UpGuard userrisk API

swagger: '2.0'
info:
  description: 'Access information from the CyberRisk platform programmatically using this API.


    You can find or generate an API key to access this API in your CyberRisk Account Settings.

    Please authorize all requests by setting the "Authorization" header to your api key.


    The base url for all public endpoints is https://cyber-risk.upguard.com/api/public'
  title: UpGuard CyberRisk breaches userrisk API
  version: 1.13.2
host: cyber-risk.upguard.com
basePath: /api/public
schemes:
- https
consumes:
- application/json
produces:
- application/json
security:
- API key in header: []
tags:
- name: userrisk
paths:
  /user_risk/app_categories/list:
    get:
      description: 'Retrieve a list of app categories for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app categories
      operationId: getUserRiskAppCategoriesList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      responses:
        '200':
          description: A list of app categories for your organization
          schema:
            $ref: '#/definitions/GetUserRiskAppCategoriesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/apps/list:
    get:
      description: 'Retrieve a list of apps for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List apps
      operationId: getUserRiskAppsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - first_detected
        - num_users
        - exposure_level
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - enum:
        - approve
        - tolerate
        - nudge
        - block
        type: array
        items:
          type: string
          format: string
        collectionFormat: multi
        description: Filter applications by usage policy outcome. Matches the policy base rule or any custom rule.
        name: usage_policy_outcomes
        in: query
      - enum:
        - org_default
        - app
        type: array
        items:
          type: string
          format: string
        collectionFormat: multi
        description: Filter applications by where their usage policy is derived from.
        name: usage_policy_sources
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter applications by category.
        name: categories
        in: query
      - enum:
        - browser
        - google
        - microsoft
        type: array
        items:
          type: string
          format: string
        collectionFormat: multi
        description: Filter applications by source.
        name: sources
        in: query
      - type: boolean
        description: Filter applications by Shadow AI status.
        name: shadow_ai
        in: query
      - type: boolean
        description: Filter applications by AI usage.
        name: vendor_using_ai
        in: query
      - type: boolean
        description: Filter applications by vendor monitoring status.
        name: vendor_monitored
        in: query
      - type: string
        format: date-time
        description: Filter applications first detected after or at this date-time.
        name: first_detected_min
        in: query
      - type: string
        format: date-time
        description: Filter applications first detected before or at this date-time.
        name: first_detected_max
        in: query
      responses:
        '200':
          description: The list of apps for your organization
          schema:
            $ref: '#/definitions/UserRiskAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/apps/permissions/list:
    get:
      description: 'Retrieve a list of permissions granted to a specific application.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app permissions
      operationId: getUserRiskAppsPermissionsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - exposure_level
        - num_users
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The name of the application.
        name: app_name
        in: query
        required: true
      responses:
        '200':
          description: A list of permissions granted to the application
          schema:
            $ref: '#/definitions/GetUserRiskAppsPermissionsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/apps/users/list:
    get:
      description: 'Retrieve a list of users using a specific application.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app users
      operationId: getUserRiskAppUsersList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - id
        - email
        - name
        - risk_rating
        type: string
        description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The name of the application.
        name: app_name
        in: query
        required: true
      responses:
        '200':
          description: The list of users using the application
          schema:
            $ref: '#/definitions/UserRiskAppUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/identity_breaches/list:
    get:
      description: 'Retrieve a list of identity breaches for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List identity breaches
      operationId: getUserRiskIdentityBreachesList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - title
        - breach_date
        - published_date
        type: string
        description: The field to sort results by. Default is `title`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - enum:
        - active
        - ignored
        - remediated
        type: array
        items:
          type: string
          format: string
        collectionFormat: multi
        description: Filter identity breaches by status.
        name: statuses
        in: query
      - type: string
        description: Filter identity breaches that occurred after or at this date-time.
        name: breach_date_min
        in: query
      - type: string
        description: Filter identity breaches that occurred before or at this date-time.
        name: breach_date_max
        in: query
      - type: string
        description: Filter identity breaches published after or at this date-time.
        name: published_date_min
        in: query
      - type: string
        description: Filter identity breaches published before or at this date-time.
        name: published_date_max
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter identity breaches by exposed data classes.
        name: data_classes
        in: query
      responses:
        '200':
          description: A list of identity breaches
          schema:
            $ref: '#/definitions/IdentityBreachesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/identity_breaches/users/list:
    get:
      description: 'Retrieve a list of users involved in a specific identity breach.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List identity breach users
      operationId: listIdentityBreachUsers
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - id
        - email
        - name
        - risk_rating
        type: string
        description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The unique identifier of the identity breach.
        name: id
        in: query
        required: true
      responses:
        '200':
          description: A list of users involved in the identity breach
          schema:
            $ref: '#/definitions/IdentityBreachUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/permissions/apps/list:
    get:
      description: 'Retrieve a list of applications that were granted a specific permission.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permission apps
      operationId: getUserRiskPermissionsAppsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - first_detected
        - num_users
        - exposure_level
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The unique identifier of the permission.
        name: id
        in: query
        required: true
      responses:
        '200':
          description: A list of apps that were granted the permission
          schema:
            $ref: '#/definitions/GetUserRiskPermissionsAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/permissions/list:
    get:
      description: 'Retrieve a list of permissions for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permissions
      operationId: getUserRiskPermissionsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - id
        - name
        - exposure_level
        - times_granted
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter permissions by category.
        name: categories
        in: query
      - enum:
        - read_only
        - read_write
        type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter permissions by access level.
        name: access_level
        in: query
      - enum:
        - basic
        - elevated
        type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter permissions by exposure level.
        name: exposure_level
        in: query
      responses:
        '200':
          description: A list of permissions for your organization
          schema:
            $ref: '#/definitions/GetUserRiskPermissionsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/permissions/users/list:
    get:
      description: 'Retrieve a list of users who granted a specific permission.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permission users
      operationId: getUserRiskPermissionsUsersList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - id
        - email
        - name
        - risk_rating
        type: string
        description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The unique identifier of the permission.
        name: id
        in: query
        required: true
      responses:
        '200':
          description: A list of users who granted the permission
          schema:
            $ref: '#/definitions/GetUserRiskPermissionsUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/roles/list:
    get:
      description: 'Retrieve a list of roles for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List roles
      operationId: getUserRiskRolesList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - user_count
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      responses:
        '200':
          description: A list of roles for your organization
          schema:
            $ref: '#/definitions/GetUserRiskRolesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/teams/list:
    get:
      description: 'Retrieve a list of teams for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List teams
      operationId: getUserRiskTeamsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - user_count
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      responses:
        '200':
          description: A list of teams for your organization
          schema:
            $ref: '#/definitions/GetUserRiskTeamsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/users/apps/list:
    get:
      description: 'Retrieve a list of apps used by a specific user.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List a user apps
      operationId: getUserRiskUserAppsList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - name
        - first_detected
        - exposure_level
        type: string
        description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The ID of the user to retrieve the apps for
        name: id
        in: query
        required: true
      responses:
        '200':
          description: The list of app for a user
          schema:
            $ref: '#/definitions/UserRiskUseAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/users/identity_breaches/list:
    get:
      description: 'Retrieve a list of identity breaches a user was involved in.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List a user identity breaches
      operationId: getUserRiskUserIdentityBreachesList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - title
        - breach_date
        - published_date
        type: string
        description: The field to sort results by. Default is `title`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: string
        description: The ID of the user to retrieve the identity breaches for
        name: id
        in: query
        required: true
      responses:
        '200':
          description: The list of identity breaches the user was involved in
          schema:
            $ref: '#/definitions/UserIdentityBreachesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/users/list:
    get:
      description: 'Retrieve the list of users for your organization.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List users
      operationId: getUserRiskUsersList
      parameters:
      - type: integer
        format: int64
        description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
      - type: string
        description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
      - enum:
        - id
        - email
        - name
        - risk_rating
        type: string
        description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
      - enum:
        - asc
        - desc
        type: string
        description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Limit the users to the ones belonging to the provided teams.
        name: teams
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Limit the users to the ones with the provided roles.
        name: roles
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Limit the users to the ones using the provided apps.
        name: app_names
        in: query
      responses:
        '200':
          description: The list of users in your organization
          schema:
            $ref: '#/definitions/UserRiskUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          schema:
            $ref: '#/definitions/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          schema:
            $ref: '#/definitions/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          schema:
            $ref: '#/definitions/endpointError'
        '500':
          description: An internal system error occurred
          schema:
            $ref: '#/definitions/endpointError'
  /user_risk/users/permissions/list:
    get:
      description: 'Retrieve the list of permissions granted by a specific user.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List a user permissions
      operationId: getUserRiskUserPermissionsList
      parameters:
      - type: integ

# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upguard/refs/heads/main/openapi/upguard-userrisk-api-openapi.yml