Security Rating and Vendor Risk API: UpGuard CyberRisk

Pull vendor security ratings, third party risks, CVE vulnerabilities, attack surface domains and IPs, identity breaches and data leak disclosures from the UpGuard CyberRisk API with your own API key, as one clean dataset row per record.

UpGuard CyberRisk scores organisations from 0 to 950 on their external security posture (website security, email security, network security, encryption, DNS, IP and domain reputation, vulnerability management, attack surface and data leakage) and tracks the risks behind each score. This actor wraps its read only public API on cyber-risk.upguard.com, so you can export your vendor portfolio, follow score and risk changes over time, and feed security ratings into GRC tools, vendor risk management workflows, SIEM and BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every path, parameter and field comes from UpGuard's published Swagger document (version 1.13.2), and every route was probed on 2026-10-23 with an invalid key (403 on real routes, 404 on invented ones). The actor has not been run against a live UpGuard key.

What it does

• Vendor security rating: overall, automated and questionnaire scores, category scores, risk counts by severity and category, industry average, scores now, 1 month, 3 months and 1 year ago, tier, labels, assessment status and vendor metadata, by hostname or vendor ID.
• Monitored vendors: your whole third party portfolio with scores, category scores, tiers, labels and an optional risk summary, paged to any size.
• Vendors affected by a risk: every vendor failing a given risk, such as a specific CVE, with score, tier, detection date and waiver status, filtered by score range, tier, label or name.
• Vendor risks, risk changes and vulnerabilities: each active risk with severity, finding, description, remediation, hostnames and waivers; risks introduced or resolved between two dates; potential CVEs with CVSS, EPSS and known exploited flags.
• Vendor domains and IPs: a vendor's attack surface with per domain and per IP scores, owners, ASNs, countries and services.
• Your organisation: your own security rating, risks, risk changes, vulnerabilities, domains, IPs, typosquat domains, and full scan check results for single domains and IPs.
• Identity breaches and data leaks: breached employee identities with the breaches they appear in and exposed data classes, and data leak disclosures with severity, status and source.
• Risk catalogue: every risk UpGuard checks, with category, severity and remediation.
• Pay only for results: refused, unmonitored and empty lookups are recorded as a free row that says why, never charged.

Nothing in your UpGuard account is created or changed. The actor only sends GET requests, never starts monitoring a vendor and never spends an ad hoc report.

How to use it

1. In UpGuard CyberRisk, open Account Settings, API, and create an API key. Select the permissions for the modes you plan to use: VendorRisk for vendor modes, BreachRisk for your own domains, IPs, risks and vulnerabilities, Platform for your own rating, IdentityBreaches for identity breaches and DataLeaks for data leak disclosures.
2. Paste the key into the API key field (or set the DATA_API_KEY secret). It is sent only to cyber-risk.upguard.com in the Authorization header and is removed from everything the actor logs.
3. Pick a mode, add vendors, hostnames or filters, and start the run. Download the rows as JSON, CSV or Excel, or schedule the actor to track scores over time.

A missing or rejected key ends the run cleanly with a status message that says what to change.

Input

Field	Modes	Description
mode	all	vendorRating (default), monitoredVendors, vendorsWithRisk, vendorRisks, vendorRiskChanges, vendorVulnerabilities, vendorDomains, vendorIps, organisationRating, organisationRisks, organisationRiskChanges, organisationVulnerabilities, organisationDomains, organisationIps, domainDetails, ipDetails, identityBreaches, dataLeakDisclosures, typosquatDomains or riskCatalogue
vendors	vendor modes	Vendor primary hostnames such as upguard.com; the rating mode also takes vendor IDs
hostnames, ips	domain and IP scan details	Your own active domains or IP addresses
riskId	vendors affected by a risk	Risk ID from the catalogue or a risk row
minSeverity	risks	info, low, medium, high or critical
includeSources, includeMeta, excludeHostnames	risks and risk changes	Detection sources, per hostname metadata, smaller rows
startDate, endDate	risk changes, data leak disclosures	YYYY-MM-DD; vendor risk changes span at most 30 days
domainStatus, labels, domainSortBy, ipSortBy, breachSortBy, sortDescending	lists	Active or inactive domains, UpGuard labels and sort order
includeVendorRisks, includeAdHocReports	monitored vendors	Risk summary per vendor, ad hoc report vendors
waitForScan	vendor security rating	Wait for the first scan of a new vendor
minScore, maxScore, namePrefix, vendorTiers	vendors affected by a risk	Score range 0 to 950, name prefix, tiers 1 to 5
breachId	identity breaches	One breach
disclosureStatuses, disclosureIds	data leak disclosures	Statuses such as Disclosed or Remediating, IDs
riskCategory, riskSeverity	risk catalogue	Category and exact severity
maxResults	all	Row ceiling for the run (default 100)
requestsPerMinute	all	Pacing, default 60
apiKey	all	Your UpGuard API key (or the DATA_API_KEY secret)

Example: security ratings for three monitored vendors.

{
    "mode": "vendorRating",
    "vendors": ["vendor-one.example", "vendor-two.example", "123456789"]
}

Example: high and critical risks a vendor gained or lost this month.

{
    "mode": "vendorRiskChanges",
    "vendors": ["vendor-one.example"],
    "startDate": "2026-10-01",
    "includeSources": true
}

Example output

An illustrative vendor security rating row (values are an example, not real data). Every field UpGuard returns is kept next to the summary columns.

{
    "mode": "vendorRating",
    "modeLabel": "Vendor security rating",
    "recordType": "vendorRating",
    "query": "vendor-one.example",
    "found": true,
    "vendorName": "Vendor One",
    "vendorHostname": "vendor-one.example",
    "vendorId": 123456789,
    "securityScore": 812,
    "overallScore": 812,
    "automatedScore": 798,
    "categoryScores": { "websiteSecurity": 840, "emailSecurity": 950, "networkSecurity": 760, "encryption": 900, "vulnerabilityManagement": 720 },
    "overall_risk_counts": { "critical": 0, "high": 2, "medium": 7, "low": 12 },
    "industry_sector": "Technology",
    "industry_average_score": 760,
    "tier": 1,
    "labels": ["Critical supplier"],
    "scores_by_epoch": [{ "epoch": "now", "overall": 812 }, { "epoch": "1 month ago", "overall": 790 }],
    "retrievedAt": "2026-10-23T12:00:00.000Z",
    "note": null
}

Risk rows carry riskName, riskSeverity, riskCategory, detectedAt and the full risk with remediation and hostnames. Risk change rows add changeType (introduced or resolved) and riskGroup. Vulnerability rows carry cveId, cvss, epss, assetHostname and known_exploited_vulnerability. Domain and IP rows carry assetHostname or assetIp and securityScore; scan detail rows add failedCheckCount and every check result. Breached identity rows carry breachNames, riskSeverity and the matching breaches.

Pricing

Event	Price	Charged for
security-rating	0.02 USD	Each vendor or organisation security rating
vendor-summary	0.01 USD	Each monitored vendor, or vendor affected by a risk
risk-finding	0.008 USD	Each risk, risk change or CVE vulnerability
asset-detail	0.01 USD	Each domain or IP with full scan check results
asset-record	0.005 USD	Each domain, IP or typosquat domain in a list
breach-record	0.01 USD	Each breached identity or data leak disclosure
risk-reference	0.005 USD	Each risk catalogue entry

Refused, unmonitored, not yet scanned and empty lookups are never charged. Your UpGuard subscription is billed separately by UpGuard.

FAQ

What is the UpGuard CyberRisk API?

It is the public REST API of UpGuard CyberRisk, a third party risk management and attack surface management platform. It serves vendor security ratings from 0 to 950, category scores, risks, vulnerabilities, domains, IPs, identity breaches, data leak disclosures and questionnaires for the vendors and organisation in your UpGuard account, at cyber-risk.upguard.com/api/public.

Do I need my own UpGuard API key?

Yes. This is a bring your own key actor: it calls UpGuard with your key, under your subscription and its terms. Create the key in UpGuard CyberRisk under Account Settings, API, with the permissions your modes need.

Can I get the security rating of any company?

You get ratings for vendors you monitor in UpGuard, or vendors you already have an ad hoc report for. Any other vendor comes back as a free row saying the API refused it. The actor never starts monitoring a vendor or uses your ad hoc report allowance on its own; do that in UpGuard first if you want a new vendor.

How do I track vendor score changes over time?

Run Vendor security rating on a schedule: each row carries the current scores plus scores_by_epoch with the scores 1 month, 3 months and 1 year ago. For the risks behind a change, run Vendor risk changes with a start date up to 30 days back.

How do I find every vendor exposed to a new CVE?

Run Risk catalogue or Vendor risks to get the risk ID (CVE risks look like verified_vuln:CVE-2021-34473), then run Vendors affected by a risk with that ID. Filter by tier, score range or label to focus on critical suppliers.

Does it cover my own attack surface?

Yes. The organisation modes read your own security rating, risks, risk changes, CVEs, domains, IPs and typosquat domains, and the scan detail modes return every check run against a single domain or IP.

What do I pay?

Pay per result, from 0.005 USD per domain or catalogue entry to 0.02 USD per full security rating. Refused and empty lookups are free. See the pricing table above.

How many API requests does a run use?

One per vendor, hostname or IP for lookup modes, and one per page of up to 1,000 records for list modes. Max results stops paging early, and the run log reports the exact request count.

Keyword map

Security rating API, vendor risk API, third party risk management API, TPRM data, cyber risk score, vendor security score, security ratings export, attack surface management API, external attack surface data, CVE exposure by vendor, supply chain risk, identity breach monitoring, data leak detection, typosquatting domains, UpGuard API, UpGuard CyberRisk API, UpGuard vendor risk export, UpGuard BreachSight data.

Licensing and data use

This actor works only with your own UpGuard subscription and API key. UpGuard's Hosted Services Agreement (dated 2025-10-17) licenses the service and its data for your internal business use, is non sublicensable, and forbids using the service to build a competing product. Use the rows for your own security, vendor risk and compliance work, and do not resell, publish or redistribute UpGuard data. The agreement sets no limit on how long you may keep results. This actor is not affiliated with or endorsed by UpGuard.