# Security Rating and Vendor Risk API: UpGuard CyberRisk (`nabeelbaghoor/security-rating-vendor-risk-api`) Actor

Security ratings and vendor risk data from the UpGuard CyberRisk API: vendor scores, category scores, risks, risk changes, CVE vulnerabilities, domains, IPs, identity breaches, data leaks and typosquat domains for third party risk and attack surface monitoring. Bring your own key.

- **URL**: https://apify.com/nabeelbaghoor/security-rating-vendor-risk-api.md
- **Developed by:** [Nabeel Hassan](https://apify.com/nabeelbaghoor) (community)
- **Categories:** Developer tools, Business, Integrations
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $20.00 / 1,000 security rating returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Security Rating and Vendor Risk API: UpGuard CyberRisk

Pull vendor security ratings, third party risks, CVE vulnerabilities, attack surface domains and IPs, identity breaches and data leak disclosures from the UpGuard CyberRisk API with your own API key, as one clean dataset row per record.

UpGuard CyberRisk scores organisations from 0 to 950 on their external security posture (website security, email security, network security, encryption, DNS, IP and domain reputation, vulnerability management, attack surface and data leakage) and tracks the risks behind each score. This actor wraps its read only public API on cyber-risk.upguard.com, so you can export your vendor portfolio, follow score and risk changes over time, and feed security ratings into GRC tools, vendor risk management workflows, SIEM and BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every path, parameter and field comes from UpGuard's published Swagger document (version 1.13.2), and every route was probed on 2026-10-23 with an invalid key (403 on real routes, 404 on invented ones). The actor has not been run against a live UpGuard key.

### What it does

- **Vendor security rating**: overall, automated and questionnaire scores, category scores, risk counts by severity and category, industry average, scores now, 1 month, 3 months and 1 year ago, tier, labels, assessment status and vendor metadata, by hostname or vendor ID.
- **Monitored vendors**: your whole third party portfolio with scores, category scores, tiers, labels and an optional risk summary, paged to any size.
- **Vendors affected by a risk**: every vendor failing a given risk, such as a specific CVE, with score, tier, detection date and waiver status, filtered by score range, tier, label or name.
- **Vendor risks, risk changes and vulnerabilities**: each active risk with severity, finding, description, remediation, hostnames and waivers; risks introduced or resolved between two dates; potential CVEs with CVSS, EPSS and known exploited flags.
- **Vendor domains and IPs**: a vendor's attack surface with per domain and per IP scores, owners, ASNs, countries and services.
- **Your organisation**: your own security rating, risks, risk changes, vulnerabilities, domains, IPs, typosquat domains, and full scan check results for single domains and IPs.
- **Identity breaches and data leaks**: breached employee identities with the breaches they appear in and exposed data classes, and data leak disclosures with severity, status and source.
- **Risk catalogue**: every risk UpGuard checks, with category, severity and remediation.
- **Pay only for results**: refused, unmonitored and empty lookups are recorded as a free row that says why, never charged.

Nothing in your UpGuard account is created or changed. The actor only sends GET requests, never starts monitoring a vendor and never spends an ad hoc report.

### How to use it

1. In UpGuard CyberRisk, open Account Settings, API, and create an API key. Select the permissions for the modes you plan to use: VendorRisk for vendor modes, BreachRisk for your own domains, IPs, risks and vulnerabilities, Platform for your own rating, IdentityBreaches for identity breaches and DataLeaks for data leak disclosures.
2. Paste the key into the API key field (or set the DATA_API_KEY secret). It is sent only to cyber-risk.upguard.com in the Authorization header and is removed from everything the actor logs.
3. Pick a mode, add vendors, hostnames or filters, and start the run. Download the rows as JSON, CSV or Excel, or schedule the actor to track scores over time.

A missing or rejected key ends the run cleanly with a status message that says what to change.

### Input

| Field | Modes | Description |
| --- | --- | --- |
| `mode` | all | `vendorRating` (default), `monitoredVendors`, `vendorsWithRisk`, `vendorRisks`, `vendorRiskChanges`, `vendorVulnerabilities`, `vendorDomains`, `vendorIps`, `organisationRating`, `organisationRisks`, `organisationRiskChanges`, `organisationVulnerabilities`, `organisationDomains`, `organisationIps`, `domainDetails`, `ipDetails`, `identityBreaches`, `dataLeakDisclosures`, `typosquatDomains` or `riskCatalogue` |
| `vendors` | vendor modes | Vendor primary hostnames such as upguard.com; the rating mode also takes vendor IDs |
| `hostnames`, `ips` | domain and IP scan details | Your own active domains or IP addresses |
| `riskId` | vendors affected by a risk | Risk ID from the catalogue or a risk row |
| `minSeverity` | risks | `info`, `low`, `medium`, `high` or `critical` |
| `includeSources`, `includeMeta`, `excludeHostnames` | risks and risk changes | Detection sources, per hostname metadata, smaller rows |
| `startDate`, `endDate` | risk changes, data leak disclosures | YYYY-MM-DD; vendor risk changes span at most 30 days |
| `domainStatus`, `labels`, `domainSortBy`, `ipSortBy`, `breachSortBy`, `sortDescending` | lists | Active or inactive domains, UpGuard labels and sort order |
| `includeVendorRisks`, `includeAdHocReports` | monitored vendors | Risk summary per vendor, ad hoc report vendors |
| `waitForScan` | vendor security rating | Wait for the first scan of a new vendor |
| `minScore`, `maxScore`, `namePrefix`, `vendorTiers` | vendors affected by a risk | Score range 0 to 950, name prefix, tiers 1 to 5 |
| `breachId` | identity breaches | One breach |
| `disclosureStatuses`, `disclosureIds` | data leak disclosures | Statuses such as Disclosed or Remediating, IDs |
| `riskCategory`, `riskSeverity` | risk catalogue | Category and exact severity |
| `maxResults` | all | Row ceiling for the run (default 100) |
| `requestsPerMinute` | all | Pacing, default 60 |
| `apiKey` | all | Your UpGuard API key (or the DATA_API_KEY secret) |

Example: security ratings for three monitored vendors.

```json
{
    "mode": "vendorRating",
    "vendors": ["vendor-one.example", "vendor-two.example", "123456789"]
}
```

Example: high and critical risks a vendor gained or lost this month.

```json
{
    "mode": "vendorRiskChanges",
    "vendors": ["vendor-one.example"],
    "startDate": "2026-10-01",
    "includeSources": true
}
```

### Example output

An illustrative vendor security rating row (values are an example, not real data). Every field UpGuard returns is kept next to the summary columns.

```json
{
    "mode": "vendorRating",
    "modeLabel": "Vendor security rating",
    "recordType": "vendorRating",
    "query": "vendor-one.example",
    "found": true,
    "vendorName": "Vendor One",
    "vendorHostname": "vendor-one.example",
    "vendorId": 123456789,
    "securityScore": 812,
    "overallScore": 812,
    "automatedScore": 798,
    "categoryScores": { "websiteSecurity": 840, "emailSecurity": 950, "networkSecurity": 760, "encryption": 900, "vulnerabilityManagement": 720 },
    "overall_risk_counts": { "critical": 0, "high": 2, "medium": 7, "low": 12 },
    "industry_sector": "Technology",
    "industry_average_score": 760,
    "tier": 1,
    "labels": ["Critical supplier"],
    "scores_by_epoch": [{ "epoch": "now", "overall": 812 }, { "epoch": "1 month ago", "overall": 790 }],
    "retrievedAt": "2026-10-23T12:00:00.000Z",
    "note": null
}
```

Risk rows carry `riskName`, `riskSeverity`, `riskCategory`, `detectedAt` and the full risk with remediation and hostnames. Risk change rows add `changeType` (introduced or resolved) and `riskGroup`. Vulnerability rows carry `cveId`, `cvss`, `epss`, `assetHostname` and `known_exploited_vulnerability`. Domain and IP rows carry `assetHostname` or `assetIp` and `securityScore`; scan detail rows add `failedCheckCount` and every check result. Breached identity rows carry `breachNames`, `riskSeverity` and the matching breaches.

### Pricing

| Event | Price | Charged for |
| --- | --- | --- |
| `security-rating` | 0.02 USD | Each vendor or organisation security rating |
| `vendor-summary` | 0.01 USD | Each monitored vendor, or vendor affected by a risk |
| `risk-finding` | 0.008 USD | Each risk, risk change or CVE vulnerability |
| `asset-detail` | 0.01 USD | Each domain or IP with full scan check results |
| `asset-record` | 0.005 USD | Each domain, IP or typosquat domain in a list |
| `breach-record` | 0.01 USD | Each breached identity or data leak disclosure |
| `risk-reference` | 0.005 USD | Each risk catalogue entry |

Refused, unmonitored, not yet scanned and empty lookups are never charged. Your UpGuard subscription is billed separately by UpGuard.

### FAQ

#### What is the UpGuard CyberRisk API?

It is the public REST API of UpGuard CyberRisk, a third party risk management and attack surface management platform. It serves vendor security ratings from 0 to 950, category scores, risks, vulnerabilities, domains, IPs, identity breaches, data leak disclosures and questionnaires for the vendors and organisation in your UpGuard account, at cyber-risk.upguard.com/api/public.

#### Do I need my own UpGuard API key?

Yes. This is a bring your own key actor: it calls UpGuard with your key, under your subscription and its terms. Create the key in UpGuard CyberRisk under Account Settings, API, with the permissions your modes need.

#### Can I get the security rating of any company?

You get ratings for vendors you monitor in UpGuard, or vendors you already have an ad hoc report for. Any other vendor comes back as a free row saying the API refused it. The actor never starts monitoring a vendor or uses your ad hoc report allowance on its own; do that in UpGuard first if you want a new vendor.

#### How do I track vendor score changes over time?

Run Vendor security rating on a schedule: each row carries the current scores plus `scores_by_epoch` with the scores 1 month, 3 months and 1 year ago. For the risks behind a change, run Vendor risk changes with a start date up to 30 days back.

#### How do I find every vendor exposed to a new CVE?

Run Risk catalogue or Vendor risks to get the risk ID (CVE risks look like verified_vuln:CVE-2021-34473), then run Vendors affected by a risk with that ID. Filter by tier, score range or label to focus on critical suppliers.

#### Does it cover my own attack surface?

Yes. The organisation modes read your own security rating, risks, risk changes, CVEs, domains, IPs and typosquat domains, and the scan detail modes return every check run against a single domain or IP.

#### What do I pay?

Pay per result, from 0.005 USD per domain or catalogue entry to 0.02 USD per full security rating. Refused and empty lookups are free. See the pricing table above.

#### How many API requests does a run use?

One per vendor, hostname or IP for lookup modes, and one per page of up to 1,000 records for list modes. Max results stops paging early, and the run log reports the exact request count.

### Keyword map

Security rating API, vendor risk API, third party risk management API, TPRM data, cyber risk score, vendor security score, security ratings export, attack surface management API, external attack surface data, CVE exposure by vendor, supply chain risk, identity breach monitoring, data leak detection, typosquatting domains, UpGuard API, UpGuard CyberRisk API, UpGuard vendor risk export, UpGuard BreachSight data.

### Licensing and data use

This actor works only with your own UpGuard subscription and API key. UpGuard's Hosted Services Agreement (dated 2025-10-17) licenses the service and its data for your internal business use, is non sublicensable, and forbids using the service to build a competing product. Use the rows for your own security, vendor risk and compliance work, and do not resell, publish or redistribute UpGuard data. The agreement sets no limit on how long you may keep results. This actor is not affiliated with or endorsed by UpGuard.

# Actor input Schema

## `mode` (type: `string`):

Vendor modes read third party data for vendors you monitor in UpGuard CyberRisk (key permission VendorRisk). Your organisation modes read your own attack surface (BreachRisk; the rating needs Platform). Identity breaches need IdentityBreaches and data leak disclosures need DataLeaks. Every call is a read only GET.

## `vendors` (type: `array`):

Vendor modes. One vendor primary hostname per line, such as upguard.com. The security rating mode also takes a numeric UpGuard vendor ID. Ratings come back for vendors you monitor or have an ad hoc report for; this actor never starts monitoring a vendor.

## `hostnames` (type: `array`):

Domain scan details only. One of your own active domains per line. An inactive domain is refused by the API and not charged.

## `ips` (type: `array`):

IP scan details only. One of your own active IPv4 or IPv6 addresses per line.

## `riskId` (type: `string`):

Vendors affected by a risk only. The risk ID to look for, 4 to 120 characters, as the Risk catalogue or Vendor risks modes list it, such as a CVE risk like verified_vuln:CVE-2021-34473.

## `minSeverity` (type: `string`):

Vendor risks and your organisation risks. Only risks of this severity or higher.

## `includeSources` (type: `boolean`):

Risk and risk change modes. Adds the hostnames and IP addresses each risk was detected on, with ports when available.

## `includeMeta` (type: `boolean`):

Vendor risks and your organisation risks. Adds per hostname metadata for each risk. Cannot be combined with exclude hostnames.

## `excludeHostnames` (type: `boolean`):

Vendor risks only. Leaves out the list of hostnames on each risk for a smaller row.

## `startDate` (type: `string`):

Risk change modes: required, YYYY-MM-DD within the last 2 years; vendor risk changes allow at most 30 days to the end date. Data leak disclosures: optional, only disclosures after this date.

## `endDate` (type: `string`):

Risk change modes and data leak disclosures, optional, YYYY-MM-DD. Empty means the latest state.

## `domainStatus` (type: `string`):

Vendor domains and your organisation domains.

## `labels` (type: `array`):

Monitored vendors, vendors affected by a risk, domain, IP and organisation vulnerability lists. Only records with these UpGuard labels. A label that does not exist may be refused by the API.

## `domainSortBy` (type: `string`):

Vendor domains and your organisation domains.

## `ipSortBy` (type: `string`):

Vendor IPs and your organisation IPs.

## `breachSortBy` (type: `string`):

Identity breaches only.

## `sortDescending` (type: `boolean`):

Domain, IP and identity breach lists. Sorts the chosen field from highest to lowest.

## `includeVendorRisks` (type: `boolean`):

Monitored vendors only. Adds a summary list of each vendor's risks.

## `includeAdHocReports` (type: `boolean`):

Monitored vendors only. Also lists vendors you have an existing ad hoc report for.

## `waitForScan` (type: `boolean`):

Vendor security rating only. Asks the API to wait for scan results on a vendor UpGuard has not seen before, instead of answering that it was scheduled.

## `minScore` (type: `integer`):

Vendors affected by a risk only. Only vendors with a score of at least this value (0 to 950).

## `maxScore` (type: `integer`):

Vendors affected by a risk only. Only vendors with a score of at most this value (0 to 950).

## `namePrefix` (type: `string`):

Vendors affected by a risk only. Only vendors whose name starts with this text, ignoring case.

## `vendorTiers` (type: `array`):

Vendors affected by a risk only. Only watched vendors in these tiers.

## `breachId` (type: `string`):

Identity breaches only. Only identities in this breach, using the breach ID from an earlier identity breaches row.

## `disclosureStatuses` (type: `array`):

Data leak disclosures only. Only disclosures in these statuses. Empty means every status.

## `disclosureIds` (type: `array`):

Data leak disclosures only, optional. Numeric disclosure IDs to read.

## `riskCategory` (type: `string`):

Risk catalogue only, optional. Only risks in this category, as the catalogue names it.

## `riskSeverity` (type: `string`):

Risk catalogue only. Only risks of exactly this severity.

## `maxResults` (type: `integer`):

The most rows this run returns and charges for. Paged lists stop asking for pages once this is reached.

## `requestsPerMinute` (type: `integer`):

Pacing for calls to cyber-risk.upguard.com. Throttled calls are retried after a pause.

## `apiKey` (type: `string`):

Your own UpGuard CyberRisk API key, from Account Settings, API, with the permissions for the modes you use. Stored as a secret and sent only to cyber-risk.upguard.com in the Authorization header; it is never logged. You can instead set the DATA_API_KEY environment secret.

## Actor input object example

```json
{
  "mode": "vendorRating",
  "vendors": [
    "upguard.com"
  ],
  "minSeverity": "info",
  "includeSources": false,
  "includeMeta": false,
  "excludeHostnames": false,
  "domainStatus": "all",
  "domainSortBy": "domain",
  "ipSortBy": "ip",
  "breachSortBy": "date_last_breach",
  "sortDescending": false,
  "includeVendorRisks": false,
  "includeAdHocReports": false,
  "waitForScan": false,
  "riskSeverity": "any",
  "maxResults": 100,
  "requestsPerMinute": 60
}
```

# Actor output Schema

## `records` (type: `string`):

One row per record the chosen mode returns.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "vendors": [
        "upguard.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("nabeelbaghoor/security-rating-vendor-risk-api").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "vendors": ["upguard.com"] }

# Run the Actor and wait for it to finish
run = client.actor("nabeelbaghoor/security-rating-vendor-risk-api").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "vendors": [
    "upguard.com"
  ]
}' |
apify call nabeelbaghoor/security-rating-vendor-risk-api --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,nabeelbaghoor/security-rating-vendor-risk-api"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/5YPexSw3VTuiM7iag/builds/C5S31jmBxi2TI7VfL/openapi.json