Query all risk registers

POST

/risk-registers

Query and filter AI-driven risk register entries — records of
risks flagged for a user/detection by the analysis pipeline, with
severity, state, and audit metadata. Each entry ties a specific
investigation to one category from the risk register catalog
(see /risk-registers/catalog).

Relations:

person (Person): The user this risk register entry applies to

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/risk-registers' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "created_by": "user@example.com",
            "detection_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "investigation_id": "8CA67511-744C-4D74-B26E-7281CF88712F",
            "logged_action": "string",
            "name": "Source code exfiltration to personal GitHub",
            "person_id": "alan@example.com",
            "rationale": "string",
            "risk_register_kind": "custom",
            "severity": "critical",
            "state": "suggestion"
        }
    ]
}

Modified at 2026-07-24 15:31:52

Get a remote machine by id

Query all risk register catalog entries