> ## Documentation Index > Fetch the complete documentation index at: https://docs.msportal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get a compliance risk > One risk with occurrences, source compliance state, linked remediation, standards references and audit history. Scope compliance.read; permission read_compliance. ## OpenAPI ````yaml /openapi.json get /api/public/v1/compliance/risks/{id} openapi: 3.0.3 info: title: MSPortal Public API version: 1.0.0 description: >- Public API for MSPortal - provides programmatic access to tenant data. ## Authentication All endpoints require authentication via API key passed as a Bearer token: ``` Authorization: Bearer ``` API keys can be created in the MSPortal dashboard under Settings → Integrations → API Access. **Important:** Do not include cookies in API requests. The public API uses stateless authentication only. ## Scopes API keys are granted specific scopes that determine what operations they can perform. Each endpoint documents its required scope(s). ## Rate Limiting API calls are rate limited per API key. Rate limit information is returned in response headers: - `X-RateLimit-Limit`: Maximum requests per minute - `X-RateLimit-Remaining`: Remaining requests in current window - `X-RateLimit-Reset`: When the rate limit resets (ISO 8601) ## Request ID All responses include an `X-Request-Id` header for debugging and support. You can also pass your own `X-Request-Id` header to correlate requests. contact: name: MSPortal Support email: support@msportal.ai license: name: Proprietary servers: - url: https://app.msportal.ai description: Production (US) - url: https://eu.msportal.ai description: Production (EU) security: - BearerAuth: [] tags: - name: Budgets description: >- Budget management - create, track, and forecast budgets with line items, categories, and products - name: Calendar description: Calendar and meeting management - events, participants, and meeting types - name: Companies description: Company management endpoints - name: Company Users description: Company user management - client portal contacts (read-only, paginated) - name: Compliance description: Compliance check management - runs, assigned checks, and status updates - name: Dashboards description: Dashboard management - external iframe resources and internal dashboards - name: Devices description: Device management - inventory, types, and locations - name: Goals description: Goal management - create, track, and manage goals with tasks and updates - name: NPS Surveys description: >- NPS survey management - Net Promoter Score surveys, responses, and analytics - name: Reports description: >- Report management - create, manage, and schedule reports with templates and types - name: Planner description: >- Planner item management - tasks, roadmap items, and project planning with linked goals, compliance, and projects - name: Surveys description: >- General survey management - multi-question surveys, responses, and statistics - name: Tickets description: Ticket management - view and filter tickets from PSA integrations - name: Training description: >- Training management - courses, enrollments, certificates, and progress tracking - name: Users description: Tenant user management - internal staff and team members (read-only) - name: Automation Rules description: >- Automation rule management - create, configure, and monitor automation rules with triggers, conditions, and actions - name: Analytics description: >- Analytics and reporting - company audit data, training analytics, user activity, and portfolio metrics - name: Client Onboarding description: >- Client onboarding - portals (phases, tasks, contacts, activation), templates, checklist templates, forms and documentation pages - name: Backup description: >- Backup - summaries, protected devices, alerts and SaaS protection (Datto, Axcient, Slide, Kaseya) - name: Microsoft 365 description: Microsoft 365 - licenses, users, domains and Secure Score - name: Security description: >- Security - posture summary, EDR incidents, vulnerabilities, email threats, firewalls, DNS filtering and security awareness - name: Financial description: Financial - quotes, invoices and revenue summaries - name: Integrations description: Integrations - status, sync health, pause and resume (never credentials) - name: Documentation description: >- Documentation - pages, folders and articles synced from Hudu or IT Glue, plus built-in pages - name: Broadcasts description: Broadcasts - emergency broadcasts, recipients and groups - name: Notifications description: Notifications - the linked user's in-app notifications - name: Standards description: >- Standards - technology standards catalog, service plans, applicability, deployment statuses, compliance rollups, white space and costs - name: Customer Success description: >- Customer success - client health scores, trends, benchmarks and Traffic Light Reviews - name: Tasks description: Tasks - the linked user's personal task list - name: Tenant Setup description: Tenant setup - profile, branding and portal settings (never secrets) - name: Roles description: Roles - staff and client roles and their permission grants - name: Ticket Templates description: Ticket templates - reusable ticket definitions - name: Readiness description: Client readiness - account readiness assessments - name: Projects description: >- Projects - PSA projects with health overlays (deliverables, milestones, client actions, weekly updates), phases, tickets, time entries, PSA status/owner/priority write-through, ticket notes, task controls, display settings and the document library paths: /api/public/v1/compliance/risks/{id}: get: tags: - Compliance summary: Get a compliance risk description: >- One risk with occurrences, source compliance state, linked remediation, standards references and audit history. Scope compliance.read; permission read_compliance. parameters: - schema: type: string format: uuid description: Risk ID required: true description: Risk ID name: id in: path responses: '200': description: Risk detail content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/ComplianceRiskDetail' required: - data '400': description: Validation error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- Forbidden - missing scope (compliance.read) or the linked user lacks the compliance permission content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Risk not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - BearerAuth: [] components: schemas: ComplianceRiskDetail: type: object properties: enabled: type: boolean risk: $ref: '#/components/schemas/ComplianceRisk' occurrences: type: array items: type: object properties: id: type: string format: uuid assignmentId: type: string nullable: true format: uuid runName: type: string nullable: true completedAt: type: string dueDate: type: string nullable: true isClientVisible: type: boolean required: - id - assignmentId - runName - completedAt - dueDate - isClientVisible source: type: object nullable: true additionalProperties: nullable: true description: Source compliance state, ticket and evidence dependencies: type: array items: type: object additionalProperties: nullable: true dependentRisks: type: array items: type: object additionalProperties: nullable: true history: type: array items: type: object properties: id: type: string format: uuid actionType: type: string changes: type: object nullable: true additionalProperties: nullable: true createdAt: type: string actor: type: object nullable: true properties: id: type: string nullable: true format: uuid name: type: string nullable: true avatarUrl: type: string nullable: true required: - id - name - avatarUrl required: - id - actionType - changes - createdAt - actor required: - enabled - risk - occurrences - source - dependencies - dependentRisks - history ErrorResponse: type: object properties: error: type: string description: Error message requestId: type: string description: Request correlation ID details: nullable: true description: Additional error details code: type: string description: Error code required: - error ComplianceRisk: type: object properties: id: type: string format: uuid companyId: type: string format: uuid companyName: type: string complianceCheckId: type: string nullable: true format: uuid sourceType: type: string sourceAssignmentId: type: string nullable: true format: uuid categoryId: type: string format: uuid categoryName: type: string categoryColor: type: string title: type: string riskStatement: type: string sourceTitle: type: string nullable: true sourceReferences: type: string nullable: true frameworkTags: type: array items: type: string likelihood: type: integer impact: type: integer score: type: integer severity: type: string enum: - low - medium - high - critical status: type: string enum: - open - approved - mitigating - accepted - closed ownerUserId: type: string nullable: true format: uuid ownerName: type: string nullable: true treatmentPlan: type: string nullable: true targetDate: type: string nullable: true isClientVisible: type: boolean firstDetectedAt: type: string lastDetectedAt: type: string occurrenceCount: type: integer sourceIsCompliant: type: boolean nullable: true needsAssessment: type: boolean dependencyRiskIds: type: array items: type: string format: uuid dependencyCount: type: integer dependentRiskCount: type: integer linkedRemediation: type: object nullable: true additionalProperties: nullable: true createdAt: type: string updatedAt: type: string closedAt: type: string nullable: true required: - id - companyId - companyName - complianceCheckId - sourceType - sourceAssignmentId - categoryId - categoryName - categoryColor - title - riskStatement - sourceTitle - sourceReferences - frameworkTags - likelihood - impact - score - severity - status - ownerUserId - ownerName - treatmentPlan - targetDate - isClientVisible - firstDetectedAt - lastDetectedAt - occurrenceCount - sourceIsCompliant - needsAssessment - dependencyRiskIds - dependencyCount - dependentRiskCount - linkedRemediation - createdAt - updatedAt - closedAt securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- Use your API key as a Bearer token. API keys can be generated in Settings → Integrations → API Access. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.