> ## Documentation Index
> Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get risk map

> Per-system risk levels by category. Results are computed from the most recent 5,000 events in the period.

**Required permission:** `observe:read`




## OpenAPI

````yaml /api-reference/openapi.yaml get /api/v1/observe/risk-map
openapi: 3.1.0
info:
  title: Igris Management API
  version: '1'
  description: >-
    REST API for managing Igris connections, policies, sessions, audit events
    and alerts.
servers:
  - url: https://api.igrisecurity.com
security:
  - bearerAuth: []
tags:
  - name: Connections
  - name: Policies
  - name: Sessions
  - name: Audit Events
  - name: Incidents
  - name: Webhooks
  - name: API Keys
  - name: Members
  - name: LLM Providers
  - name: LLM Cost
  - name: Observe
paths:
  /api/v1/observe/risk-map:
    get:
      tags:
        - Observe
      summary: Get risk map
      description: >
        Per-system risk levels by category. Results are computed from the most
        recent 5,000 events in the period.


        **Required permission:** `observe:read`
      operationId: getRiskMap
      parameters:
        - $ref: '#/components/parameters/PeriodParam'
      responses:
        '200':
          description: The risk map.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/RiskMap'
              example:
                data:
                  systems:
                    - github-prod
                  categories:
                    - pii_exposure
                    - injection_attempts
                    - policy_violations
                    - anomalies
                  cells:
                    - systemId: github-prod
                      category: anomalies
                      count: 1
                      highestSeverity: high
                      level: red
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  parameters:
    PeriodParam:
      name: period
      in: query
      schema:
        $ref: '#/components/schemas/Period'
  schemas:
    RiskMap:
      type: object
      properties:
        systems:
          type: array
          items:
            type: string
          description: MCP server ids seen in the period.
        categories:
          type: array
          items:
            type: string
            enum:
              - pii_exposure
              - injection_attempts
              - policy_violations
              - anomalies
        cells:
          type: array
          items:
            type: object
            properties:
              systemId:
                type: string
              category:
                type: string
                enum:
                  - pii_exposure
                  - injection_attempts
                  - policy_violations
                  - anomalies
              count:
                type: integer
              highestSeverity:
                type:
                  - string
                  - 'null'
              level:
                type: string
                enum:
                  - green
                  - amber
                  - red
    Period:
      type: string
      enum:
        - day
        - week
        - month
      default: week
      description: >-
        `day` is 24 hours, `week` 7 days, `month` 30 days. Any other value is
        treated as `week`.
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
    ForbiddenError:
      type: object
      properties:
        error:
          type: string
          example: Forbidden
        required:
          type: string
          description: The permission the caller lacks.
          example: policies:write
  responses:
    Unauthorized:
      description: No valid session or API key, or the key's creator is no longer a member.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Unauthorized
    Forbidden:
      description: The caller lacks the required permission.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenError'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: ig_...
      description: >-
        An Igris API key. It acts with the current role and permission overrides
        of the member who created it.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.