> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-cli/admin-rest-api/risk-management.md). # Risk Management ### Description The Risk Management endpoint provides programmatic access to security posture metrics, compliance benchmarks, and organizational KPIs captured by the Keeper [Risk Management Dashboard](/enterprise-guide/risk-management-dashboard.md). The Risk Management Dashboard tracks key utilization metrics across your Keeper Enterprise environment, including user onboarding status, vault activity, two-factor authentication adoption, and adherence to Keeper Security Benchmarks. The Risk Management endpoint exposes this data through a RESTful interface, enabling CSPM (Cloud Security Posture Management) integration and programmatic security posture assessment. ### Overview The Admin REST API Risk Management endpoint delivers comprehensive security posture data from your Keeper Enterprise environment. This capability supports critical security, compliance, and operational use cases: **Security Posture Monitoring**\ Retrieve real-time metrics on user deployment, vault utilization, and 2FA adoption. Track organizational security health across all users and identify gaps in credential protection coverage. **Compliance Automation**\ Programmatically assess adherence to Keeper Security Benchmarks. Integrate benchmark compliance status into GRC (Governance, Risk, and Compliance) platforms for automated compliance reporting against SOX, ISO 27001, HIPAA, PCI-DSS, and internal security policies. **Executive Dashboards**\ Feed security posture analytics and KPIs into business intelligence platforms for executive visibility. Track deployment progress, user adoption trends, and security benchmark remediation over time. **CSPM Integration**\ Incorporate Keeper security posture data into your Cloud Security Posture Management stack. Automate detection of misconfigurations and track remediation progress across your credential management environment. ### Prerequisites * Active Keeper Enterprise subscription * [Advanced Reporting and Alerts Module (ARAM)](/enterprise-guide/event-reporting.md) add-on enabled * Administrative privileges with reporting permissions * Valid API authentication credentials ### Key Metrics Available The endpoint provides access to the following security posture data: | Metric Category | Description | | ------------------- | --------------------------------------------------------------------- | | User Deployment | Total users, active users, invited users, invitation acceptance rates | | Vault Utilization | Users who have created records, record creation activity | | Login Activity | Users logged in within 30 days, last login timestamps | | 2FA Adoption | Users with 2FA-protected vaults (non-SSO environments) | | License Utilization | Active licenses, available licenses, utilization percentage | | Security Benchmarks | Critical items to resolve, completed benchmarks, ignored benchmarks | | Security Alerts | High-priority alert counts, occurrence trends, 30-day comparisons | ### Enterprise Statistics **Endpoint** ``` GET /api/rest/public/security_posture/get_enterprise_stat ``` **Purpose**\ Retrieve Risk Management recent login count. **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** 
curl 'https://keepersecurity.com/api/rest/public/security_posture/get_enterprise_stat' \
  --header 'x-api-token: Bearer <API_TOKEN>'
#### Example success response (200) ```json { "users_has_records": 0, "users_logged_recent": 1 } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------- | ---------------------------- | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | #### Security Notes * Treat API tokens like passwords; rotate them on a schedule. * Restrict permissions to the minimum required roles and actions. * Prefer short expirations; use `never` only for special automation cases. * Store tokens in a secure location (e.g., Keeper Vault). ### Enterprise Statistics Details **Endpoint** ``` GET /api/rest/public/security_posture/get_enterprise_stat_details ``` **Purpose**\ Retrieve the recent login count (users who logged in the last 30 days) and the number of users who have at least one record in their Vault **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** 
curl 'https://keepersecurity.com/api/rest/public/security_posture/get_enterprise_stat_details' \
  --header 'x-api-token: Bearer <API_TOKEN>'
#### Example success response (200) ```json { "enterprise_stat_details": [ { "last_logged_in": "2025-11-21 22:11:15", "has_records": false, "enterprise_user_id": "user@company.com" } ] } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------- | ---------------------------- | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | *** #### Security Notes * Treat API tokens like passwords; rotate them on a schedule. * Restrict permissions to the minimum required roles and actions. * Prefer short expirations; use `never` only for special automation cases. * Store tokens in a secure location (e.g., Keeper Vault). ### Security Alerts Summary **Endpoint** ``` GET /api/rest/public/security_posture/get_security_alerts_summary ``` **Purpose**\ Retrieve summary of events that happened in the last 30 days **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** 
curl 'https://keepersecurity.com/api/rest/public/security_posture/get_security_alerts_summary' \
  --header 'x-api-token: Bearer <API_TOKEN>'
#### Example success response (200) ```json { "security_alerts_summary": [ { "event_occurrences": 1, "unique_users": 1, "last_users": 0, "event": "account_recovery_decline", "last_events": 0 } ] } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------- | ---------------------------- | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | *** #### Security Notes * Treat API tokens like passwords; rotate them on a schedule. * Restrict permissions to the minimum required roles and actions. * Prefer short expirations; use `never` only for special automation cases. * Store tokens in a secure location (e.g., Keeper Vault). ### Security Alerts Detail **Endpoint** ``` GET /api/rest/public/security_posture/get_security_alerts_detail ``` **Purpose**\ Retrieve details of event that happened in the last 30 days with a comparison to the previous 30 days\ **aet** is audit event type (id)\ example: **account\_recovery\_decline** **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Query parameters
NameTypeRequiredDescription
audit_event_typeStringYesAudit event type from stats
Audit Event Types ``` account_recovery account_recovery_decline added_admin_key alias_added bridge_deleted bw_record_high_risk bw_record_ignored change_master_password delete_security_key delete_user deleted_shared_folder email_provisioning_deleted enterprise_2fa_disabled_by_admin expire_password folder_add_outside_user lock_user login_failed_console login_failed_ip_whitelist login_failure msp_changes_mc_seats msp_pauses_mc msp_removes_mc node_deleted record_rotation_on_demand_fail record_rotation_scheduled_fail record_share_outside_user record_type_deleted role_enforcement_changed scim_deleted set_two_factor_off sso_deleted team_deleted two_factor_disabled_by_support vault_transferred ``` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** 
curl 'https://keepersecurity.com/api/rest/public/security_posture/get_security_alerts_detail?audit_event_type=account_recovery_decline' \
  --header 'x-api-token: Bearer <API_TOKEN>'
#### Example success response (200) ```json { "security_alerts_summary": [ { "event_occurrences": 1, "unique_users": 1, "last_users": 0, "event": "account_recovery_decline", "last_events": 0 } ] } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------------------------------------------- | ------------------------------------------------------------- | | 400 | Can't find required query param: audit\_event\_type value | audit\_event\_type is missing or not matches internal mapping | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | ### Get security benchmarks **Endpoint** ``` GET /api/rest/public/security_posture/get_security_benchmarks ``` **Purpose**\ Get the list of security benchmark set for the calling enterprise **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** 
curl 'https://keepersecurity.com/api/rest/public/security_posture/get_security_benchmarks' \
  --header 'x-api-token: Bearer <API_TOKEN>'
#### Example success response (200) ```json { "security_benchmarks": [ { "id": "SB_DEPLOY_ACROSS_ENTIRE_ORGANIZATION", "auto_resolve": false, "status": "UNRESOLVED" }, { "last_updated": "2025-12-11 23:37:29", "id": "SB_PREVENT_INSTALLATION_OF_UNTRUSTED_EXTENSIONS", "auto_resolve": false, "status": "RESOLVED" }, { "id": "SB_ENABLE_ACCOUNT_TRANSFER_POLICY", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_REDUCE_ADMINISTRATOR_PRIVILEGE", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_ENSURE_OUTSIDE_SSO_ADMINISTRATOR_EXISTS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_LOCK_DOWN_SSO_PROVIDER", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_CREATE_AT_LEAST_TWO_KEEPER_ADMINISTRATORS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_ENSURE_TWO_FACTOR_AUTHENTICATION_ADMIN_USERS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_ENFORCE_STRONG_MASTER_PASSWORD", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_ENSURE_TWO_FACTOR_AUTHENTICATION_FOR_END_USERS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_CONFIGURE_IP_ALLOWLISTING", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_CREATE_ALERTS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_DISABLE_BROWSER_PASSWORD_MANAGERS", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_DISABLE_ACCOUNT_RECOVERY", "auto_resolve": false, "status": "UNRESOLVED" }, { "id": "SB_ENFORCE_LEAST_PRIVILEGE_POLICY", "auto_resolve": false, "status": "UNRESOLVED" } ] } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------- | ---------------------------- | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | ### Set security benchmarks **Endpoint** ``` POST /api/rest/public/security_posture/set_security_benchmarks ``` **Purpose**\ Set a list of security benchmark. Corresponding audit events will be logged. **Authentication**\ Send your API token in the `x-api-token` header:\ `x-api-token: Bearer ` #### Headers
HeaderExample
x-api-tokenBearer <API_TOKEN>
#### Query parameters **Request** ```bash curl -X POST -H 'x-api-token: Bearer ' -H 'Content-Type: application/json' \ 'https://keepersecurity.com/api/rest/public/security_posture/set_security_benchmarks' \ -d '[{"benchmark": "SB_PREVENT_INSTALLATION_OF_UNTRUSTED_EXTENSIONS", "status": "RESOLVED"}]' ``` #### Example success response (200) ```json { "security_benchmarks": [ { "id": "SB_PREVENT_INSTALLATION_OF_UNTRUSTED_EXTENSIONS", "auto_resolve": false, "status": "RESOLVED" } ] } ``` #### Error codes | Code | Message | Cause | | ---- | --------------------- | ---------------------------- | | 401 | Unauthorized | Invalid or missing API token | | 500 | Internal Server Error | Unexpected server error | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/keeperpam/commander-cli/admin-rest-api/risk-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.