GET) and require an account-id (or individual); org callers need at least viewer.
Paths are under /metrics/.
Dashboard summary
GET /metrics/dashboard?account-id={uuid}&vendor-list-id={listId}
Returns portfolio counts plus
overallPosture (the tier-weighted mean of latest scores), vendorsInOverallPosture, avgGrcScore (unweighted), portfolioApprovedPercent, and an explanation string.Tier weights used for
overallPosture: Core 1.0, Standard 0.65, Minimal / untiered 0.65. See Dependency tiers.Recent incidents
GET /metrics/recent-incidents?account-id={uuid}&vendor-list-id={listId}&limit={n}
Returns recent incident records.
vendor-list-id scopes to a list; limit is capped at 100.Vendors from a list
GET /metrics/vendors-from-list?account-id={uuid}&vendor-list-id={listId}
Returns each vendor on the list with
recent_incident_count (approx. last 30 days), vendor_id, and alerts_enabled.Portfolio posture history
GET /metrics/list-posture-history?account-id={uuid}&vendor-list-id={listId}&limit_months={n}
Returns monthly tier-weighted posture:
{ items: [{ yearMonth, overallPosture, recordedAt }] }. Defaults to 24 months (max 120).Vendor score history
GET /metrics/vendor-grc-history?account-id={uuid}&vendor-id={uuid}&limit_months={n}
Returns a vendor’s monthly aggregate:
{ items: [{ yearMonth, rawScore, grcAssessedAt, recordedAt }] }. Defaults to 36 months. The vendor must be on the list.AI summary
GET /metrics/ai-summary?account-id={uuid}&vendor-list-id={listId}
Returns a generated weekly summary of your portfolio as a JSON string.
History endpoints read from monthly snapshots recorded on the 1st of each month, so trends are stable and comparable over time.