# Get a monthly security report

> One monthly security report with its sections.

Source: https://docs.vigilbase.com/one/api/reference/reports/recon-reports-get

`GET https://api.vigilbase.com/one/v1/customers/{customerId}/recon-reports/{reportId}`

One monthly security report with its sections. Billing appears only for readers with billing access, and never for a customer billed through a partner.

> Deprecated aliases: `GET https://one.vigilbase.com/api/customers/{id}/recon/reports/{reportId}`. They answer with the same bodies, with a `Deprecation` header and a `successor-version` link to this URL.

## Authorizations

Send one of these:

- `Authorization` (string, header, required): Bearer access token from Vigilbase Identity (`auth.vigilbase.com`), sent as `Authorization: Bearer <token>`. The CLI gets one with `vigilbase login`. Scope: `one:api`.
- `Authorization` (string, header, required): Organisation API key (`vb_one_…`) from **Settings → API keys** in Vigilbase One, sent as `Authorization: Bearer vb_one_…`. Read-only keys work. See [organisation API keys](https://docs.vigilbase.com/one/api#organisation-api-keys).
- `Authorization` (string, header, required): Vigilbase Identity access token issued to an MCP client (mcp.vigilbase.com). Scope: `one:read`.
- Permissions checked: `read:customers`

## Path parameters

- `customerId` (string, required)
- `reportId` (string, required)

## Responses

Errors are problem details (`application/problem+json`). See [errors](https://docs.vigilbase.com/one/api#errors).

### 200 (application/json)

Success

- `id` (string, required)
- `customerId` (string, required)
- `customerName` (string | null, required)
- `period` (object, required)
  - `start` (string, required)
  - `end` (string, required)
  - `label` (string, required)
  - `type` (string, required)
- `status` (string, required): One of `pending`, `generating`, `completed`, `failed`.
- `generatedAt` (any, required)
- `availableSections` (string[], required)
- `branding` (object, required)
  - `type` (string, required): One of `vigilbase`, `partner`.
  - `partnerName` (string | null, required)
  - `partnerLogoUrl` (string | null, required)
  - `customerLogoUrl` (string | null, required)
  - `accentColor` (string, required)
- `publicLink` (any, required): Whether a public share link exists. The link itself is a bearer URL and is not returned.
- `executiveSummary` (object, required)
  - `overallScore` (number, required): Score from 0 to 100. 0 when `scored` is false.
  - `scoreLabel` (string, required): Excellent, Good, Fair or Needs Attention; "Not scored" when `scored` is false.
  - `scored` (boolean, required): False when no service could be measured for the report, so `overallScore` carries no meaning.
  - `scoreVersion` (any, required): 2 for the security score (Cloudflare Checkup and endpoint protection). Null for older reports, whose health score also counted support and cache performance and defaulted to 75 without data. Compare scores only within one version.
  - `highlights` (string[], required)
  - `serviceSummary` (object, required)
- `threatLandscape` (object, required)
  - `title` (string, required)
  - `summary` (string, required)
  - `keyThreats` (object[], required)
    - `name` (string, required)
    - `description` (string, required)
    - `severity` (string, required): One of `critical`, `high`, `medium`, `low`.
    - `affectedSystems` (string[], required)
  - `industryAlerts` (object[], required)
    - `industry` (string, required)
    - `title` (string, required)
    - `description` (string, required)
    - `severity` (string, required): One of `critical`, `high`, `medium`, `low`.
  - `recommendations` (object[], required)
    - `title` (string, required)
    - `description` (string, required)
    - `priority` (string, required): One of `high`, `medium`, `low`.
    - `category` (string, required)
- `insights` (object[], required)
  - `type` (string, required): One of `anomaly`, `trend`, `recommendation`, `highlight`.
  - `severity` (string, required): One of `info`, `warning`, `critical`, `success`.
  - `title` (string, required)
  - `description` (string, required)
  - `service` (string | null, required)
  - `metric` (string | null, required)
  - `value` (number | null, required)
  - `previousValue` (number | null, required)
  - `isIncreaseBetter` (boolean, required)
- `aiAnalysis` (any, required)
- `comparison` (object, required)
  - `endpointChangePct` (number | null, required)
  - `threatsChangePct` (number | null, required)
  - `requestsChangePct` (number | null, required)
  - `bandwidthChangePct` (number | null, required)
  - `cacheHitChangePct` (number | null, required)
  - `supportTicketsChangePct` (number | null, required)
  - `securityThreatsChangePct` (number | null, required)
- `endpoint` (object, required)
  - `ninjaOne` (any, required)
  - `huntress` (any, required)
- `backup` (object, required)
  - `afi` (any, required)
- `cloudflare` (object, required)
  - `metrics` (object, required): Traffic, cache, security and product figures for the period, as the report page shows them.
  - `zones` (object[], required)
    - `zoneId` (string, required)
    - `zoneName` (string, required)
    - `status` (string, required)
    - `requests` (number, required)
    - `bandwidth` (number, required)
    - `cacheHitRatio` (number, required)
    - `threats` (number, required)
  - `configuration` (any, required): The Cloudflare configuration review (checkup grades and findings), when the report has one.
- `support` (object, required)
  - `issuesCreated` (number, required)
  - `issuesClosed` (number, required)
  - `openIssues` (number, required)
  - `averageResolutionTimeHours` (number | null, required)
  - `issuesByPriority` (object, required)
    - `urgent` (number, required)
    - `high` (number, required)
    - `medium` (number, required)
    - `low` (number, required)
  - `slaCompliancePercent` (number | null, required)
- `billing` (any, required): Present only when the report has a billing section the caller may see; null for readers without billing access and for customers billed through a partner.

### 400 (application/problem+json)

Problem: `validation_failed`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 401 (application/problem+json)

Problem: `unauthorized`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 403 (application/problem+json)

Problem: `forbidden`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 404 (application/problem+json)

Problem: `not_found`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 429 (application/problem+json)

Problem: `rate_limit_exceeded`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### 503 (application/problem+json)

Problem: `service_unavailable`.

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

### default (application/problem+json)

Problem details (RFC 9457).

- `type` (string, required)
- `title` (string, required)
- `status` (integer, required): Minimum 400, maximum 599.
- `detail` (string, required)
- `instance` (string)
- `code` (string, required): One of `bad_request`, `validation_failed`, `idempotency_key_invalid`, `unauthorized`, `invalid_api_key`, `api_key_revoked`, `api_key_expired`, `forbidden`, `step_up_required`, `staff_only`, `read_only_key`, `not_for_api_keys`, `insufficient_scope`, `not_found`, `method_not_allowed`, `conflict`, `idempotency_in_progress`, `gone`, `length_required`, `precondition_failed`, `payload_too_large`, `unsupported_media_type`, `unprocessable_entity`, `idempotency_key_reused`, `rate_limit_exceeded`, `internal_error`, `upstream_unavailable`, `service_unavailable`.
- `requestId` (string, required)
- `docs` (string)
- `errors` (object[])
  - `pointer` (string, required)
  - `message` (string, required)
- `retryAfterSeconds` (integer): Minimum 0, maximum 9007199254740991.

## Example request

```bash
# Token from `vigilbase login`, or an API key (vb_one_…)
curl --request GET \
  --url 'https://api.vigilbase.com/one/v1/customers/{customerId}/recon-reports/{reportId}' \
  --header "Authorization: Bearer $VIGILBASE_TOKEN"
```

With the Vigilbase CLI:

```bash
vigilbase customers report
```

## Example response (200)

```json
{
  "id": "<uuid>",
  "customerId": "<uuid>",
  "customerName": "<string>",
  "period": {
    "start": "<string>",
    "end": "<string>",
    "label": "<string>",
    "type": "<string>"
  },
  "status": "pending",
  "generatedAt": "<any>",
  "availableSections": [
    "threat_landscape"
  ],
  "branding": {
    "type": "vigilbase",
    "partnerName": "<string>",
    "partnerLogoUrl": "<string>",
    "customerLogoUrl": "<string>",
    "accentColor": "<string>"
  },
  "publicLink": "<any>",
  "executiveSummary": {
    "overallScore": 123,
    "scoreLabel": "<string>",
    "scored": true,
    "scoreVersion": "<any>",
    "highlights": [
      "<string>"
    ],
    "serviceSummary": {}
  },
  "threatLandscape": {
    "title": "<string>",
    "summary": "<string>",
    "keyThreats": [
      {
        "name": "<string>",
        "description": "<string>",
        "severity": "critical",
        "affectedSystems": [
          "<string>"
        ]
      }
    ],
    "industryAlerts": [
      {
        "industry": "<string>",
        "title": "<string>",
        "description": "<string>",
        "severity": "critical"
      }
    ],
    "recommendations": [
      {
        "title": "<string>",
        "description": "<string>",
        "priority": "high",
        "category": "<string>"
      }
    ]
  },
  "insights": [
    {
      "type": "anomaly",
      "severity": "info",
      "title": "<string>",
      "description": "<string>",
      "service": "<string>",
      "metric": "<string>",
      "value": 123,
      "previousValue": 123,
      "isIncreaseBetter": true
    }
  ],
  "aiAnalysis": "<any>",
  "comparison": {
    "endpointChangePct": 123,
    "threatsChangePct": 123,
    "requestsChangePct": 123,
    "bandwidthChangePct": 123,
    "cacheHitChangePct": 123,
    "supportTicketsChangePct": 123,
    "securityThreatsChangePct": 123
  },
  "endpoint": {
    "ninjaOne": "<any>",
    "huntress": "<any>"
  },
  "backup": {
    "afi": "<any>"
  },
  "cloudflare": {
    "metrics": {},
    "zones": [
      {
        "zoneId": "<string>",
        "zoneName": "<string>",
        "status": "<string>",
        "requests": 123,
        "bandwidth": 123,
        "cacheHitRatio": 123,
        "threats": 123
      }
    ],
    "configuration": "<any>"
  },
  "support": {
    "issuesCreated": 123,
    "issuesClosed": 123,
    "openIssues": 123,
    "averageResolutionTimeHours": 123,
    "issuesByPriority": {
      "urgent": 123,
      "high": 123,
      "medium": 123,
      "low": 123
    },
    "slaCompliancePercent": 123
  },
  "billing": "<any>"
}
```

See also the [guide](https://docs.vigilbase.com/one/api/customers).