> ## Documentation Index > Fetch the complete documentation index at: https://developers.marko.fr/llms.txt > Use this file to discover all available pages before exploring further. # Lister les risques tiers d'un opérateur > Expose les événements de surveillance tiers rattachés à un opérateur. **Scope requis :** `third_party_risks:read`. [Scopes et délégation](/scopes-and-delegation). ## OpenAPI ````yaml /openapi.json get /operateurs/{operateur_id}/third-party-risks openapi: 3.1.0 info: title: MARKO External Partner API version: v1 description: >- Stable external API contract for the live environment. Authentication flow for partner integrations: 1. Generate an API key from the MARKO entity admin API section. 2. Keep the raw API secret server-side and use it only to sign `POST /v1/auth/token`. 3. Build the canonical message `MARKO-EXTERNAL-API-TOKEN-V1\n{key_id}\n{timestamp}\n{nonce}`. 4. Sign that message with HMAC-SHA256 and send the hex signature with `key_id`, `timestamp` and `nonce`. 5. Use the returned short-lived bearer on business endpoints as `Authorization: Bearer `. The raw API secret must never be sent on business endpoints. This public contract intentionally excludes beta endpoints. Référence enrichie pour les développeurs et les assistants IA. Exemples synthétiques; les champs sont extraits des modèles et sérialiseurs de la version indiquée dans x-documentation-provenance. servers: - url: https://partner-api.marko.fr/v1 security: - BearerAuth: [] tags: - name: auth x-group: Authentification - name: entity x-group: Entité - name: portfolio x-group: Portefeuille - name: deals x-group: Deals - name: fonds x-group: Fonds - name: spvs x-group: SPV - name: operations x-group: Opérations - name: taxonomies x-group: Taxonomies - name: import-jobs x-group: Imports par lot - name: comments x-group: Commentaires - name: documents x-group: Documents - name: users x-group: Utilisateurs - name: settings x-group: Paramètres - name: rcci x-group: Conformité RCCI - name: field-definitions x-group: Champs métier - name: search x-group: Recherche - name: operateurs x-group: Opérateurs - name: alerts x-group: Alertes - name: notifications x-group: Notifications - name: calendar x-group: Calendrier - name: enrichment x-group: Enrichissement SIREN - name: reports x-group: Exports - name: reporting x-group: Templates de reporting - name: workflows x-group: Workflows et extraction IA - name: tasks x-group: Tâches externalDocs: description: Download the matching Postman collection. url: /v1/postman.json paths: /operateurs/{operateur_id}/third-party-risks: get: tags: - operateurs summary: Lister les risques tiers d'un opérateur description: >- Expose les événements de surveillance tiers rattachés à un opérateur. **Scope requis :** `third_party_risks:read`. [Scopes et délégation](/scopes-and-delegation). operationId: operateurs_third-party-risks_list parameters: - in: path name: operateur_id required: true schema: type: string format: uuid title: Operateur Id example: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa description: UUID MARKO de l'opérateur. - in: query name: active_only required: false schema: type: boolean description: Only unresolved events default: false title: Active Only example: true description: Only unresolved events - in: query name: limit required: false schema: type: integer maximum: 200 minimum: 1 default: 50 title: Limit example: 20 description: >- Nombre maximal de résultats sur cette page; bornes et valeur par défaut ci-dessous. - in: query name: offset required: false schema: type: integer minimum: 0 default: 0 title: Offset example: 0 description: Nombre de résultats à ignorer avant cette page (commence à 0). - in: header name: X-Request-ID required: false description: >- Partner-generated correlation identifier echoed in logs and error payloads. schema: type: string example: marko-operateurs-third-party-risks-list - name: source in: query required: false schema: anyOf: - type: string - type: 'null' description: Filter by source title: Source description: Filter by source - name: severity in: query required: false schema: anyOf: - type: string - type: 'null' description: Filter by severity title: Severity description: Filter by severity responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/PaginatedResponse_ThirdPartyRiskResponse_' example: items: - id: 11111111-1111-4111-8111-111111111111 operateur_id: 11111111-1111-4111-8111-111111111111 source: example event_type: example severity: warning title: Publication BODACC detected_at: '2026-10-01T10:00:00Z' created_at: '2026-10-01T10:00:00Z' updated_at: '2026-10-01T10:00:00Z' total: 1 limit: 0 offset: 0 '401': description: Authentication required content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: about:blank title: Unauthorized status: 401 detail: A valid bearer token is required. request_id: req_example_partner_call '403': description: Scope, route or IP restriction content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: about:blank title: Forbidden status: 403 detail: The API key does not allow this operation. request_id: req_example_partner_call '422': description: Validation failed content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: about:blank title: Unprocessable Content status: 422 detail: The request payload or parameters are invalid. request_id: req_example_partner_call '429': description: Rate limit or progressive ban headers: Retry-After: description: Cooldown in seconds before retrying the request. schema: type: string content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: about:blank title: Too Many Requests status: 429 detail: The request rate limit was exceeded. request_id: req_example_partner_call '500': description: Unexpected server error content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' example: type: about:blank title: Internal Server Error status: 500 detail: An unexpected server error occurred. request_id: req_example_partner_call deprecated: false security: - BearerAuth: [] components: schemas: PaginatedResponse_ThirdPartyRiskResponse_: properties: items: items: $ref: '#/components/schemas/ThirdPartyRiskResponse' type: array title: Items description: Résultats de la page courante. total: type: integer title: Total description: Nombre total de résultats correspondant aux filtres. limit: type: integer title: Limit description: Limit used for this request offset: type: integer title: Offset description: Nombre de résultats ignorés avant cette page. page: type: integer title: Page description: Numéro de la page courante, à partir de 1. default: 0 pages: type: integer title: Pages description: Nombre total de pages pour cette taille de page. default: 0 type: object required: - items - total - limit - offset title: PaginatedResponse[ThirdPartyRiskResponse] ProblemDetails: type: object required: - title - status - detail properties: type: type: string default: about:blank description: >- URI identifiant le type de problème; about:blank lorsque seul le statut HTTP le caractérise. title: type: string description: Titre affiché pour l'événement ou le problème. status: type: integer description: Statut HTTP de la réponse d'erreur. detail: type: string description: Informations détaillées sur le problème ou le dossier. request_id: type: string description: Identifiant de corrélation pour le diagnostic de la requête. scope: type: string description: Scope concerné par le refus d'accès, lorsqu'il est renseigné. route_id: type: string description: Identifiant de la route concernée par le problème. reason_code: type: string description: >- Code structuré du motif de refus; préférable au texte du message pour le diagnostic. ThirdPartyRiskResponse: properties: id: type: string format: uuid title: Id description: Identifiant MARKO de la ressource. operateur_id: type: string format: uuid title: Operateur Id description: UUID MARKO de l'opérateur. source: type: string title: Source description: Origine de l'événement de risque concernant l'opérateur. provider_event_id: anyOf: - type: string - type: 'null' title: Provider Event Id description: Identifiant de l'événement dans le système du fournisseur. event_type: type: string title: Event Type description: Type de l'événement. severity: type: string title: Severity description: >- Niveau de gravité de l'événement, distinct de son statut de traitement. title: type: string title: Title description: Titre affiché pour l'événement ou le problème. description: anyOf: - type: string - type: 'null' title: Description description: Description libre de la ressource. raw_data: anyOf: - additionalProperties: true type: object description: >- Objet JSON extensible. Les types des valeurs sont indiqués par additionalProperties lorsque la route les contraint. - type: 'null' title: Raw Data description: >- Données de l'événement fournies par sa source, avec une structure propre au fournisseur. detected_at: type: string format: date-time title: Detected At description: Date de détection de l'événement de risque. resolved_at: anyOf: - type: string format: date-time - type: 'null' title: Resolved At description: Date de résolution de l'événement, du commentaire ou du conflit. risk_score_impact: anyOf: - type: number - type: 'null' title: Risk Score Impact description: Contribution de l'événement au score de risque. is_resolved: type: boolean title: Is Resolved default: false description: Indique si le commentaire ou l'événement de risque est résolu. created_at: type: string format: date-time title: Created At description: Date de création au format ISO 8601. updated_at: type: string format: date-time title: Updated At description: Date de dernière modification au format ISO 8601. type: object required: - id - operateur_id - source - event_type - severity - title - detected_at - created_at - updated_at title: ThirdPartyRiskResponse description: Response schema for a single third-party risk event. securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: MARKO short-lived bearer description: >- Use the `access_token` returned by `POST /v1/auth/token`. Do not send the raw API secret on business endpoints. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.