<!-- BusyBot node reference — https://busybot.net/tools/security-scorecard/ -->

> Node: SecurityScorecard (`security_scorecard`) · Action (binary) · v1
> Category: Utility · Credentials: SecurityScorecard API (`securityScorecardApi`)
> Updated: 2026-08-16

# SecurityScorecard

> Manage SecurityScorecard portfolios, scores, and reports

## Overview

SecurityScorecard rates the cybersecurity posture of companies. This tool reads company and industry scores, factor breakdowns and historical trends, manages portfolios and the companies inside them, sends assessment invites, and generates and downloads reports. Report downloads are written to binary data so they can be emailed, stored or uploaded by a later node.

**Category:** Utility  
**Tool Name:** `security_scorecard`  
**Version:** 1

**Appearance:** Icon: `lucide-ShieldCheck` | Color: `#1F2937`

## Node Type

**Action (Binary)** — handles file/binary data operations

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **SecurityScorecard API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/security-scorecard-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Company | `company` |
| Industry | `industry` |
| Invite | `invite` |
| Portfolio | `portfolio` |
| Portfolio Company | `portfolioCompany` |
| Report | `report` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Get Factor Scores | `getFactor` | Company factor scores and issue counts, or factor scores for an industry |
| Get Historical Factor Scores | `getFactorHistorical` | A company's or industry's historical factor scores |
| Get Historical Scores | `getHistoricalScore` | A company's historical scores |
| Get Information and Scorecard | `getScorecard` | Company information and a summary of their scorecard |
| Get Score Plan | `getScorePlan` | A company's score improvement plan |
| Get Score | `getScore` | The score for an industry |
| Create | `create` | Create an invite for a company/user, or create a portfolio |
| Update | `update` | Update a portfolio |
| Delete | `delete` | Delete a portfolio |
| Get Many | `getAll` | Get many portfolios, many companies in a portfolio, or recently generated reports |
| Add | `add` | Add a company to a portfolio |
| Remove | `remove` | Remove a company from a portfolio |
| Generate | `generate` | Generate a report |
| Download | `download` | Download a generated report |

Which operations you see depends on the resource: `company` → `getFactor`, `getFactorHistorical`, `getHistoricalScore`, `getScorecard`, `getScorePlan`; `industry` → `getFactor`, `getFactorHistorical`, `getScore`; `invite` → `create`; `portfolio` → `create`, `delete`, `getAll`, `update`; `portfolioCompany` → `add`, `getAll`, `remove`; `report` → `download`, `generate`, `getAll`.

### Parameters

#### Company: Get Information and Scorecard

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}. |

#### Company: Get Factor Scores

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Filters (`filters`) | `collection` | No | `{}` | Narrow the returned issues. |
| — Severity | `string` | No | — | Filter issues by a single severity. |
| — Severity In | `string` | No | — | Filter issues by comma-separated severity list. |

#### Company: Get Historical Factor Scores

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |
| Options (`options`) | `collection` | No | `{}` | Date range and granularity for the history. |
| — Date From | `string` | No | — | History start date (YYYY-MM-DD or date string). |
| — Date To | `string` | No | — | History end date (YYYY-MM-DD or date string). |
| — Timing | `options` | No | `daily` | Date granularity. |
| | | | | Options: `daily`, `weekly`, `monthly` |

#### Company: Get Historical Scores

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |
| Options (`options`) | `collection` | No | `{}` | Date range and granularity for the history. |
| — Date From | `string` | No | — | History start date (YYYY-MM-DD or date string). |
| — Date To | `string` | No | — | History end date (YYYY-MM-DD or date string). |
| — Timing | `options` | No | `daily` | Date granularity. |
| | | | | Options: `daily`, `weekly`, `monthly` |

#### Company: Get Score Plan

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}. |
| Score | `number` | Yes | `0` | Target score for score improvement plan. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |

#### Industry: Get Score

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Industry | `options` | Yes | `food` | The industry to report on. |
| | | | | Options: `food`, `healthcare`, `manofacturing`, `retail`, `technology` |

#### Industry: Get Factor Scores

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Industry | `options` | Yes | `food` | The industry to report on. |
| | | | | Options: `food`, `healthcare`, `manofacturing`, `retail`, `technology` |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |

#### Industry: Get Historical Factor Scores

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Industry | `options` | Yes | `food` | The industry to report on. |
| | | | | Options: `food`, `healthcare`, `manofacturing`, `retail`, `technology` |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Simplify | `boolean` | No | `true` | Whether to return a simplified version of the response instead of the raw data. |
| Options (`industryOptions`) | `collection` | No | `{}` | Date range for the history. |
| — Date From (`from`) | `string` | No | — | History start date (YYYY-MM-DD). |
| — Date To (`to`) | `string` | No | — | History end date (YYYY-MM-DD). |

#### Invite: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Email | `string` | Yes | — | Email address of the invitee. Supports expressions. |
| First Name | `string` | Yes | — | Given name of the invitee. Supports expressions. |
| Last Name | `string` | Yes | — | Family name of the invitee. Supports expressions. |
| Message | `string` | Yes | — | Message for the invitee. Supports expressions. |
| Additional Fields | `collection` | No | `{}` | Optional invite details. |
| — Days to Resolve Issue | `number` | No | `0` | Minimum days to resolve a scorecard issue. |
| — Domain | `string` | No | — | Invitee company domain. |
| — Grade to Maintain | `string` | No | — | Request the invitee's organisation to maintain a minimum grade. |
| — Is Organisation Point of Contact | `boolean` | No | `false` | Whether the invitee is the organisation's point of contact. |
| — Issue Description | `string` | No | — | Body text describing the issue the invitee should address. |
| — Issue Title | `string` | No | — | Title of the issue the invitee should address. |
| — Issue Type (`issue_type`) | `string` | No | — | Type of the issue the invitee should address. |
| — Send Me a Copy | `boolean` | No | `false` | Whether to send a copy of the invite to the requesting user. |
| — Target URL | `string` | No | — | Optional URL to take the invitee to when arriving to the platform. |

#### Portfolio: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio Name (`name`) | `string` | Yes | — | Name of the portfolio. Supports expressions. |
| Description (`portfolioDescription`) | `string` | No | — | Free-text description of the portfolio. |
| Privacy | `options` | No | `shared` | Who can see this portfolio. |
| | | | | Options: `private` (only visible to you), `shared` (visible to everyone in your company), `team` (visible to the people on your team) |

#### Portfolio: Update

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio ID | `string` | Yes | — | ID of the portfolio to change. Supports expressions. |
| Portfolio Name (`name`) | `string` | Yes | — | Name of the portfolio. Supports expressions. |
| Description (`portfolioDescription`) | `string` | No | — | Free-text description of the portfolio. |
| Privacy | `options` | No | `shared` | Who can see this portfolio. |
| | | | | Options: `private` (only visible to you), `shared` (visible to everyone in your company), `team` (visible to the people on your team) |

#### Portfolio: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio ID | `string` | Yes | — | ID of the portfolio to delete. Supports expressions. |

#### Portfolio: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |

#### Portfolio Company: Add

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio ID | `string` | Yes | — | ID of the portfolio to add the company to. Supports expressions. |
| Domain | `string` | Yes | — | Company's domain name. Supports expressions. |

#### Portfolio Company: Remove

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio ID | `string` | Yes | — | ID of the portfolio to remove the company from. Supports expressions. |
| Domain | `string` | Yes | — | Company's domain name. Supports expressions. |

#### Portfolio Company: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Portfolio ID | `string` | Yes | — | ID of the portfolio to list. Supports expressions. |
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |
| Filters (`portfolioCompanyFilters`) | `collection` | No | `{}` | Narrow which companies are returned. |
| — Grade | `string` | No | — | Company score grade filter. |
| — Industry | `string` | No | — | Industry filter. |
| — Issue Type (`issueType`) | `string` | No | — | Issue type filter. |
| — Status | `options` | No | — | Company status filter. |
| | | | | Options: `active`, `inactive` |
| — Vulnerability | `string` | No | — | CVE vulnerability filter. |

#### Report: Generate

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Report | `options` | Yes | `detailed` | Which report to generate. |
| | | | | Options: `detailed` (Company Detailed), `events-json` (Company Events), `issues` (Company Issues), `partnership` (Company Partnership), `summary` (Company Summary), `full-scorecard-json` (Full Scorecard), `portfolio` (Portfolio), `scorecard-footprint` (Scorecard Footprint) |
| Scorecard Identifier | `string` | Yes | — | Primary identifier of a company or scorecard, i.e. domain. Supports expressions. _(shown when Report is `detailed`, `events-json`, `full-scorecard-json`, `issues`, `partnership`, `scorecard-footprint`, `summary`)_ |
| Portfolio ID | `string` | Yes | — | ID of the portfolio the report covers. Supports expressions. _(shown when Report is `portfolio`)_ |
| Branding | `options` | No | `securityscorecard` | Whose branding appears on the generated report. _(shown when Report is `detailed`, `summary`)_ |
| | | | | Options: `securityscorecard`, `company_and_securityscorecard`, `company` |
| Date | `string` | Yes | — | Date for the events report (YYYY-MM-DD or date string). _(shown when Report is `events-json`)_ |
| Options (`reportOptions`) | `collection` | No | `{}` | Output settings for issues and portfolio reports. _(shown when Report is `issues`, `portfolio`)_ |
| — Format | `options` | No | `pdf` | File format of the generated report. |
| | | | | Options: `csv`, `pdf` |
| Options (`footprintOptions`) | `collection` | No | `{}` | Scope and output settings for the footprint report. _(shown when Report is `scorecard-footprint`)_ |
| — Countries | `string` | No | — | Comma-separated list of countries. |
| — Format | `options` | No | `pdf` | File format of the generated report. |
| | | | | Options: `csv`, `pdf` |
| — IPs | `string` | No | — | Comma-separated list of IPs. |
| — Subdomains | `string` | No | — | Comma-separated list of subdomains. |

#### Report: Download

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Report URL (`url`) | `string` | Yes | — | URL to a generated report (obtained from Generate or Get Many operations). Supports expressions. |
| Binary Property | `string` | Yes | `data` | Name of the binary property to write the downloaded report to. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |

#### Report: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `100` | Max number of results to return. Between 1 and 100. _(shown when Return All is `false`)_ |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

Every operation **merges its result onto the input item JSON** — the incoming fields pass through unchanged, and binary data is forwarded. Where the operations differ is how many items come out.

**Operations that fan out** — one output item per record returned, each carrying that record's fields merged onto the input item:

| Resource / Operation | One item per |
|----------------------|--------------|
| `company` / `getFactor` | Factor entry (issue counts and scores per factor) |
| `company` / `getFactorHistorical` | Historical factor entry |
| `company` / `getHistoricalScore` | Historical score entry |
| `company` / `getScorePlan` | Score-plan entry |
| `industry` / `getFactor` | Industry factor entry |
| `industry` / `getFactorHistorical` | Historical industry factor entry |
| `portfolio` / `getAll` | Portfolio |
| `portfolioCompany` / `getAll` | Company in the portfolio |
| `report` / `getAll` | Recently generated report |

With **Return All** off these lists are truncated to **Limit** before the items are emitted. If nothing matches, the input item produces no output item at all.

**Operations that produce exactly one output item:**

| Resource / Operation | Fields merged onto the item |
|----------------------|-----------------------------|
| `company` / `getScorecard` | The company's scorecard summary. |
| `industry` / `getScore` | The industry's score. |
| `invite` / `create` | The API's invite response. |
| `portfolio` / `create` | The created portfolio. |
| `portfolio` / `update` | The updated portfolio. |
| `portfolio` / `delete` | `success: true` |
| `portfolioCompany` / `add` | The API's add response. |
| `portfolioCompany` / `remove` | `success: true` |
| `report` / `generate` | The generate response — it carries the URL you later feed to `download`. |
| `report` / `download` | `reportUrl`, `downloaded: true` and `fileSize` (bytes). The report file itself is written to the named **Binary Property**, keeping the file name from the URL, alongside any binary the item already carried. |

Reference the result downstream by expression, e.g. `{{ $json.fileSize }}` or `{{ $json.success }}`.

## Usage Examples

- Get a company security scorecard by domain
- Download a SecurityScorecard report as PDF
- List all portfolios in SecurityScorecard
- Generate a detailed security report for a company
- Get historical security scores for a company
- Add a company to a SecurityScorecard portfolio

## Example Configuration

Look up a company's scorecard by the domain on the incoming item:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getScorecard",
    "scorecardIdentifier": "{{ $json.domain }}"
  }
}
```

Pull a company's high-severity factor issues, one item per factor:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getFactor",
    "scorecardIdentifier": "example.com",
    "returnAll": false,
    "limit": 25,
    "filters": {
      "severity_in": "high,critical"
    }
  }
}
```

Track a company's score month by month over a year:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getHistoricalScore",
    "scorecardIdentifier": "example.com",
    "returnAll": true,
    "simple": true,
    "options": {
      "date_from": "2023-01-01",
      "date_to": "2023-12-31",
      "timing": "monthly"
    }
  }
}
```

Create a shared portfolio:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolio",
    "operation": "create",
    "name": "Q1 2024 Vendors",
    "portfolioDescription": "Vendor security assessments for Q1 2024",
    "privacy": "shared"
  }
}
```

Add a vendor from the incoming item to that portfolio:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolioCompany",
    "operation": "add",
    "portfolioId": "portfolio-123",
    "domain": "{{ $json.vendorDomain }}"
  }
}
```

List the active technology companies in a portfolio, graded A:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolioCompany",
    "operation": "getAll",
    "portfolioId": "portfolio-123",
    "returnAll": false,
    "limit": 25,
    "portfolioCompanyFilters": {
      "grade": "A",
      "industry": "technology",
      "status": "active",
      "vulnerability": "high"
    }
  }
}
```

Generate a co-branded detailed company report:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "detailed",
    "scorecardIdentifier": "example.com",
    "branding": "company_and_securityscorecard"
  }
}
```

Generate a portfolio report as CSV:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "portfolio",
    "portfolioId": "portfolio-123",
    "reportOptions": {
      "format": "csv"
    }
  }
}
```

Generate a scorecard footprint report scoped to specific countries and subdomains:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "scorecard-footprint",
    "scorecardIdentifier": "example.com",
    "footprintOptions": {
      "format": "pdf",
      "countries": "US,CA,UK",
      "ips": "192.168.1.0/24",
      "subdomains": "*.example.com"
    }
  }
}
```

Download a generated report into binary data:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "download",
    "url": "{{ $json.url }}",
    "binaryPropertyName": "reportFile"
  }
}
```

Invite a vendor to complete an assessment:

```json
{
  "type": "security_scorecard",
  "parameters": {
    "resource": "invite",
    "operation": "create",
    "email": "{{ $json.contactEmail }}",
    "firstName": "John",
    "lastName": "Doe",
    "message": "Please join our security assessment program",
    "additionalFields": {
      "domain": "example.com",
      "issue_title": "Security Assessment Required",
      "issue_desc": "We need you to complete a security assessment",
      "issue_type": "vulnerability",
      "days_to_resolve_issue": 30,
      "grade_to_maintain": "A",
      "is_organization_point_of_contact": true,
      "sendme_copy": true
    }
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Retrieve security scores, manage portfolios, and download reports from SecurityScorecard cybersecurity ratings platform.

### Behavior notes

- **Generate then download.** `generate` returns a URL rather than a file; feed that URL into a second node running `download` to get the bytes into binary data.
- **Comma-separated footprint fields.** Countries, IPs and Subdomains are typed as comma-separated text and split for you, so `US,CA,UK` is correct — do not wrap them in brackets.
- **Return All and Limit apply after the API responds.** The list is fetched and then truncated, so a large Return All still pulls the full response from SecurityScorecard.
- **Simplify is on by default** for the historical operations; turn it off when you need the raw API shape rather than the condensed one.
- **Branding only applies to the detailed and summary reports**, and format only to the issues, portfolio and footprint reports — the other report types ignore both.

### Common patterns

- **Security assessment workflow** — `company` / `getScorecard` for the summary, then `getFactor` with filters to find the weak points, then `report` / `generate` and `report` / `download` to produce the document.
- **Portfolio management** — `portfolio` / `create`, then `portfolioCompany` / `add` per vendor, then `portfolioCompany` / `getAll` with filters to monitor them, and `report` / `generate` with `portfolio` for a roll-up.
- **Historical analysis** — `getHistoricalScore` with a date range and Simplify on for easy charting, and `industry` / `getFactorHistorical` to compare against the sector.