SecurityScorecard

Manage SecurityScorecard portfolios, scores, and reports

Overview

SecurityScorecard rates the cybersecurity posture of companies. This tool reads company and industry scores, factor breakdowns and historical trends, manages portfolios and the companies inside them, sends assessment invites, and generates and downloads reports. Report downloads are written to binary data so they can be emailed, stored or uploaded by a later node.

Category: Utility
Tool Name: security_scorecard
Version: 1

Appearance: Icon: lucide-ShieldCheck | Color: #1F2937

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires SecurityScorecard API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Company	company
Industry	industry
Invite	invite
Portfolio	portfolio
Portfolio Company	portfolioCompany
Report	report

Operations

Operation	Value	Description
Get Factor Scores	getFactor	Company factor scores and issue counts, or factor scores for an industry
Get Historical Factor Scores	getFactorHistorical	A company’s or industry’s historical factor scores
Get Historical Scores	getHistoricalScore	A company’s historical scores
Get Information and Scorecard	getScorecard	Company information and a summary of their scorecard
Get Score Plan	getScorePlan	A company’s score improvement plan
Get Score	getScore	The score for an industry
Create	create	Create an invite for a company/user, or create a portfolio
Update	update	Update a portfolio
Delete	delete	Delete a portfolio
Get Many	getAll	Get many portfolios, many companies in a portfolio, or recently generated reports
Add	add	Add a company to a portfolio
Remove	remove	Remove a company from a portfolio
Generate	generate	Generate a report
Download	download	Download a generated report

Which operations you see depends on the resource: company → getFactor, getFactorHistorical, getHistoricalScore, getScorecard, getScorePlan; industry → getFactor, getFactorHistorical, getScore; invite → create; portfolio → create, delete, getAll, update; portfolioCompany → add, getAll, remove; report → download, generate, getAll.

Parameters

Company: Get Information and Scorecard

Parameter	Type	Required	Default	Description
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}.

Company: Get Factor Scores

Parameter	Type	Required	Default	Description
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Filters (filters)	collection	No	{}	Narrow the returned issues.
— Severity	string	No	—	Filter issues by a single severity.
— Severity In	string	No	—	Filter issues by comma-separated severity list.

Company: Get Historical Factor Scores

Parameter	Type	Required	Default	Description
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Simplify	boolean	No	true	Whether to return a simplified version of the response instead of the raw data.
Options (options)	collection	No	{}	Date range and granularity for the history.
— Date From	string	No	—	History start date (YYYY-MM-DD or date string).
— Date To	string	No	—	History end date (YYYY-MM-DD or date string).
— Timing	options	No	daily	Date granularity.
				Options: daily, weekly, monthly

Company: Get Historical Scores

Parameter	Type	Required	Default	Description
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Simplify	boolean	No	true	Whether to return a simplified version of the response instead of the raw data.
Options (options)	collection	No	{}	Date range and granularity for the history.
— Date From	string	No	—	History start date (YYYY-MM-DD or date string).
— Date To	string	No	—	History end date (YYYY-MM-DD or date string).
— Timing	options	No	daily	Date granularity.
				Options: daily, weekly, monthly

Company: Get Score Plan

Parameter	Type	Required	Default	Description
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain (e.g., example.com). Supports expressions like {{ $json.domain }}.
Score	number	Yes	0	Target score for score improvement plan.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)

Industry: Get Score

Parameter	Type	Required	Default	Description
Industry	options	Yes	food	The industry to report on.
				Options: food, healthcare, manofacturing, retail, technology

Industry: Get Factor Scores

Parameter	Type	Required	Default	Description
Industry	options	Yes	food	The industry to report on.
				Options: food, healthcare, manofacturing, retail, technology
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Simplify	boolean	No	true	Whether to return a simplified version of the response instead of the raw data.

Industry: Get Historical Factor Scores

Parameter	Type	Required	Default	Description
Industry	options	Yes	food	The industry to report on.
				Options: food, healthcare, manofacturing, retail, technology
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Simplify	boolean	No	true	Whether to return a simplified version of the response instead of the raw data.
Options (industryOptions)	collection	No	{}	Date range for the history.
— Date From (from)	string	No	—	History start date (YYYY-MM-DD).
— Date To (to)	string	No	—	History end date (YYYY-MM-DD).

Invite: Create

Parameter	Type	Required	Default	Description
Email	string	Yes	—	Email address of the invitee. Supports expressions.
First Name	string	Yes	—	Given name of the invitee. Supports expressions.
Last Name	string	Yes	—	Family name of the invitee. Supports expressions.
Message	string	Yes	—	Message for the invitee. Supports expressions.
Additional Fields	collection	No	{}	Optional invite details.
— Days to Resolve Issue	number	No	0	Minimum days to resolve a scorecard issue.
— Domain	string	No	—	Invitee company domain.
— Grade to Maintain	string	No	—	Request the invitee’s organisation to maintain a minimum grade.
— Is Organisation Point of Contact	boolean	No	false	Whether the invitee is the organisation’s point of contact.
— Issue Description	string	No	—	Body text describing the issue the invitee should address.
— Issue Title	string	No	—	Title of the issue the invitee should address.
— Issue Type (issue_type)	string	No	—	Type of the issue the invitee should address.
— Send Me a Copy	boolean	No	false	Whether to send a copy of the invite to the requesting user.
— Target URL	string	No	—	Optional URL to take the invitee to when arriving to the platform.

Portfolio: Create

Parameter	Type	Required	Default	Description
Portfolio Name (name)	string	Yes	—	Name of the portfolio. Supports expressions.
Description (portfolioDescription)	string	No	—	Free-text description of the portfolio.
Privacy	options	No	shared	Who can see this portfolio.
				Options: private (only visible to you), shared (visible to everyone in your company), team (visible to the people on your team)

Portfolio: Update

Parameter	Type	Required	Default	Description
Portfolio ID	string	Yes	—	ID of the portfolio to change. Supports expressions.
Portfolio Name (name)	string	Yes	—	Name of the portfolio. Supports expressions.
Description (portfolioDescription)	string	No	—	Free-text description of the portfolio.
Privacy	options	No	shared	Who can see this portfolio.
				Options: private (only visible to you), shared (visible to everyone in your company), team (visible to the people on your team)

Portfolio: Delete

Parameter	Type	Required	Default	Description
Portfolio ID	string	Yes	—	ID of the portfolio to delete. Supports expressions.

Portfolio: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)

Portfolio Company: Add

Parameter	Type	Required	Default	Description
Portfolio ID	string	Yes	—	ID of the portfolio to add the company to. Supports expressions.
Domain	string	Yes	—	Company’s domain name. Supports expressions.

Portfolio Company: Remove

Parameter	Type	Required	Default	Description
Portfolio ID	string	Yes	—	ID of the portfolio to remove the company from. Supports expressions.
Domain	string	Yes	—	Company’s domain name. Supports expressions.

Portfolio Company: Get Many

Parameter	Type	Required	Default	Description
Portfolio ID	string	Yes	—	ID of the portfolio to list. Supports expressions.
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)
Filters (portfolioCompanyFilters)	collection	No	{}	Narrow which companies are returned.
— Grade	string	No	—	Company score grade filter.
— Industry	string	No	—	Industry filter.
— Issue Type (issueType)	string	No	—	Issue type filter.
— Status	options	No	—	Company status filter.
				Options: active, inactive
— Vulnerability	string	No	—	CVE vulnerability filter.

Report: Generate

Parameter	Type	Required	Default	Description
Report	options	Yes	detailed	Which report to generate.
				Options: detailed (Company Detailed), events-json (Company Events), issues (Company Issues), partnership (Company Partnership), summary (Company Summary), full-scorecard-json (Full Scorecard), portfolio (Portfolio), scorecard-footprint (Scorecard Footprint)
Scorecard Identifier	string	Yes	—	Primary identifier of a company or scorecard, i.e. domain. Supports expressions. (shown when Report is detailed, events-json, full-scorecard-json, issues, partnership, scorecard-footprint, summary)
Portfolio ID	string	Yes	—	ID of the portfolio the report covers. Supports expressions. (shown when Report is portfolio)
Branding	options	No	securityscorecard	Whose branding appears on the generated report. (shown when Report is detailed, summary)
				Options: securityscorecard, company_and_securityscorecard, company
Date	string	Yes	—	Date for the events report (YYYY-MM-DD or date string). (shown when Report is events-json)
Options (reportOptions)	collection	No	{}	Output settings for issues and portfolio reports. (shown when Report is issues, portfolio)
— Format	options	No	pdf	File format of the generated report.
				Options: csv, pdf
Options (footprintOptions)	collection	No	{}	Scope and output settings for the footprint report. (shown when Report is scorecard-footprint)
— Countries	string	No	—	Comma-separated list of countries.
— Format	options	No	pdf	File format of the generated report.
				Options: csv, pdf
— IPs	string	No	—	Comma-separated list of IPs.
— Subdomains	string	No	—	Comma-separated list of subdomains.

Report: Download

Parameter	Type	Required	Default	Description
Report URL (url)	string	Yes	—	URL to a generated report (obtained from Generate or Get Many operations). Supports expressions.
Binary Property	string	Yes	data	Name of the binary property to write the downloaded report to. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.

Report: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	100	Max number of results to return. Between 1 and 100. (shown when Return All is false)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

Every operation merges its result onto the input item JSON — the incoming fields pass through unchanged, and binary data is forwarded. Where the operations differ is how many items come out.

Operations that fan out — one output item per record returned, each carrying that record’s fields merged onto the input item:

Resource / Operation	One item per
company / getFactor	Factor entry (issue counts and scores per factor)
company / getFactorHistorical	Historical factor entry
company / getHistoricalScore	Historical score entry
company / getScorePlan	Score-plan entry
industry / getFactor	Industry factor entry
industry / getFactorHistorical	Historical industry factor entry
portfolio / getAll	Portfolio
portfolioCompany / getAll	Company in the portfolio
report / getAll	Recently generated report

With Return All off these lists are truncated to Limit before the items are emitted. If nothing matches, the input item produces no output item at all.

Operations that produce exactly one output item:

Resource / Operation	Fields merged onto the item
company / getScorecard	The company’s scorecard summary.
industry / getScore	The industry’s score.
invite / create	The API’s invite response.
portfolio / create	The created portfolio.
portfolio / update	The updated portfolio.
portfolio / delete	success: true
portfolioCompany / add	The API’s add response.
portfolioCompany / remove	success: true
report / generate	The generate response — it carries the URL you later feed to download.
report / download	reportUrl, downloaded: true and fileSize (bytes). The report file itself is written to the named Binary Property, keeping the file name from the URL, alongside any binary the item already carried.

Reference the result downstream by expression, e.g. {{ $json.fileSize }} or {{ $json.success }}.

Usage Examples

• Get a company security scorecard by domain
• Download a SecurityScorecard report as PDF
• List all portfolios in SecurityScorecard
• Generate a detailed security report for a company
• Get historical security scores for a company
• Add a company to a SecurityScorecard portfolio

Example Configuration

Look up a company’s scorecard by the domain on the incoming item:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getScorecard",
    "scorecardIdentifier": "{{ $json.domain }}"
  }
}

Pull a company’s high-severity factor issues, one item per factor:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getFactor",
    "scorecardIdentifier": "example.com",
    "returnAll": false,
    "limit": 25,
    "filters": {
      "severity_in": "high,critical"
    }
  }
}

Track a company’s score month by month over a year:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "company",
    "operation": "getHistoricalScore",
    "scorecardIdentifier": "example.com",
    "returnAll": true,
    "simple": true,
    "options": {
      "date_from": "2023-01-01",
      "date_to": "2023-12-31",
      "timing": "monthly"
    }
  }
}

Create a shared portfolio:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolio",
    "operation": "create",
    "name": "Q1 2024 Vendors",
    "portfolioDescription": "Vendor security assessments for Q1 2024",
    "privacy": "shared"
  }
}

Add a vendor from the incoming item to that portfolio:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolioCompany",
    "operation": "add",
    "portfolioId": "portfolio-123",
    "domain": "{{ $json.vendorDomain }}"
  }
}

List the active technology companies in a portfolio, graded A:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "portfolioCompany",
    "operation": "getAll",
    "portfolioId": "portfolio-123",
    "returnAll": false,
    "limit": 25,
    "portfolioCompanyFilters": {
      "grade": "A",
      "industry": "technology",
      "status": "active",
      "vulnerability": "high"
    }
  }
}

Generate a co-branded detailed company report:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "detailed",
    "scorecardIdentifier": "example.com",
    "branding": "company_and_securityscorecard"
  }
}

Generate a portfolio report as CSV:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "portfolio",
    "portfolioId": "portfolio-123",
    "reportOptions": {
      "format": "csv"
    }
  }
}

Generate a scorecard footprint report scoped to specific countries and subdomains:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "generate",
    "report": "scorecard-footprint",
    "scorecardIdentifier": "example.com",
    "footprintOptions": {
      "format": "pdf",
      "countries": "US,CA,UK",
      "ips": "192.168.1.0/24",
      "subdomains": "*.example.com"
    }
  }
}

Download a generated report into binary data:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "report",
    "operation": "download",
    "url": "{{ $json.url }}",
    "binaryPropertyName": "reportFile"
  }
}

Invite a vendor to complete an assessment:

{
  "type": "security_scorecard",
  "parameters": {
    "resource": "invite",
    "operation": "create",
    "email": "{{ $json.contactEmail }}",
    "firstName": "John",
    "lastName": "Doe",
    "message": "Please join our security assessment program",
    "additionalFields": {
      "domain": "example.com",
      "issue_title": "Security Assessment Required",
      "issue_desc": "We need you to complete a security assessment",
      "issue_type": "vulnerability",
      "days_to_resolve_issue": 30,
      "grade_to_maintain": "A",
      "is_organization_point_of_contact": true,
      "sendme_copy": true
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Retrieve security scores, manage portfolios, and download reports from SecurityScorecard cybersecurity ratings platform.

Behavior notes

• Generate then download. generate returns a URL rather than a file; feed that URL into a second node running download to get the bytes into binary data.
• Comma-separated footprint fields. Countries, IPs and Subdomains are typed as comma-separated text and split for you, so US,CA,UK is correct — do not wrap them in brackets.
• Return All and Limit apply after the API responds. The list is fetched and then truncated, so a large Return All still pulls the full response from SecurityScorecard.
• Simplify is on by default for the historical operations; turn it off when you need the raw API shape rather than the condensed one.
• Branding only applies to the detailed and summary reports, and format only to the issues, portfolio and footprint reports — the other report types ignore both.

Common patterns

• Security assessment workflow — company / getScorecard for the summary, then getFactor with filters to find the weak points, then report / generate and report / download to produce the document.
• Portfolio management — portfolio / create, then portfolioCompany / add per vendor, then portfolioCompany / getAll with filters to monitor them, and report / generate with portfolio for a roll-up.
• Historical analysis — getHistoricalScore with a date range and Simplify on for easy charting, and industry / getFactorHistorical to compare against the sector.