> ## Documentation Index
> Fetch the complete documentation index at: https://developers.marko.fr/llms.txt
> Use this file to discover all available pages before exploring further.

# Lister les risques tiers d'un opérateur

> Expose les événements de surveillance tiers rattachés à un opérateur.



## OpenAPI

````yaml https://partner-api.marko.fr/v1/openapi.json get /operateurs/{operateur_id}/third-party-risks
openapi: 3.1.0
info:
  title: MARKO External Partner API
  version: v1
  description: >-
    Stable external API contract for the live environment.


    Authentication flow for partner integrations:

    1. Generate an API key from the MARKO entity admin API section.

    2. Keep the raw API secret server-side and use it only to sign `POST
    /v1/auth/token`.

    3. Build the canonical message
    `MARKO-EXTERNAL-API-TOKEN-V1\n{key_id}\n{timestamp}\n{nonce}`.

    4. Sign that message with HMAC-SHA256 and send the hex signature with
    `key_id`, `timestamp` and `nonce`.

    5. Use the returned short-lived bearer on business endpoints as
    `Authorization: Bearer <access_token>`.

    The raw API secret must never be sent on business endpoints.


    This public contract intentionally excludes beta endpoints.
servers:
  - url: https://partner-api.marko.fr/v1
security:
  - BearerAuth: []
externalDocs:
  description: Download the matching Postman collection.
  url: /v1/postman.json
paths:
  /operateurs/{operateur_id}/third-party-risks:
    get:
      tags:
        - operateurs
      summary: Lister les risques tiers d'un opérateur
      description: Expose les événements de surveillance tiers rattachés à un opérateur.
      operationId: operateurs_third-party-risks_list
      parameters:
        - in: path
          name: operateur_id
          required: true
          schema:
            type: string
            format: uuid
          example: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
        - in: query
          name: active_only
          required: false
          schema:
            type: string
          example: true
        - in: query
          name: limit
          required: false
          schema:
            type: string
          example: 20
        - in: query
          name: offset
          required: false
          schema:
            type: string
          example: 0
        - in: header
          name: X-Request-ID
          required: false
          description: >-
            Partner-generated correlation identifier echoed in logs and error
            payloads.
          schema:
            type: string
          example: marko-operateurs-third-party-risks-list
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema: {}
              example:
                items:
                  - id: risk_001
                    severity: warning
                    title: Publication BODACC
                total: 1
        '401':
          description: Authentication required
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: about:blank
                title: Unauthorized
                status: 401
                detail: A valid bearer token is required.
                request_id: req_example_partner_call
        '403':
          description: Scope, route or IP restriction
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: about:blank
                title: Forbidden
                status: 403
                detail: The API key does not allow this operation.
                request_id: req_example_partner_call
        '422':
          description: Validation failed
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: about:blank
                title: Unprocessable Content
                status: 422
                detail: The request payload or parameters are invalid.
                request_id: req_example_partner_call
        '429':
          description: Rate limit or progressive ban
          headers:
            Retry-After:
              description: Cooldown in seconds before retrying the request.
              schema:
                type: string
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: about:blank
                title: Too Many Requests
                status: 429
                detail: The request rate limit was exceeded.
                request_id: req_example_partner_call
        '500':
          description: Unexpected server error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
              example:
                type: about:blank
                title: Internal Server Error
                status: 500
                detail: An unexpected server error occurred.
                request_id: req_example_partner_call
      deprecated: false
      security:
        - BearerAuth: []
components:
  schemas:
    ProblemDetails:
      type: object
      required:
        - title
        - status
        - detail
      properties:
        type:
          type: string
          default: about:blank
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        request_id:
          type: string
        scope:
          type: string
        route_id:
          type: string
        reason_code:
          type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: MARKO short-lived bearer
      description: >-
        Use the `access_token` returned by `POST /v1/auth/token`. Do not send
        the raw API secret on business endpoints.

````