SecurityScorecard n8n integrationAutomate SecurityScorecard with n8n.

Returns the factor scores for one company along with the issue counts behind them, so a review has something more actionable than a single headline figure.

• Scorecard Identifier: the primary identifier of a company or scorecard, meaning a domain. Coming from an earlier node, reference it with {{ $json.field }}.
• Severity In: an optional filter that keeps only issues matching a comma-separated severity list.
• Return All: on, n8n walks every page of factor results; off, Limit caps how many come back.

Same factor-level detail, replayed across a period instead of a single snapshot, which is what a trend needs.

• Scorecard Identifier: the company or scorecard identifier, a domain.
• Date From and Date To: the start and end of the history window.
• Timing: date granularity, either daily, weekly or monthly.
• Simplify: returns a simplified version of the response instead of the raw data, handy before writing rows to a sheet.

Pulls the company's scores over time rather than the factor breakdown, one series for the whole scorecard.

• Scorecard Identifier: the domain of the company being tracked.
• Date From and Date To: the history start and end dates.
• Timing: monthly for a board slide, daily when something is being watched closely.
• Return All: off by default, so Limit decides how many points a long window returns.

One call, one company: the company information plus a summary of their scorecard. It is the operation to reach for when a workflow needs context about a domain rather than a deep dive.

• Scorecard Identifier: the primary identifier of a company or scorecard, in practice its domain, and the only field the operation requires.

Asks SecurityScorecard what it would take for a company to reach a score you name, and returns that improvement plan.

• Scorecard Identifier: the domain of the company the plan is built for.
• Score: the score target, a number, and the field that makes this operation different from the other Company reads.
• Return All: on, every step of the plan is returned; off, Limit truncates the list.

Moves the same factor view up a level, from one company to a whole industry, which gives a company reading somewhere to sit.

• Industry: a fixed list of 5 choices, food, healthcare, manofacturing, retail and technology. The spelling of the manufacturing value is the node's own, so copy it as shown.
• Simplify: returns a simplified response instead of the raw data.
• Return All: paginates through the full result set instead of stopping at Limit.

The industry factor view over a window of time, so a movement on one supplier can be checked against the sector rather than read alone.

• Industry: one of the 5 values the node offers.
• Date From and Date To: the history start and end dates for this operation.
• Simplify: a simplified version of the response instead of the raw data.

The lightest call on the node: an industry goes in, its score comes out, with nothing else to configure.

• Industry: the only field, picked from food, healthcare, manofacturing, retail or technology.

Creates an invite for a company or user, which is how a supplier gets brought onto the platform from a workflow instead of by hand.

• Email, First Name and Last Name: the invitee, all three required.
• Message: the message for the invitee, also required, so it needs real text and not a placeholder.
• Domain: one of 9 additional fields, holding the invitee company domain.
• Grade to Maintain: requests the invitee's organisation to maintain a minimum grade.

Creates a portfolio, the container that companies are later added to and monitored in.

• Portfolio Name: the name of the portfolio, the only required field.
• Description: free text, worth filling when several portfolios share similar names.
• Privacy: private keeps it visible to you only, team to the people on your team, shared to everyone in your company.

Removes a portfolio from the account. There is no confirmation step inside the node, so the workflow itself has to be sure.

• Portfolio ID: the identifier of the portfolio, not its name. Get Many portfolios first if only the name is known, then pass the identifier along with {{ $json.field }}.

Lists the portfolios on the account, which is how most workflows resolve a portfolio name into the identifier every other portfolio operation needs.

• Return All: on, n8n pages through every portfolio; off, Limit sets the maximum number returned.

Changes an existing portfolio rather than creating a second one next to it.

• Portfolio ID: which portfolio gets updated.
• Portfolio Name: required here too, so the name is always sent, even when only the description is changing.
• Privacy: switch between private, team and shared as a portfolio stops being a personal experiment.

Puts a company inside a portfolio so it gets monitored with the rest of the group.

• Portfolio ID: the portfolio receiving the company.
• Domain: the company's domain name, which is what identifies it here.

Reads the companies inside one portfolio, with 5 filters available to narrow the list before it reaches the next node.

• Portfolio ID: the portfolio being read.
• Grade, Industry and Issue Type: filters on company score grade, industry and issue type.
• Vulnerability: a CVE vulnerability filter.
• Status: active or inactive.

Takes a company out of a portfolio. The company itself is untouched, only its membership of that portfolio ends.

• Portfolio ID: the portfolio the company leaves.
• Domain: the company's domain name, matching the one used when it was added.

Fetches a report that has already been generated and hands the file to the next node as binary data.

• Report URL: the report file path or HTTPS download URL from the SecurityScorecard API at api.securityscorecard.io.
• Put Output File in Field: the name of the output binary field the file goes into, which the following node reads by that exact name.

Asks the platform to build a report. Generation and retrieval are separate steps, which is why the public template chains generate, list and download.

• Report: 8 types, from summary and detailed to issues, events-json, partnership, full-scorecard-json, portfolio and scorecard-footprint.
• Scorecard Identifier, Portfolio ID and Date: required alongside the type.
• Format: csv or pdf.
• Branding: SecurityScorecard, Company, or both.

Returns the list of recently generated reports, which is the step between asking for a report and downloading it.

• Return All: on, the whole list comes back page by page; off, Limit keeps it to the most recent few.