Sign in

v1

latestOpenAPI 3.1.0Commercial License2026-07-132434129.1 KB
Risk Score API

Calculate risk score for specific IP address

Analyzes a specific IP address with optional email correlation for enhanced fraud detection.

IP Analysis Includes:

  • Network type classification (residential, datacenter, mobile)
  • Anonymization service detection (VPN, proxy, Tor)
  • Threat intelligence feeds (spam, malware, botnet)
  • Geographic anomaly detection
  • Historical behavior patterns

Combined Analysis (when email provided):

  • Cross-reference IP and email reputation
  • Account takeover risk assessment
  • Multi-factor fraud indicators

Response Time: Typically < 200ms for cached results, < 1s for new lookups

get/api/v1/risk-score/{ip}

Path parameters

ipstring required

Target IP address for risk score analysis. Supports both IPv4 (e.g., 203.0.113.1) and IPv6 (e.g., 2001:db8::1) formats. Private IP ranges (10.x.x.x, 192.168.x.x, 172.16-31.x.x) will return limited analysis.

Query parameters

emailstring

Optional email address for combined IP+email risk analysis. When provided, enables cross-correlation between IP and email reputation, account takeover detection, and enhanced fraud scoring. Must be a valid email format.

Response

Risk score calculated successfully with detailed factor breakdown

scorenumber double required

Risk score on a scale of 0.0-1.0, where higher values indicate greater risk.

Score Ranges:

  • 0.8-1.0: Very High Risk (immediate manual review recommended)
  • 0.6-0.8: High Risk (enhanced verification required)
  • 0.4-0.6: Medium Risk (standard verification procedures)
  • 0.2-0.4: Low Risk (low fraud probability)
  • 0.0-0.2: Very Low Risk (trusted, minimal verification needed)

The score is calculated by averaging individual risk factor scores from IP and email analysis. Risk factors are weighted based on their threat level and combined into a normalized score.

risk_level'VERY_LOW' | 'LOW' | 'MEDIUM' | 'HIGH' | 'VERY_HIGH' required

Human-readable risk classification derived from the numerical risk score.

Risk Levels:

  • VERY_HIGH (0.8-1.0): Immediate attention required, high probability of fraud
  • HIGH (0.6-0.8): Enhanced verification recommended, elevated fraud risk
  • MEDIUM (0.4-0.6): Standard verification sufficient, moderate risk
  • LOW (0.2-0.4): Minimal verification needed, low fraud probability
  • VERY_LOW (0.0-0.2): Trusted, very low risk

This classification helps in automated decision-making and risk-based workflows.

ipstring nullable

The IP address that was analyzed for this risk score calculation.

Null when: Only email analysis was requested (using /email/{email} endpoint) Present when: IP analysis was performed (either from request headers or explicit IP parameter)

Format can be IPv4 (e.g., 203.0.113.195) or IPv6 (e.g., 2001:db8::1)

emailstring nullable

The email address that was analyzed for this risk score calculation.

Null when: Only IP analysis was requested (using root endpoint or /{ip} without email param) Present when: Email analysis was performed (either via /email/{email} or as query parameter)

Always returned in lowercase, normalized format regardless of input casing.

Example response

{
  "score": 0.675,
  "risk_level": "HIGH",
  "ip": "203.0.113.195",
  "email": "user@example.com",
  "factors": {
    "ip_factors": {
      "is_proxy": false,
      "is_tor_node": false,
      "is_spam": true,
      "is_vpn": false,
      "is_datacenter": true,
      "risk_contribution": 0.15
    },
    "email_factors": {
      "is_disposable": false,
      "is_valid_syntax": true,
      "risk_contribution": 0
    }
  }
}