Risk Scoring API
Real-World Identity Risk Based on Attacker Behavior
The Risk Scoring API transforms raw exposure signals into a single, trustworthy 0β100 identity risk score β powered by AI correlation across breach data, dark-web telemetry, and attacker behavior.
"Has this identity been leaked?"
"How risky is this user β right now?"
Risk Scoring In The Real World
See how the Risk Scoring API transforms suspicious activity into actionable intelligence.
Example: Login from new device β Risk Score = 78 β Trigger: MFA + velocity risk review
Event Detected
Login attempt from unfamiliar device + location
Risk Analysis
Score = 78 (High Risk) based on velocity + device signals
Action Triggered
Step-up MFA enforced + analyst velocity review
What The Risk Score Represents
Each user lookup produces a continuous risk score from 0β100, designed for policy engines, fraud models, IAM, and SOC.
Inputs Into The Model
Risk scoring combines multiple intelligence dimensions into one unified score.
Credential Exposure Intelligence
- Password reuse likelihood
- Breach recency
- Exposure depth
- Hashed / plaintext classification
- Attacker interest trends
Dark-Web & Criminal Market Signals
- Reposts & combo list circulation
- Trade volume
- Mention intelligence
- "Ready-to-use" credential flags
- Marketplace activity
Identity Trust Indicators
- Email age
- Alias / burner / masked
- Corporate vs consumer domain
- Validation integrity
- Passive risk footprint
Bot & Abuse Risk
- Behavioral anomalies
- Known fraud vectors
- Throw-away lifecycle patterns
- Velocity signals
- Registration timing
Real-World Threat Funnel Stage
We don't just check if credentials leaked β we analyze where they are in the criminal process.
Risk increases as the funnel progresses β from passive exposure to active criminal monetization.
Output You Receive
Each API response includes everything your system needs to decide automatically.
Risk Score
0β100 continuous scale
Confidence Level
low / medium / high
Threat Funnel Stage
Attack lifecycle position
Risk Reason Codes
Explainable factors
Suggested Action
allow / step_up / block
API Reference
Simple REST API with JSON request/response.
curl -X POST "https://api.cityofhats.com/api/v1/risk/score" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_KEY" \
-d '{
"email": "user@example.com"
}'{
"email": "user@example.com",
"risk_score": 84,
"confidence": "high",
"threat_stage": "TESTED",
"exposed": true,
"exposure_count": 8,
"last_seen": "2025-01-02",
"risk_reasons": [
"recent credential exposure",
"observed on criminal trade channels",
"suspected password reuse",
"active testing detected"
],
"recommended_action": "step_up_auth",
"model_version": "2.1"
}Response Field Reference
risk_score
integer
0β100 risk score (higher = more risky)
confidence
string
low | medium | high β model confidence level
threat_stage
string
CLEAN | LEAKED | REPOSTED | TRADED | TESTED | ATTACKED | MONETIZED
exposed
boolean
Whether email appears in breach data
exposure_count
integer
Number of breach/exposure sources
last_seen
string
ISO 8601 date of most recent exposure
risk_reasons
array
Human-readable explainable risk factors
recommended_action
string
allow | step_up_auth | block | review
model_version
string
Risk model version for audit/compliance
Why Risk Score Instead of Binary Exposure?
Traditional Tools Answer:
"Breached? Yes / No."
City of Hats Answers:
"How likely is harm?"
Model Integrity & Explainability
Every score includes explainable reason codes, so:
Built For Modern Security Stacks
Ideal For
π Privacy & Compliance
Your platform operates with confidence.
- Never stores passwords
- Never resells identity data
- Anonymizes telemetry
- Honors enterprise governance
- SOC 2 Type II compliant
- GDPR / PDPA aligned
β‘ Performance
Built for real-time decisioning at scale.
- Real-time lookups
- Enterprise-scale throughput
- Global delivery
- 99.9% uptime SLA
- <200ms p95 latency
- Unlimited lookups (Enterprise)
The Risk Scoring API converts raw exposure intelligence into a single, reliable decision signal β so your platform can reduce friction for good users, and stop attackers early.
Start Using Risk Scoring API
Transform exposure signals into actionable risk scores. Free tier available β no credit card required.