Dependency risk for a package or repository: the latest open maintenance forecasts (commits_90d, release_90d), 90 days of commit/release/star activity summarised, the day the entity was last velocity-scored (the score itself and its stage label are both withheld), the plain-language flags those numbers support, and the families' own calibration record — one timestamped answer for an agent choosing a dependency. q is an npm/PyPI/crates.io package name, a GitHub owner/repo (or URL), or npm: / pypi: / crate: / repo: plus a name. See foresight_api.risk for what each block means and how a package is linked to its repository.

view (pilot findings, Priority 5): full (default -- every diagnostic field, this endpoint's historical shape plus status and triage) or compact (foresight_api.risk_batch.compact_view -- what was resolved, coverage status, key evidence, forecasts, warnings, nothing else). The default stays full on purpose: entity.html and coverage_preview.py already depend on fields (signals, calibration_note, repo_link) this endpoint has always returned by default, so making compact the default would silently break both rather than opt anyone in.

status and triage are in the DEFAULT answer since #325(a). They were not between 2026-09-13 and then: Priority 3/4/5 computed them only inside risk_batch, so the two fields the pilot is sold on were reachable only from ?view=compact or /v1/risk/batch, while both pilot documents' example URLs are this bare default. Added, never substituted -- every field the default carried before is still here, so existing consumers read exactly what they read before and gain two.