---
title: "Domain Risk Score"
method: GET
path: "/v1/risk/"
tags: ["Lookups"]
---

# Domain Risk Score

`GET /v1/risk/`

## Request

- Base URL: `https://api.domaintools.com`
- URL: `https://api.domaintools.com/v1/risk/`
- Auth: one of:
  - API key in header `X-Api-Key`
  - HTTP basic
  - API key in query parameter `signature`
- TypeScript: <https://skmtc.dev/domaintools/apis/domaintools-lookups-and-monitors-api/docs/v1/risk/get.ts> (a function with typed inputs; its response is checked against the schema)

Provides risk scores and threat predictions based on DomainTools Proximity and Threat Profile algorithms.

## Query parameters

- `domain` string, required: A base (apex) domain like example.com, excluding subdomains.
- `app_partner` string: A short identifier, code, or handle.
- `app_name` string: A short identifier, code, or handle.
- `app_version` string: A short identifier, code, or handle.
- `format` 'html' | 'json' | 'xml': The desired response format.

## Response `200`

OK

- DomainRiskScore
  - `response` object
    - `domain` string: A base (apex) domain like example.com, excluding subdomains.
    - `risk_score` integer: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
    - `components` DomainRiskComponent[]
      - union: A polymorphic schema representing one of several types of risk components.
        - Proximity: Indicates risk based on proximity to known threats or suspicious infrastructure.
          - `name` 'proximity', required: The type of risk component.
          - `risk_score` integer, required: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
          - `evidence` string[]: Optional array of evidence types supporting the risk score for this component.
        - ThreatProfile: Indicates risk based on machine-learning models.
          - `name` 'threat_profile', required: The type of risk component.
          - `risk_score` integer, required: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
          - `evidence` string[]: Optional array of evidence types supporting the risk score for this component.
        - ThreatProfileMalware: Indicates risk based on a machine-learning model that classifies domains as malware-related.
          - `name` 'threat_profile_malware', required: The type of risk component.
          - `risk_score` integer, required: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
          - `evidence` string[]: Optional array of evidence types supporting the risk score for this component.
        - ThreatProfilePhishing: Indicates risk based on a machine-learning model that classifies domains as phishing-related.
          - `name` 'threat_profile_phishing', required: The type of risk component.
          - `risk_score` integer, required: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
          - `evidence` string[]: Optional array of evidence types supporting the risk score for this component.
        - ThreatProfileSpam: Indicates risk based on a machine-learning model that classifies domains as spam-related.
          - `name` 'threat_profile_spam', required: The type of risk component.
          - `risk_score` integer, required: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
          - `evidence` string[]: Optional array of evidence types supporting the risk score for this component.
        - ZeroListedScore: Indicates the domain is on a known-good 'zero list' and is not considered a threat.
          - `name` 'zerolist', required: The type of risk component.
          - `risk_score` 0, required: The risk score for a zerolisted domain, which is always 0.

## Other responses

- `400`: 400: Bad Request. The request was invalid. The response will contain details about the error.
- `401`: 401: Unauthorized. API credentials are required and were not provided, or the provided credentials are not valid.
- `403`: 403: Forbidden. The API credentials provided do not have access to the requested resource or endpoint.
- `404`: 404: Not Found. The requested resource does not exist.
- `500`: 500: Internal Server Error. An unexpected error occurred on the server. If the problem persists, contact DomainTools support.
- `503`: 503: Service Unavailable. The service is temporarily unavailable.

---

[API](https://skmtc.dev/domaintools/apis/domaintools-lookups-and-monitors-api.md) - [All operations](https://skmtc.dev/domaintools/apis/domaintools-lookups-and-monitors-api/llms.txt) - [OpenAPI document](https://skmtc.dev/domaintools/apis/domaintools-lookups-and-monitors-api/revisions/832f423a9729?raw)