---
title: "Risk overview"
method: GET
path: "/stats/risk/overview"
tags: ["Stats"]
---

# Risk overview

`GET /stats/risk/overview`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/risk/overview`
- Auth: `bearer` (a scheme the document does not define)

Admin-only. Counts of flagged users by level, clusters, and identity signals recorded, plus when flags were last recomputed.

## Response `200`

- APIRiskOverview
  - `computedAt` string, nullable, required: When the flags were last recomputed (ISO 8601); null before the first run.
  - `highUsers` number, required: Users at high risk who still need a look: not banned, not in a cluster reviewed as not a problem (ADR 0055) and not in an open duplicate-account case (ADR 0057). Medium and low count the same way.
  - `mediumUsers` number, required
  - `lowUsers` number, required
  - `clusters` number, required: Clusters of 2 or more linked accounts.
  - `openClusters` number, required: Clusters that still need a verdict.
  - `contactedClusters` number, required: Clusters with a member in an open duplicate-account case (ADR 0057).
  - `dismissedClusters` number, required: Clusters reviewed as not a problem.
  - `bannedClusters` number, required: Clusters whose every member is banned.
  - `clusteredUsers` number, required: Users inside a cluster.
  - `trustedUsers` number, required: Users an admin marked as genuine; the engine skips them.
  - `signals` number, required: Identity signals recorded in total.
  - `signalsLast24h` number, required: Identity signals recorded in the last 24 hours.
  - `devices` number, required: Distinct device IDs seen.

## Other responses

- `403`: Admin access required

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)