---
title: "One user’s risk, linked accounts and identity signals"
method: GET
path: "/stats/risk/users/{id}"
tags: ["Stats"]
---

# One user’s risk, linked accounts and identity signals

`GET /stats/risk/users/{id}`

## Request

- Base URL: `https://api.nippy.host`
- URL: `https://api.nippy.host/stats/risk/users/{id}`
- Auth: `bearer` (a scheme the document does not define)

Admin-only. The score and reasons from the last recompute, every account linked to this user with what links them, and the newest 100 identity signals (IP, network prefix, device, user agent).

## Path parameters

- `id` string, required

## Response `200`

- APIUserRisk
  - `userId` string, required
  - `score` number, nullable, required
  - `level` 'high' | 'medium' | 'low', nullable, required
  - `reviewed` boolean, required: True while the user’s cluster is reviewed as not a problem. The score stays, but the work queues skip the user.
  - `trusted` APIRiskTrust, required
    - `note` string, nullable, required
    - `trustedAt` string, required
    - `trustedByName` string, nullable, required
  - `reasons` APIRiskReason[], required
    - `code` 'device' | 'mailbox' | 'ip_burst' | 'email_domain' | 'numbered_stem' | 'same_file' | 'ip_prefix_day' | 'cluster_size' | 'document_farm', required
    - `label` string, required
    - `detail` string, required
    - `points` number, required
  - `clusterId` string, nullable, required
  - `clusterSize` number, required
  - `firstFlaggedAt` string, nullable, required
  - `computedAt` string, nullable, required
  - `linkedAccounts` APIRiskLinkedAccount[], required
    - `userId` string, required
    - `email` string, required
    - `bannedAt` string, nullable, required
    - `score` number, nullable, required
    - `level` 'high' | 'medium' | 'low', nullable, required
    - `links` APIRiskLink[], required
      - `kind` 'device' | 'mailbox' | 'ip_burst' | 'email_domain' | 'numbered_stem' | 'same_file' | 'ip_prefix_day', required
      - `value` string, required
  - `signals` APIIdentitySignal[], required: Newest first, capped at 100.
    - `id` string, required
    - `event` string, required
    - `ip` string, nullable, required
    - `ipPrefix` string, nullable, required
    - `deviceId` string, nullable, required
    - `userAgent` string, nullable, required
    - `source` string, nullable, required
    - `siteId` string, nullable, required
    - `createdAt` string, required

## Other responses

- `403`: Admin access required
- `404`: User not found

---

[API](https://skmtc.dev/nippy/apis/nippy-backend-api.md) · [All operations](https://skmtc.dev/nippy/apis/nippy-backend-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nippy/apis/nippy-backend-api/revisions/7ab23f040a55?raw)