---
title: "Score a domain 0-100 across six identity dimensions"
method: POST
path: "/v1/metered/identity-risk-score"
tags: ["Vendor and organisation risk"]
---

# Score a domain 0-100 across six identity dimensions

`POST /v1/metered/identity-risk-score`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/identity-risk-score`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

A security credit score for any domain: breach exposure, infostealer density, IOC corpus presence, ransomware victim listing, active session exposure and CVE exposure. Returns the per-dimension breakdown as well as the total, so the score is auditable rather than a black box. MSPs embed this in QBRs, insurance renewals and onboarding assessments.

**Billing.** $0.35 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

## Request body

- object
  - `domain` string, required: Domain to score.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `domain` string: The normalised domain.
    - `risk_score` integer: Total 0-100. Higher is worse.
    - `risk_level` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': CRITICAL at 70+, HIGH at 45+, MEDIUM at 22+, otherwise LOW.
    - `grade` 'A' | 'B' | 'C' | 'D' | 'F': F at 70+, D at 45+, C at 25+, B at 10+, otherwise A.
    - `dimension_scores` object: Per-dimension contribution to the total.
      - `breach_exposure` integer: 0-25, scaled by accounts affected.
      - `infostealer_density` integer: 0-25, scaled by stealer-log hit volume.
      - `ioc_presence` integer: 0-15, attributed IOCs referencing the brand.
      - `ransomware_victim` integer: 0 or 20.
      - `session_exposure` integer: 0-10, stolen session records.
      - `cve_exposure` integer: 0-25, weighted toward ransomware-linked KEV entries.
    - `max_score` integer: Always 100.
    - `risk_factors` string[]: Plain-English reasons, one per contributing dimension.
    - `summary` string: One-line summary of score, grade and dimensions triggered.
    - `recommendation` string: Recommended action.

## Other responses

- `400`: `domain` is missing or contains no '.'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)