---
title: "Score how likely a domain is to be targeted"
method: POST
path: "/v1/metered/target-risk"
tags: ["Vendor and organisation risk"]
---

# Score how likely a domain is to be targeted

`POST /v1/metered/target-risk`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/metered/target-risk`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Correlates six signals -- ransomware victim listing, stealer-log hits, breach exposure, criminal channel mentions, high-EPSS CVEs and pre-ransomware credentials -- into a 0-100 score with a four-tier rating. Every contributing signal is returned with its weight, so the score can be explained to whoever has to act on it.

**Billing.** $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.

**Note.** Each of the six signal lookups is independently fault-tolerant: one failing source lowers the score rather than failing the request, so treat a LOW score as 'no signals fired', not as a guarantee.

## Request body

- object
  - `domain` string, required: Domain to score. A leading `www.` is stripped.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `record_type` string: Always `threat_prediction`.
    - `domain` string: The normalised domain.
    - `target_risk_score` integer: 0-100. Higher is worse.
    - `probability_tier` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW': CRITICAL at 60+, HIGH at 35+, MEDIUM at 15+, otherwise LOW.
    - `signals` object[]: Only the signals that fired, each with the points it contributed.
      - `signal` 'ransomware_victim' | 'stealer_log_hits' | 'breach_exposure' | 'criminal_channel_mention' | 'high_epss_cves_active': Signal identifier.
      - `weight` integer: Points this signal added to the total.
      - `detail` string: Plain-English explanation.
    - `recommendation` string: Recommended action for the tier.
    - `checked_at` string, date-time: ISO 8601 UTC timestamp of when this check ran.

## Other responses

- `400`: `domain` is missing or contains no '.'.
- `401`: Missing or invalid API key.
- `402`: No credits and no active subscription. The response carries `topup_url`.
- `405`: Wrong HTTP method. Every endpoint is POST.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)