--- title: "Batch Get Risk Summaries" method: GET path: "/v1alpha2/organizations/{organization}/riskSummaries:batchGet" tags: ["ClientService"] --- # Batch Get Risk Summaries `GET /v1alpha2/organizations/{organization}/riskSummaries:batchGet` ## Request - Base URL: `https://api.thirdfort.dev/client/api` - URL: `https://api.thirdfort.dev/client/api/v1alpha2/organizations/{organization}/riskSummaries:batchGet` - Auth: HTTP bearer Retrieves the RiskSummary for multiple Checks in a single request. All names must belong to teams within the Organization specified by parent. Maximum of 100 summaries can be retrieved per request. ## Path parameters - `organization` string, required ## Query parameters - `names` string[], required ## Response `200` A successful response. - BatchGetRiskSummariesResponse: Response message for [ClientService.BatchGetRiskSummaries](#/operations/ClientService_BatchGetRiskSummaries). - `riskSummaries` RiskSummary[]: Retrieved risk summaries in the same order as requested names. - `name` string - `domains` RiskSummaryDomainSummary[]: One entry per domain that has at least one visible indicator on the check. Domains with no visible indicators are omitted. - `domain` 'RISK_INDICATOR_DOMAIN_UNSPECIFIED' | 'RISK_INDICATOR_DOMAIN_SCREENING' | 'RISK_INDICATOR_DOMAIN_IDENTITY' | 'RISK_INDICATOR_DOMAIN_SOURCE_OF_FUNDS' | 'RISK_INDICATOR_DOMAIN_ADDRESS' | 'RISK_INDICATOR_DOMAIN_CLIENT_ALERT' | 'RISK_INDICATOR_DOMAIN_BANK_STATEMENTS' | 'RISK_INDICATOR_DOMAIN_KYB': The product-facing domain a [RiskIndicator](#/schemas/RiskIndicator) belongs to. Domains are a presentation concept first: they group indicators for the Task Manager pills and may not map 1:1 to the underlying [Finding](#/schemas/Finding) payload categorisation. - RISK_INDICATOR_DOMAIN_UNSPECIFIED: Default value. Set on placeholder ("no-verdict") revisions where no domain applies because no rule matched the underlying [Finding](#/schemas/Finding). - RISK_INDICATOR_DOMAIN_SCREENING: Sanctions, PEP, and adverse media findings from screening providers. - RISK_INDICATOR_DOMAIN_IDENTITY: Identity document and identity verification findings. - RISK_INDICATOR_DOMAIN_SOURCE_OF_FUNDS: Source of Funds findings. - RISK_INDICATOR_DOMAIN_ADDRESS: Address verification and proof-of-address findings (address-match providers and supporting-document checks). CCJ, insolvency, and child-maintenance-order findings — though from the same Experian provider — belong to RISK_INDICATOR_DOMAIN_CLIENT_ALERT, not this domain. - RISK_INDICATOR_DOMAIN_CLIENT_ALERT: Adverse-financial and legal alerts about the subject: CCJs, insolvency/bankruptcy, and child-maintenance orders (Experian uk-contras C65xx). Grouped separately from RISK_INDICATOR_DOMAIN_ADDRESS because they are client-facing alerts rather than address-verification signals. - RISK_INDICATOR_DOMAIN_BANK_STATEMENTS: Bank statement findings. - RISK_INDICATOR_DOMAIN_KYB: KYB verification-check indicators derived from company data (screening matches, jurisdiction, operating status, ownership shape). Unlike the presence-based domains above, KYB indicators exist for every KYB check with a tri-state result; only indicators whose result is RISK_INDICATOR_RESULT_CONSIDER contribute to [RiskSummary](#/schemas/RiskSummary) aggregation, and the domain is excluded entirely from the check's overall risk severity. - `findingCount` integer: Total count of visible indicators in this domain. Matches the count shown on the Task Manager pill. - `highSeverityCount` integer: Count of indicators whose [severity](#/schemas/RiskIndicatorSeverity) is RISK_INDICATOR_SEVERITY_CRITICAL or RISK_INDICATOR_SEVERITY_HIGH. Surfaced in the pill tooltip. - `peakSeverity` 'RISK_INDICATOR_SEVERITY_UNSPECIFIED' | 'RISK_INDICATOR_SEVERITY_CRITICAL' | 'RISK_INDICATOR_SEVERITY_HIGH' | 'RISK_INDICATOR_SEVERITY_MEDIUM' | 'RISK_INDICATOR_SEVERITY_LOW': The severity assigned to a [RiskIndicator](#/schemas/RiskIndicator) by the rule that produced it. Stored at full granularity in the data model even when the UI surfaces a narrower set of tiers, so the rendering can evolve without re-deriving stored values. Values are ordered such that lower numeric value indicates higher severity (CRITICAL = 1, LOW = 4); use the textual ordering CRITICAL > HIGH > MEDIUM > LOW when comparing rather than relying on numeric `<` / `>`. - RISK_INDICATOR_SEVERITY_UNSPECIFIED: Default value. Set on placeholder ("no-verdict") revisions or when the computed verdict has lapsed. - RISK_INDICATOR_SEVERITY_CRITICAL: The highest severity (e.g. active sanction match, active insolvency, document fraud). Emitted by V1 rules and surfaced as the check's peak severity; not yet wired to any automatic escalation. - RISK_INDICATOR_SEVERITY_HIGH: The indicator requires reviewer attention with priority over standard findings (e.g. senior PEP, regulatory warning, active CCJ). - RISK_INDICATOR_SEVERITY_MEDIUM: The indicator warrants review but at standard priority. - RISK_INDICATOR_SEVERITY_LOW: Informational; reviewer attention is optional. - `categories` RiskSummaryCategorySummary[]: Per-category breakdown scoped to this domain: the check-wide categories stats restricted to this domain's indicators, one entry per category present (others omitted). The same category may appear under several domains — the enum is domain-independent — which is what distinguishes, e.g., an Identity from an Address data-comparison. Because an indicator can carry multiple categories, the sum of finding_count here may exceed this domain's own finding_count. - `category` 'RISK_INDICATOR_PRESENTATION_CATEGORY_UNSPECIFIED' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_COMPARISON' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DOCUMENT_AUTHENTICITY' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_PEP' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_FITNESS_AND_PROBITY' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_VALIDATION' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_LAW_ENFORCEMENT': The presentation category(ies) assigned to a [RiskIndicator](#/schemas/RiskIndicator) by the rule(s) that produced it. Categories are an orthogonal classification to [domain](#/schemas/RiskIndicatorDomain): where domain reflects the data source bucket (screening, identity, ...), the presentation category reflects what the indicator is *about* (sanction, document authenticity, ...). A single indicator can carry multiple categories when its underlying [Finding](#/schemas/Finding) matches more than one category rule (e.g. a screening finding flagged as both RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION and RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA). - RISK_INDICATOR_PRESENTATION_CATEGORY_UNSPECIFIED: Default value. Not expected to appear in presentation_categories for well-formed indicators — absence of a category is represented by an empty list, not by emitting this value. - RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_COMPARISON: The indicator reflects a comparison between two pieces of identity data (e.g. extracted document data vs. provided personal details). - RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION: The indicator reflects a sanctions-list match. - RISK_INDICATOR_PRESENTATION_CATEGORY_DOCUMENT_AUTHENTICITY: The indicator reflects a document-authenticity concern (e.g. image integrity, visual authenticity, compromised document, chip cloning). - RISK_INDICATOR_PRESENTATION_CATEGORY_PEP: The indicator reflects a politically-exposed-person (PEP) match. - RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING: The indicator reflects a regulatory warning recorded against the subject. - RISK_INDICATOR_PRESENTATION_CATEGORY_FITNESS_AND_PROBITY: The indicator reflects a fitness-and-probity-list match. - RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA: The indicator reflects adverse-media coverage of the subject. - RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_VALIDATION: The indicator reflects a data-validation concern (e.g. address database match, document data validation, age validation). - RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD: The indicator reflects a police-record concern surfaced by an identity document provider. - RISK_INDICATOR_PRESENTATION_CATEGORY_LAW_ENFORCEMENT: The indicator reflects a law-enforcement action recorded against the subject by a screening provider. Distinct from RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING, which covers regulatory rather than law-enforcement bodies, and from RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD, which an identity document provider surfaces against a document. - `findingCount` integer: Total count of visible indicators carrying this category. - `highSeverityCount` integer: Count of indicators carrying this category whose [severity](#/schemas/RiskIndicatorSeverity) is RISK_INDICATOR_SEVERITY_CRITICAL or RISK_INDICATOR_SEVERITY_HIGH. - `peakSeverity` 'RISK_INDICATOR_SEVERITY_UNSPECIFIED' | 'RISK_INDICATOR_SEVERITY_CRITICAL' | 'RISK_INDICATOR_SEVERITY_HIGH' | 'RISK_INDICATOR_SEVERITY_MEDIUM' | 'RISK_INDICATOR_SEVERITY_LOW': The severity assigned to a [RiskIndicator](#/schemas/RiskIndicator) by the rule that produced it. Stored at full granularity in the data model even when the UI surfaces a narrower set of tiers, so the rendering can evolve without re-deriving stored values. Values are ordered such that lower numeric value indicates higher severity (CRITICAL = 1, LOW = 4); use the textual ordering CRITICAL > HIGH > MEDIUM > LOW when comparing rather than relying on numeric `<` / `>`. - RISK_INDICATOR_SEVERITY_UNSPECIFIED: Default value. Set on placeholder ("no-verdict") revisions or when the computed verdict has lapsed. - RISK_INDICATOR_SEVERITY_CRITICAL: The highest severity (e.g. active sanction match, active insolvency, document fraud). Emitted by V1 rules and surfaced as the check's peak severity; not yet wired to any automatic escalation. - RISK_INDICATOR_SEVERITY_HIGH: The indicator requires reviewer attention with priority over standard findings (e.g. senior PEP, regulatory warning, active CCJ). - RISK_INDICATOR_SEVERITY_MEDIUM: The indicator warrants review but at standard priority. - RISK_INDICATOR_SEVERITY_LOW: Informational; reviewer attention is optional. - `createTime` string, date-time: The time the summary was computed. Because the summary is derived at read time from the latest [RiskIndicatorRevisions](#/schemas/RiskIndicatorRevision), this is the response generation time, not a stored timestamp. - `categories` RiskSummaryCategorySummary[]: One entry per presentation category that has at least one visible indicator on the check. Categories with no visible indicators are omitted. Because indicators can carry multiple categories, the sum of finding_count across categories entries may exceed the total number of visible indicators on the check, and may also exceed the equivalent sum across domains. Indicators whose presentation_categories field is empty do not contribute to any CategorySummary. - `category` 'RISK_INDICATOR_PRESENTATION_CATEGORY_UNSPECIFIED' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_COMPARISON' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DOCUMENT_AUTHENTICITY' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_PEP' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_FITNESS_AND_PROBITY' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_VALIDATION' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD' | 'RISK_INDICATOR_PRESENTATION_CATEGORY_LAW_ENFORCEMENT': The presentation category(ies) assigned to a [RiskIndicator](#/schemas/RiskIndicator) by the rule(s) that produced it. Categories are an orthogonal classification to [domain](#/schemas/RiskIndicatorDomain): where domain reflects the data source bucket (screening, identity, ...), the presentation category reflects what the indicator is *about* (sanction, document authenticity, ...). A single indicator can carry multiple categories when its underlying [Finding](#/schemas/Finding) matches more than one category rule (e.g. a screening finding flagged as both RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION and RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA). - RISK_INDICATOR_PRESENTATION_CATEGORY_UNSPECIFIED: Default value. Not expected to appear in presentation_categories for well-formed indicators — absence of a category is represented by an empty list, not by emitting this value. - RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_COMPARISON: The indicator reflects a comparison between two pieces of identity data (e.g. extracted document data vs. provided personal details). - RISK_INDICATOR_PRESENTATION_CATEGORY_SANCTION: The indicator reflects a sanctions-list match. - RISK_INDICATOR_PRESENTATION_CATEGORY_DOCUMENT_AUTHENTICITY: The indicator reflects a document-authenticity concern (e.g. image integrity, visual authenticity, compromised document, chip cloning). - RISK_INDICATOR_PRESENTATION_CATEGORY_PEP: The indicator reflects a politically-exposed-person (PEP) match. - RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING: The indicator reflects a regulatory warning recorded against the subject. - RISK_INDICATOR_PRESENTATION_CATEGORY_FITNESS_AND_PROBITY: The indicator reflects a fitness-and-probity-list match. - RISK_INDICATOR_PRESENTATION_CATEGORY_ADVERSE_MEDIA: The indicator reflects adverse-media coverage of the subject. - RISK_INDICATOR_PRESENTATION_CATEGORY_DATA_VALIDATION: The indicator reflects a data-validation concern (e.g. address database match, document data validation, age validation). - RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD: The indicator reflects a police-record concern surfaced by an identity document provider. - RISK_INDICATOR_PRESENTATION_CATEGORY_LAW_ENFORCEMENT: The indicator reflects a law-enforcement action recorded against the subject by a screening provider. Distinct from RISK_INDICATOR_PRESENTATION_CATEGORY_REGULATORY_WARNING, which covers regulatory rather than law-enforcement bodies, and from RISK_INDICATOR_PRESENTATION_CATEGORY_POLICE_RECORD, which an identity document provider surfaces against a document. - `findingCount` integer: Total count of visible indicators carrying this category. - `highSeverityCount` integer: Count of indicators carrying this category whose [severity](#/schemas/RiskIndicatorSeverity) is RISK_INDICATOR_SEVERITY_CRITICAL or RISK_INDICATOR_SEVERITY_HIGH. - `peakSeverity` 'RISK_INDICATOR_SEVERITY_UNSPECIFIED' | 'RISK_INDICATOR_SEVERITY_CRITICAL' | 'RISK_INDICATOR_SEVERITY_HIGH' | 'RISK_INDICATOR_SEVERITY_MEDIUM' | 'RISK_INDICATOR_SEVERITY_LOW': The severity assigned to a [RiskIndicator](#/schemas/RiskIndicator) by the rule that produced it. Stored at full granularity in the data model even when the UI surfaces a narrower set of tiers, so the rendering can evolve without re-deriving stored values. Values are ordered such that lower numeric value indicates higher severity (CRITICAL = 1, LOW = 4); use the textual ordering CRITICAL > HIGH > MEDIUM > LOW when comparing rather than relying on numeric `<` / `>`. - RISK_INDICATOR_SEVERITY_UNSPECIFIED: Default value. Set on placeholder ("no-verdict") revisions or when the computed verdict has lapsed. - RISK_INDICATOR_SEVERITY_CRITICAL: The highest severity (e.g. active sanction match, active insolvency, document fraud). Emitted by V1 rules and surfaced as the check's peak severity; not yet wired to any automatic escalation. - RISK_INDICATOR_SEVERITY_HIGH: The indicator requires reviewer attention with priority over standard findings (e.g. senior PEP, regulatory warning, active CCJ). - RISK_INDICATOR_SEVERITY_MEDIUM: The indicator warrants review but at standard priority. - RISK_INDICATOR_SEVERITY_LOW: Informational; reviewer attention is optional. ## Other responses - `default`: An unexpected error response. --- [API](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview.md) - [All operations](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/llms.txt) - [OpenAPI document](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/revisions/3446b9aefa90?raw)