Users

Bulk Update Risk Scores

Sets identity risk scores for many users at once, matching them to existing users by email. Use this to push scores from an external identity risk provider on a schedule instead of issuing one update per user.

Scores are on a 0-100 scale where a higher number means a riskier user. Providers that use a different scale must convert before calling: for example CrowdStrike Falcon Identity Protection reports 0-1, so multiply its riskScore by 100.

Emails that match no user are counted in skipped rather than failing the request, so a provider export can be pushed wholesale without first reconciling it against the org's user list. Scores an admin set by hand are also skipped unless overwrite_manual is true.

Scores can be pushed at any time, but they only take effect — shown in the dashboard, used by guard filters, and enforced by the blocking policy — once the User Risk Score beta feature is enabled.

post/api/users/risk-scores

Request

  • Base URL: https://app.withwillow.ai
  • URL: https://app.withwillow.ai/api/users/risk-scores
  • Auth: HTTP bearer

Request body

sourcestring

Label recorded on every updated user, identifying the system that supplied the scores. Defaults to api. The value manual is reserved for dashboard edits and is rejected.

overwrite_manualboolean

Whether to replace scores an admin set by hand in the dashboard. Defaults to false so a scheduled push cannot undo a deliberate override.

Example request

{
  "source": "crowdstrike",
  "scores": [
    {
      "email": "john.doe@example.com",
      "risk_score": 72
    }
  ]
}

Response

Scores applied

Example response

{
  "data": {
    "updated": 128,
    "skipped": 4
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.