{"type":"api","title":"Get Risk Score for Domain","meta":{"id":"/apps/pubhub/media/legacy-umbrella-api/1f4bc296b06b13bab942ef791a49deeed880a9de/f963d12c-70c5-3340-bb7c-d5cff60c643a","info":{"title":"Investigate API","description":"Umbrella Investigate API","version":"1.1.4","contact":{"name":"Cloud Security Developer Community"}},"security":[{"bearerAuth":[]}],"tags":[{"name":"Domain Status and Categorization"},{"name":"Domain Volume"},{"name":"Co-occurrences for a Domain"},{"name":"Passive DNS"},{"name":"Tagging Timeline"},{"name":"Subdomains for a Domain"},{"name":"Related Domains for a Domain"},{"name":"Security Information for a Domain"},{"name":"AS Information for a Domain"},{"name":"WHOIS Information for a Domain"},{"name":"Umbrella Popularity List-Top Million Domains"},{"name":"Search Domain"},{"name":"Cisco Secure Malware Analytics Integration"}],"x-parser-conf":{"overview":{"markdownPath":"investigate/investigate-explorer-overview.md"}},"openapi":"3.0.0","servers":[{"url":"https://investigate.api.umbrella.com"}],"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}}},"spec":{"summary":"Get Risk Score for Domain","operationId":"getDomainsRiskScore","tags":["Security Information for a Domain"],"description":"The Umbrella Investigate Risk Score is based on an analysis of\nthe lexical characteristics of the domain name\nand patterns in queries and requests to the domain.\nThe risk score is scaled from 0 to 100, with 100 being the highest risk\nand 0 being no risk at all. Periodically Umbrella updates this score based\non additional inputs.\nA domain blocked by Umbrella receives a score of 100.","parameters":[{"name":"domain","in":"path","required":true,"description":"A domain name. For example, 'cisco.com'.","schema":{"type":"string"},"$$ref":"#/components/parameters/domainParam"}],"responses":{"200":{"description":"Everything worked as expected.","content":{"application/json":{"schema":{"type":"object","properties":{"indicators":{"type":"array","items":{"properties":{"indicator":{"type":"string"},"normalized_score":{"type":"integer"},"score":{"type":"number","format":"float"}},"description":"Array of [indicator, normalized_score, score] tuples. Each element is a behavioral\nor lexical feature that contributes to the calculation of the risk score.\nThe values of normalized_score range between 0 and 100,\nwhile score is the raw outcome from the statistical algorithms."}},"risk_score":{"type":"number","format":"float","description":"risk score"}},"$$ref":"#/components/schemas/RiskScore"},"example":{"indicators":[{"indicator":"Geo Popularity Score","normalized_score":2,"score":-3.610878169999999},{"indicator":"Keyword Score","normalized_score":3,"score":0.03586190445512534},{"indicator":"Lexical","normalized_score":52,"score":0.525},{"indicator":"Popularity 1 Day","normalized_score":100,"score":113.14},{"indicator":"Popularity 30 Day","normalized_score":100,"score":112.01},{"indicator":"Popularity 7 Day","normalized_score":100,"score":112.86},{"indicator":"Popularity 90 Day","normalized_score":100,"score":111.4},{"indicator":"TLD Rank Score","normalized_score":1,"score":0.010000315765229171},{"indicator":"Umbrella Block Status","normalized_score":0,"score":0}],"risk_score":4}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getDomainsRiskScore","security":[{"bearerAuth":[]}],"method":"get","path":"/domains/risk-score/{domain}"}}