> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Unified cross-channel Trust & Fraud risk score for a destination > Fuses the platform's existing anti-fraud detectors into one composite risk verdict a tenant can query BEFORE committing an SMS send or a call. The live SMS-pumping / artificial-traffic score and (when a message body is supplied) the outbound URL/link-reputation score are always computed; the caller's own Verify Fraud Guard and Voice Biometrics scores are folded in as optional pass-through inputs. Returns a 0-100 composite score (the worst present channel score), a band (low/elevated/high/critical), an advisory recommendation (allow/review/block), and a transparent per-channel breakdown so the composite is never a black box. Read-only and advisory: it sends nothing, routes nothing, and enforces nothing — the Devotel softswitch remains the sole outbound path. Rate-limited to 120 requests/minute per tenant. ## OpenAPI ````yaml /openapi.yaml post /api/v1/risk/score openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway - name: Risk description: >- Unified cross-channel Trust & Fraud risk scoring — fuses SMS-pumping, URL-reputation, Verify Fraud Guard, and Voice Biometrics signals into one composite verdict queryable before a send or a call. - name: Orby description: >- In-dashboard Orby operator assistant: streamed assistant turns, conversation threads, product knowledge-base search, and the tool-action approval gate. Available to signed-in operators only (dashboard session auth — API-key requests are rejected). paths: /api/v1/risk/score: post: tags: - Risk summary: Unified cross-channel Trust & Fraud risk score for a destination description: >- Fuses the platform's existing anti-fraud detectors into one composite risk verdict a tenant can query BEFORE committing an SMS send or a call. The live SMS-pumping / artificial-traffic score and (when a message body is supplied) the outbound URL/link-reputation score are always computed; the caller's own Verify Fraud Guard and Voice Biometrics scores are folded in as optional pass-through inputs. Returns a 0-100 composite score (the worst present channel score), a band (low/elevated/high/critical), an advisory recommendation (allow/review/block), and a transparent per-channel breakdown so the composite is never a black box. Read-only and advisory: it sends nothing, routes nothing, and enforces nothing — the Devotel softswitch remains the sole outbound path. Rate-limited to 120 requests/minute per tenant. requestBody: required: true content: application/json: schema: type: object required: - destination properties: destination: type: string description: >- Destination the score is requested for, in E.164 format (e.g. +14155552671). channel: type: string enum: - sms - whatsapp - voice - verify default: sms description: >- Channel the score is being requested for — drives the SMS-pumping velocity aggregate. message_body: type: string maxLength: 5000 description: >- Optional outbound message body. When supplied, every URL in it is reputation-scanned and folded into the composite. verify_signal: type: object description: >- Optional pass-through score from the caller's own Verify Fraud Guard evaluation for this recipient this session. required: - score properties: score: type: integer minimum: 0 maximum: 100 description: Transparent 0-100 risk score from the source detector. reasons: type: array default: [] description: >- Machine-readable reason codes echoed from the source detector. items: type: string maxLength: 200 voice_biometrics_signal: type: object description: >- Optional pass-through score from the caller's own Voice Biometrics challenge for this session. required: - score properties: score: type: integer minimum: 0 maximum: 100 description: Transparent 0-100 risk score from the source detector. reasons: type: array default: [] description: >- Machine-readable reason codes echoed from the source detector. items: type: string maxLength: 200 responses: '200': description: Composite cross-channel risk verdict for the destination content: application/json: schema: type: object properties: data: type: object description: >- The composite verdict plus a per-channel transparency breakdown. properties: destination: type: string description: The destination that was scored, in E.164 format. channel: type: string enum: - sms - whatsapp - voice - verify description: The channel the score was requested for. score: type: integer minimum: 0 maximum: 100 description: >- Composite risk score — the worst present channel score (0 clean → 100 block). band: type: string enum: - low - elevated - high - critical description: Coarse band derived from the composite score. recommendation: type: string enum: - allow - review - block description: >- Advisory action suggested by the verdict — the endpoint enforces nothing. channels: type: array description: >- Per-channel breakdown showing every signal that was and wasn't available for the request. items: type: object properties: channel: type: string enum: - sms_pumping - url_reputation - verify_fraud - voice_biometrics description: The source detector this row reports on. present: type: boolean description: >- Whether this channel's signal was supplied/computed for this request. score: type: integer minimum: 0 maximum: 100 description: >- This channel's score, or 0 when absent — an absent channel never invents risk. reasons: type: array description: >- Machine-readable reason codes that drove this channel's score. items: type: string meta: type: object properties: request_id: type: string description: >- Unique request identifier (also returned in X-Request-Id header) timestamp: type: string format: date-time description: ISO 8601 UTC timestamp of the response components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````