> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk API

> Risk endpoints exposed by the Devotel CPaaS API

# Risk API

Risk endpoints exposed by the Devotel CPaaS API

**Base path:** `/api/v1/risk/score`

**Endpoint count:** 1

***

### Unified cross-channel Trust & Fraud risk score for a destination

<Note>
  `POST /api/v1/risk/score`
</Note>

Fuses the platform's existing anti-fraud detectors into one composite risk verdict a tenant can query BEFORE committing an SMS send or a call. The live SMS-pumping / artificial-traffic score and (when a message body is supplied) the outbound URL/link-reputation score are always computed; the caller's own Verify Fraud Guard and Voice Biometrics scores are folded in as optional pass-through inputs. Returns a 0-100 composite score (the worst present channel score), a band (low/elevated/high/critical), an advisory recommendation (allow/review/block), and a transparent per-channel breakdown so the composite is never a black box. Read-only and advisory: it sends nothing, routes nothing, and enforces nothing — the Devotel softswitch remains the sole outbound path. Rate-limited to 120 requests/minute per tenant.

<ParamField body="destination" type="string" required>
  Destination the score is requested for, in E.164 format (e.g. +14155552671).
</ParamField>

<ParamField body="channel" type="string (enum: sms|whatsapp|voice|verify)">
  Channel the score is being requested for — drives the SMS-pumping velocity aggregate.
</ParamField>

<ParamField body="message_body" type="string">
  Optional outbound message body. When supplied, every URL in it is reputation-scanned and folded into the composite.
</ParamField>

<ParamField body="verify_signal" type="object">
  Optional pass-through score from the caller's own Verify Fraud Guard evaluation for this recipient this session.
</ParamField>

<ParamField body="voice_biometrics_signal" type="object">
  Optional pass-through score from the caller's own Voice Biometrics challenge for this session.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/risk/score" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{
      "destination": "string"
    }'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel-orbit/node'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/risk/score', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
      "destination": "string"
    }),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/risk/score", headers=headers, json={
      "destination": "string"
    })
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/risk/score", bytes.NewBuffer([]byte(`{
      "destination": "string"
    }`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/risk/score')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {
      "destination": "string"
    }.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/risk/score');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {
      "destination": "string"
    }
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***