Get Risk Score

curl --request GET \
  --url https://api.humanos.tech/intelligence/risk

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.humanos.tech/intelligence/risk",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.humanos.tech/intelligence/risk"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.humanos.tech/intelligence/risk")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "report": {
    "did": "did:web:humanos.tech:agent:2f8b6c41-9d37-4e5a-8b02-6c1d9e7a4f35",
    "computedAt": "2026-09-09T11:30:00.000Z",
    "basis": "chain",
    "window": {
      "from": "2026-08-10T11:30:00.000Z",
      "to": "2026-09-09T11:30:00.000Z",
      "days": 30
    },
    "score": 31,
    "trust": 0.625,
    "components": {
      "identity": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "compliance": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "exposure": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "anomaly": {
        "value": 1,
        "state": "cold"
      }
    },
    "posture": {
      "rung": "pop/custodial",
      "bootstrapAnchor": "manual",
      "affiliated": true,
      "keyAgeDays": 2,
      "activeMandates": 7,
      "unboundedAuthorizations": 2,
      "verifications": 17,
      "approvals": 10,
      "denies": 7,
      "denyRatio": 0.412,
      "distinctFailedRules": [
        "review_required"
      ],
      "unreportedOutcomes": 5,
      "stepUps": {
        "approved": 4,
        "declined": 0,
        "expired": 2
      },
      "proofFailures": 0,
      "postRevocationAttempts": 0
    },
    "remediations": [
      {
        "summary": "Put an expiry and a use cap on 2 open-ended authorization(s) — the largest line in the score",
        "evidence": [
          "urn:via:credential:550e8400-e29b-41d4-a716-446655440000"
        ]
      }
    ]
  },
  "computedAt": "2026-09-09T11:30:00.000Z",
  "trigger": "VERIFICATION_DENIED",
  "previousScore": 28,
  "live": {
    "score": 50,
    "anomaly": 1.6,
    "state": "live",
    "at": "2026-09-09T03:12:00.000Z"
  }
}

{
  "statusCode": 400,
  "message": "did must be a string",
  "error": "Bad Request"
}

{
  "statusCode": 404,
  "message": "sharing_not_enabled: the organization does not share with you",
  "error": "Not Found"
}

Intelligence

Get Risk Score

Score one agent from its signed event chain: identity strength, compliance behaviour and exposure, combined as exposure × (1 − trust), 0..100, with the factors that made each component.
A derived judgement over the chain — never an input to any verification. Anyone holding the chain recomputes the same number.
Use your own organization DID in orgDid to score your agents (evidence URNs included). Use a partner organization’s DID to score theirs; this requires an active sharing grant, and the evidence URNs are withheld.
The posture block is the read-out of the facts before any weighting; remediations say what would lower the score and point at the evidence.

GET

intelligence

risk

Get Risk Score

curl --request GET \
  --url https://api.humanos.tech/intelligence/risk

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.humanos.tech/intelligence/risk",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.humanos.tech/intelligence/risk"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.humanos.tech/intelligence/risk")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "report": {
    "did": "did:web:humanos.tech:agent:2f8b6c41-9d37-4e5a-8b02-6c1d9e7a4f35",
    "computedAt": "2026-09-09T11:30:00.000Z",
    "basis": "chain",
    "window": {
      "from": "2026-08-10T11:30:00.000Z",
      "to": "2026-09-09T11:30:00.000Z",
      "days": 30
    },
    "score": 31,
    "trust": 0.625,
    "components": {
      "identity": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "compliance": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "exposure": {
        "value": 0.65,
        "factors": [
          {
            "name": "unreported_outcomes",
            "delta": -0.15,
            "note": "5 of 10 approvals have no ACTION_COMPLETED / FAILED after them",
            "evidence": [
              "urn:via:event:550e8400-e29b-41d4-a716-446655440000"
            ]
          }
        ]
      },
      "anomaly": {
        "value": 1,
        "state": "cold"
      }
    },
    "posture": {
      "rung": "pop/custodial",
      "bootstrapAnchor": "manual",
      "affiliated": true,
      "keyAgeDays": 2,
      "activeMandates": 7,
      "unboundedAuthorizations": 2,
      "verifications": 17,
      "approvals": 10,
      "denies": 7,
      "denyRatio": 0.412,
      "distinctFailedRules": [
        "review_required"
      ],
      "unreportedOutcomes": 5,
      "stepUps": {
        "approved": 4,
        "declined": 0,
        "expired": 2
      },
      "proofFailures": 0,
      "postRevocationAttempts": 0
    },
    "remediations": [
      {
        "summary": "Put an expiry and a use cap on 2 open-ended authorization(s) — the largest line in the score",
        "evidence": [
          "urn:via:credential:550e8400-e29b-41d4-a716-446655440000"
        ]
      }
    ]
  },
  "computedAt": "2026-09-09T11:30:00.000Z",
  "trigger": "VERIFICATION_DENIED",
  "previousScore": 28,
  "live": {
    "score": 50,
    "anomaly": 1.6,
    "state": "live",
    "at": "2026-09-09T03:12:00.000Z"
  }
}

{
  "statusCode": 400,
  "message": "did must be a string",
  "error": "Bad Request"
}

{
  "statusCode": 404,
  "message": "sharing_not_enabled: the organization does not share with you",
  "error": "Not Found"
}

Headers

API-Version

string

Pin request, response, and webhook shapes to a specific dated API version (YYYY-MM-DD). Omit to use the version pinned to your API key (set when the key is created; new keys default to the latest version). New integrations should target the latest version.

Pattern: ^\d{4}-\d{2}-\d{2}$

Example:

"2026-10-16"

Query Parameters

orgDid

string

required

DID of the organization whose data is consulted. Your own organization DID needs no grant; any other requires an active sharing grant from that organization to yours.

Example:

"did:web:org-a.example"

did

string

required

DID of the agent to score.

Example:

"did:web:humanos.tech:agent:RRJyvYvj0T-ZRBU-"

days

string

Behaviour window in days, ending now. Default 30, at most 366.

Example:

30

Response

Returns the stored risk score: the report, when it was computed and why, and the live variant when the inline loop has seen a call.

report

object

required

The risk report.

Show child attributes

computedAt

string

required

When the stored score was last recomputed from the chain.

Example:

"2026-09-09T11:30:00.000Z"

trigger

string

required

What caused the recompute: a chain event type, read, or manual.

Example:

"VERIFICATION_DENIED"

previousScore

number | null

required

The score before this recompute; null on the first.

Example:

28

live

object

Absent until the inline loop has seen a call.

Show child attributes

Requests

Credentials

Actions

Agents

Actors

User

DID

Approval

Intelligence

Webhooks

Get Risk Score

Headers

Query Parameters

Response