Risk Score API — Changelog

This page lists API changes by version. Breaking changes are only introduced with a major version bump.

v2.1 — 2026-01-03

Non-breaking improvements: new DNS signals, tracing, consistency, and clearer outputs (no change to endpoint).

Added meta block to all success responses: cached, processingMs, requestId, cacheHours, scoringPolicy.
Added optional explanations via ?explain=1 with explanations[] (signal, category, severity, note).
Unified error responses: { error, requestId } for 400/401/429.
Locked risk level thresholds in code (low 0–24, medium 25–49, high 50–100).
Introduced signal categories (risk vs informational): only risk signals affect the score.
Added health informational signals when a subsystem is unavailable: dns_lookup_failed, rdap_unavailable, drop_list_unavailable.
Added per-domain in-flight gating to prevent stampede on cold cache.
Added DNS-only signals to support all TLDs (including .io, .us, .eu).
Added signals: dns_no_mx_records, dns_spf_missing, dns_spf_allows_all, dns_dmarc_missing, dns_dmarc_policy_none, dns_caa_missing, dns_ns_count_high, dns_null_a_record.
Scoring tuned for low-support operation: some signals are informational (weight 0).

Versioning rule: if weights/thresholds change → bump minor. If signals are renamed/removed → bump major.

Breaking change: signal names updated for accuracy.

Renamed signals to match what is actually measured (truth-in-label).
nameserver_volatility → recent_nameserver_or_delegation_change (window: 30 days, RDAP best-effort).
whois_anonymous → whois_redacted_or_privacy.
incomplete_whois_fields → registrar_missing_in_rdap.
high_risk_registrar → registrar_high_risk_listed.
registrant_country_mismatch_tld → cctld_registrant_country_mismatch.
shared_hosting_high_density → shared_hosting_asn_listed.
blacklist_proximity → spamhaus_drop_listed_ip.
domain_pattern_similarity → suspicious_keywords_in_domain.
disposable_domain_traits → long_or_hyphenated_domain.
Adjusted risk level thresholds: low 0–24, medium 25–49, high 50–100.