aria-partner-api

Threat score API

Kanary computes threat scores from a member profile’s enrolled PII, scan results, and site-level risk signals. Scores are normalized 0–10 (higher = greater risk). A composite profile_threat_score is also returned on member objects (Member summary); individual site rows expose site_threat_score (Site API).

The endpoints below return attack-vector threat scores for a single identity (member profile). Each score breaks down likelihood, potential damage from information currently available, damage by category, and platforms where the risk is most likely to materialize.

Resource	Path	Purpose
Doxxing threat score	`/api/v1/members/{member_id}/threat-scores/doxxing/`	Likelihood and impact of public PII aggregation / doxxing
Impersonation threat score	`/api/v1/members/{member_id}/threat-scores/impersonation/`	Likelihood and impact of identity impersonation
Account takeover threat score	`/api/v1/members/{member_id}/threat-scores/account-takeover/`	Likelihood and impact of personal account compromise

Score indexes

Every attack-vector response includes these top-level indexes:

Field	Type	Description
`threat_score`	number	Composite score for this attack vector (0–10)
`future_likelihood_index`	number	How likely this attack is to occur in the near term, given current exposures and profile signals (0–10)
`damage_potential_index`	number	How damaging an attack would be based on information currently available about this identity (0–10)
`damage_categories`	object	Per-category damage scores (0–10 each); see Damage categories
`likely_platforms`	array	Sites and platforms where this attack is most likely to occur; see Likely platforms
`computed_at`	string	When this score was last calculated (UTC, ISO 8601)

Damage categories

All three attack vectors use the same category model:

Category	Description
`financial`	Monetary loss, fraud, extortion, or theft enabled by the attack
`reputational`	Harm to personal or professional standing, harassment, or public embarrassment
`physical`	Risk of stalking, swatting, violence, or other physical harm
`productivity`	Time lost to recovery, account lockouts, legal response, or operational disruption

Likely platforms

Each entry in likely_platforms describes a site or platform contributing to the vector-specific risk:

Field	Type	Description
`site_id`	integer \| null	Kanary site catalog id when known (Site API); `null` for platforms not in the catalog
`domain`	string	Domain or platform identifier (e.g. `spokeo.com`, `x.com`)
`platform_type`	string	e.g. `data_broker`, `social`, `forum`, `email`, `financial`, `messaging`
`risk_contribution`	number	How much this platform contributes to the vector score (0–10)
`rationale`	string	Short explanation of why this platform is relevant

Doxxing threat score

GET /api/v1/members/{member_id}/threat-scores/doxxing/

Returns a doxxing threat assessment for the member. Doxxing risk reflects how easily an attacker could aggregate and publish the identity’s PII—home address, phone numbers, family members, employer, and similar data—across people-search sites, forums, paste bins, and social platforms.

Example

GET /api/v1/members/67890/threat-scores/doxxing/

Response (`200 OK`)

{
  "member_id": 67890,
  "attack_vector": "doxxing",
  "threat_score": 7.4,
  "future_likelihood_index": 6.8,
  "damage_potential_index": 8.1,
  "damage_categories": {
    "financial": 4.2,
    "reputational": 7.5,
    "physical": 8.9,
    "productivity": 5.0
  },
  "likely_platforms": [
    {
      "site_id": 42,
      "domain": "spokeo.com",
      "platform_type": "data_broker",
      "risk_contribution": 8.5,
      "rationale": "Full name, address, and relatives listed on multiple broker pages"
    },
    {
      "site_id": 118,
      "domain": "truepeoplesearch.com",
      "platform_type": "data_broker",
      "risk_contribution": 7.9,
      "rationale": "Current and prior addresses exposed with phone numbers"
    },
    {
      "site_id": null,
      "domain": "4chan.org",
      "platform_type": "forum",
      "risk_contribution": 5.2,
      "rationale": "Prior doxxing threads reference similar public records bundles"
    },
    {
      "site_id": 201,
      "domain": "x.com",
      "platform_type": "social",
      "risk_contribution": 4.8,
      "rationale": "Public posts link real name to employer and city"
    }
  ],
  "computed_at": "2026-06-10T14:22:00.123456+00:00"
}

Doxxing-specific signals

The doxxing score weighs:

Volume and sensitivity of exposed PII (addresses, phone, employer, family, photos)
Professional seniority and position (title, executive or public-facing roles increase targeting likelihood and downstream harm)
Industry (sector-specific risk—e.g. finance, healthcare, government, tech, and media often attract higher doxxing interest)
Broker and people-search listings that bundle records for one-click lookup
Cross-linkability of usernames, emails, and real names across sites
Historical harassment or doxxing patterns on platforms where the identity is active

Impersonation threat score

GET /api/v1/members/{member_id}/threat-scores/impersonation/

Returns an impersonation threat assessment for the member. Impersonation risk reflects how easily an attacker could pose as this identity—fake social profiles, fraudulent emails, synthetic IDs, or scam accounts targeting contacts.

Example

GET /api/v1/members/67890/threat-scores/impersonation/

Response (`200 OK`)

{
  "member_id": 67890,
  "attack_vector": "impersonation",
  "threat_score": 6.1,
  "future_likelihood_index": 5.7,
  "damage_potential_index": 6.9,
  "damage_categories": {
    "financial": 6.5,
    "reputational": 7.8,
    "physical": 2.1,
    "productivity": 4.4
  },
  "likely_platforms": [
    {
      "site_id": 201,
      "domain": "x.com",
      "platform_type": "social",
      "risk_contribution": 7.2,
      "rationale": "High public activity; profile photo and bio easily cloned"
    },
    {
      "site_id": 305,
      "domain": "linkedin.com",
      "platform_type": "social",
      "risk_contribution": 6.8,
      "rationale": "Professional headshot and employer details enable credible fake profiles"
    },
    {
      "site_id": null,
      "domain": "gmail.com",
      "platform_type": "email",
      "risk_contribution": 5.5,
      "rationale": "Display name and email pattern exposed; look-alike addresses feasible"
    },
    {
      "site_id": 410,
      "domain": "facebook.com",
      "platform_type": "social",
      "risk_contribution": 5.1,
      "rationale": "Public friends list and photos support social-engineering impersonation"
    }
  ],
  "computed_at": "2026-06-10T14:22:00.123456+00:00"
}

Impersonation-specific signals

The impersonation score weighs:

Public photos, bios, and professional details usable to clone a convincing profile
Username and email patterns that enable look-alike accounts
Social graph visibility (followers, colleagues, public connections)
Existing impersonation or scam reports tied to similar profile attributes

Account takeover threat score

GET /api/v1/members/{member_id}/threat-scores/account-takeover/

Returns a personal account takeover (ATO) threat assessment for the member. ATO risk reflects how easily an attacker could gain control of the identity’s personal accounts—email, social, financial, cloud storage, and messaging—through credential exposure, recovery-flow weaknesses, or SIM swap vectors.

Example

GET /api/v1/members/67890/threat-scores/account-takeover/

Response (`200 OK`)

{
  "member_id": 67890,
  "attack_vector": "account_takeover",
  "threat_score": 5.8,
  "future_likelihood_index": 5.2,
  "damage_potential_index": 7.0,
  "damage_categories": {
    "financial": 7.4,
    "reputational": 5.6,
    "physical": 3.0,
    "productivity": 6.8
  },
  "likely_platforms": [
    {
      "site_id": null,
      "domain": "gmail.com",
      "platform_type": "email",
      "risk_contribution": 8.0,
      "rationale": "Primary email exposed on breach lists; recovery phone partially public"
    },
    {
      "site_id": 201,
      "domain": "x.com",
      "platform_type": "social",
      "risk_contribution": 6.3,
      "rationale": "Linked email and phone in prior data exposures"
    },
    {
      "site_id": null,
      "domain": "chase.com",
      "platform_type": "financial",
      "risk_contribution": 5.9,
      "rationale": "Email and phone overlap with known breach credentials"
    },
    {
      "site_id": 305,
      "domain": "linkedin.com",
      "platform_type": "social",
      "risk_contribution": 4.7,
      "rationale": "OAuth login path; profile email matches exposed primary address"
    },
    {
      "site_id": null,
      "domain": "icloud.com",
      "platform_type": "cloud",
      "risk_contribution": 4.2,
      "rationale": "Phone number exposed on broker sites; SIM swap vector"
    }
  ],
  "computed_at": "2026-06-10T14:22:00.123456+00:00"
}

Account takeover-specific signals

The account takeover score weighs:

Credential and password exposure in breach data linked to enrolled emails and usernames
Recovery identifiers (phone numbers, backup emails, security questions) visible in public records
Password reuse patterns inferred from breach correlation across services
MFA and recovery weaknesses (e.g. SMS-only 2FA with exposed mobile numbers)
High-value account linkage (primary email as root of identity across financial and cloud services)

Errors

All three endpoints share the same error behavior:

Status	Condition
`401`	Missing or invalid bearer token
`403`	Partner inactive
`404`	Member not found or not accessible to your partner
`503`	Score not yet computed (profile recently created or scan in progress); retry after the next scan completes

When a score is not yet available, the response body includes a detail message and, when known, an estimated next_computed_at timestamp.

Availability

Attack-vector threat scores require an active enrolled profile with at least one completed scan. Scores refresh on Kanary’s scan cadence and when profile PII or exposures change materially.

The composite profile_threat_score on member list and detail responses is a rollup across attack vectors and site risk. For dashboards and automated workflows, prefer the vector-specific endpoints above when you need actionable breakdowns.

Contact hello@kanary.com to enable attack-vector threat scores for your partner integration. Score-only API access is also available upon request. Accounts on a subscription are scored after a scan queued via POST /api/v1/scan/ completes.

aria-partner-api

Threat score API

Score indexes

Damage categories

Likely platforms

Doxxing threat score

Example

Response (200 OK)

Doxxing-specific signals

Impersonation threat score

Example

Response (200 OK)

Impersonation-specific signals

Account takeover threat score

Example

Response (200 OK)

Account takeover-specific signals

Errors

Availability

Response (`200 OK`)

Response (`200 OK`)

Response (`200 OK`)