Get User Risk Score - White Circle

GET

api

radar

risk

cURL

curl --request GET \
  --url https://eu.whitecircle.com/api/radar/risk \
  --header 'Authorization: Bearer <token>' \
  --header 'whitecircle-version: <whitecircle-version>'

import requests

url = "https://eu.whitecircle.com/api/radar/risk"

headers = {
    "whitecircle-version": "<whitecircle-version>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    'whitecircle-version': '<whitecircle-version>',
    Authorization: 'Bearer <token>'
  }
};

fetch('https://eu.whitecircle.com/api/radar/risk', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://eu.whitecircle.com/api/radar/risk",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "whitecircle-version: <whitecircle-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://eu.whitecircle.com/api/radar/risk"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("whitecircle-version", "<whitecircle-version>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://eu.whitecircle.com/api/radar/risk")
  .header("whitecircle-version", "<whitecircle-version>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://eu.whitecircle.com/api/radar/risk")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["whitecircle-version"] = '<whitecircle-version>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "risk_level": "normal"
}

Use this endpoint to retrieve a user’s risk level using either email or id.

How it works

White Circle can assess a user’s Risk Score by correlating their recent sessions with policy violations. To enable this:

Send a Check Session request and include the user’s identifier in metadata.user (either id or email).
The Radar service aggregates the user’s recent history and determines whether their behavior indicates elevated risk.
Query GET /api/radar/risk with the same id or email to fetch the current Risk Score.

Risk scoring is based on recent violations linked to the same user identifier. If we detect serious or repeated violations in the recent window, we return an elevated risk score.

Adding user identity to Check Session

Include metadata.user.id or metadata.user.email in your Check Session payload. This lets Radar associate policy outcomes with a specific user over time.

{
  "messages": [
    { "role": "user", "content": "Hello, can you check this for policy issues?" }
  ],
  "metadata": {
    "user": {
      "id": "user-123",
      "email": "user@example.com",
      "ip": "224.16.0.23",
      "mac_address": "00:11:22:33:44:55",
      "name": "John Doe"
    }
  }
}

At least one identifier is required: include metadata.user.id or metadata.user.email. For best results, include both.

Provide richer context in metadata.user (for example, IP, email, or name) to improve correlation and the fidelity of the resulting risk analysis.

Fetching the Risk Score

Use this endpoint to retrieve the current risk level for a user:

GET /api/radar/risk?email=user@example.com
GET /api/radar/risk?id=user-123

If recent violations exist for the user, Radar returns an elevated risk level; otherwise, it returns a normal risk level.

Authorizations

Authorization

string

header

required

API Key required. Format: Bearer wc-your-api-key

Headers

whitecircle-version

string

required

API Version

Query Parameters

string | null

User email address (provide either email or id, not both)

string | null

External user ID (provide either email or id, not both)

Response

Success

risk_level

enum<string>

required

Available options:

normal,

elevated,

severe

⌘I

cURL

curl --request GET \
  --url https://eu.whitecircle.com/api/radar/risk \
  --header 'Authorization: Bearer <token>' \
  --header 'whitecircle-version: <whitecircle-version>'

import requests

url = "https://eu.whitecircle.com/api/radar/risk"

headers = {
    "whitecircle-version": "<whitecircle-version>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    'whitecircle-version': '<whitecircle-version>',
    Authorization: 'Bearer <token>'
  }
};

fetch('https://eu.whitecircle.com/api/radar/risk', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://eu.whitecircle.com/api/radar/risk",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "whitecircle-version: <whitecircle-version>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://eu.whitecircle.com/api/radar/risk"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("whitecircle-version", "<whitecircle-version>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://eu.whitecircle.com/api/radar/risk")
  .header("whitecircle-version", "<whitecircle-version>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://eu.whitecircle.com/api/radar/risk")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["whitecircle-version"] = '<whitecircle-version>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "risk_level": "normal"
}

​How it works

​Adding user identity to Check Session

​Fetching the Risk Score

Authorizations

Headers

Query Parameters

Response

How it works

Adding user identity to Check Session

Fetching the Risk Score