The feature catalogue: what the model reads, and what your surface carries

GET /v1/risk/features

Risk → · All API references → · Six flows, four surfaces →


Address	`https://api.hanzo.ai/v1/risk/features`
Method	`GET`
Operation	`riskFeatures`
Auth	`Authorization: Bearer $HANZO_API_KEY`

Features is the feature catalogue in its two honest lenses.

The MODEL lens is the governed inventory: one entry per dimension of the model space, each carrying the typology it serves, the supervisor's own words for the indicator, and the published standard those words come from — so a coverage claim is checkable rather than asserted. It is the same for every organisation.

The SURFACE lens is what THIS organisation's own event surface actually carries, measured over the window: how many of its buckets carry each dimension at all, and what the dimension reads where it is present. A dimension present in no bucket is BLIND, and saying so is the difference between no risk and no data.

Request

1 field.

Field	In	Type	Required	Description
`days`	query	integer	—	Days is how far back to measure the organisation's own coverage, 1 to 400.

Response

Status	Body	Meaning
`200`	riskCatalog	ok

200 body — 30 fields.

Field	In	Type	Always	Description
`gap`	body	string	—	Gap says why a lens could not be measured, when that is the case.
`model`	body	riskModelFeature[]	—	Model is the governed inventory: one entry per dimension of the model space, each carrying the typology it serves and the published standard that asks for it.
`model[].blind`	body	integer	—	Blind is how often this dimension took that neutral value for THIS organisation.
`model[].citation`	body	string	—	Citation is where those words come from, so the claim is checkable rather than asserted.
`model[].indicator`	body	string	—	Indicator is the supervisor's own words for the thing being looked for.
`model[].name`	body	string	—	Name is the dimension.
`model[].neutral`	body	number	—	Neutral is the value the coordinate takes when the data cannot support it.
`model[].severity`	body	string	—	Severity is how much weight an alert on it carries.
`model[].typology`	body	string	—	Typology is the pattern this dimension detects.
`model[].unit`	body	string	—	Unit is how to read the raw number, which is what turns a coordinate into a sentence an investigator can put in a file.
`model[].window`	body	string	—	Window is the sliding aggregate it reads.
`network`	body	riskBand[]	—	Network is the published cross-organisation baseline over the same window, so the surface above has something to be read AGAINST.
`network[].day`	body	string (date-time)	—	Day is the day the band covers.
`network[].dim`	body	string	—	Dim is the dimension, named as this API publishes it.
`network[].kind`	body	string	—	Kind is the subject kind it was computed over.
`network[].n`	body	integer	—	N is how many subject-days went into it.
`network[].orgs`	body	integer	—	Orgs is how many organisations contributed, each weighted exactly one vote whatever its size.
`network[].q10`	body	number	—	Q10 is the quiet end of the network's day: a tenth of contributing organisations sit at or below it.
`network[].q50`	body	number	—	Q50 is the network's median day.
`network[].q90`	body	number	—	Q90 is the busy end: a tenth of contributing organisations sit at or above it.
`surface`	body	riskOrgFeature[]	—	Surface is what this organisation's own event surface carries, per dimension, measured over the window.
`surface[].blind`	body	boolean	—	Blind is true when the dimension is present in no bucket at all: this organisation's surface does not carry it, and saying so is the difference between no risk…
`surface[].buckets`	body	integer	—	Buckets is how many five-minute buckets of this organisation's surface were measured.
`surface[].max`	body	number	—	Max is the largest value it reached in the window.
`surface[].mean`	body	number	—	Mean is the dimension's average where it was present.
`surface[].name`	body	string	—	Name is the dimension as this API publishes it.
`surface[].present`	body	integer	—	Present is in how many of them the dimension carried a value at all.
`surface[].source`	body	string	—	Source names the plane it is rolled up from, so a dimension that reads zero everywhere traces to a plane the organisation does not use rather than to a defect.
`surface[].unit`	body	string	—	Unit is how to read the numbers below.
`tenant`	body	string	—	Tenant is whose surface was measured.

Failure carries the platform error shape — see Errors.

Examples

hanzo risk features

import { Configuration, RiskApi } from 'hanzoai';

const api = new RiskApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.riskFeatures();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import RiskApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = RiskApi(client).risk_features()

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.RiskAPI.RiskFeatures(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, risk_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = risk_api::risk_features(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.RiskApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new RiskApi(client).riskFeatures();

curl https://api.hanzo.ai/v1/risk/features \
  -H "Authorization: Bearer $HANZO_API_KEY"

Tool risk, op riskFeatures — POST the JSON-RPC envelope to https://api.hanzo.ai/v1/mcp.

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "risk",
         "arguments": {
           "op": "riskFeatures",
           "input": {}
         }
       }
     }'

Risk API · All Hanzo APIs · Interactive reference

The feature catalogue: what the model reads, and what your surface carries

Request

Response

Examples

On this page