# List features URL: https://docs.hanzo.ai/docs/openapi/risk/riskfeatures > The feature catalogue in its two honest lenses. `GET /v1/risk/features` > [Risk →](https://docs.hanzo.ai/docs/openapi/risk) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | --------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/risk/features` | | **Method** | `GET` | | **Operation** | `riskFeatures` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | The feature catalogue in its two honest lenses. The MODEL lens is the governed inventory: one entry per dimension of the model space, each carrying the typology it serves, the supervisor's own words for the indicator, and the published standard those words come from — so a coverage claim is checkable rather than asserted. It is the same for every organisation. The SURFACE lens is what THIS organisation's own event surface actually carries, measured over the window: how many of its buckets carry each dimension at all, and what the dimension reads where it is present. A dimension present in no bucket is BLIND, and saying so is the difference between no risk and no data. ## Request 1 field. | Field | In | Type | Required | Description | | ------ | ----- | ------- | -------- | -------------------------------------------------------------------------- | | `days` | query | integer | — | Days is how far back to measure the organisation's own coverage, 1 to 400. | ## Response | Status | Body | Meaning | | --------- | ---------------- | ------- | | `200` | risk.riskCatalog | ok | | `default` | problem-details | refused | `200` body — 30 fields. | Field | In | Type | Always | Description | | ------------------- | ---- | ------------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `gap` | body | string | — | Gap says why a lens could not be measured, when that is the case. | | `model` | body | risk.riskModelFeature\[] | — | Model is the governed inventory: one entry per dimension of the model space, each carrying the typology it serves and the published standard that asks for it. | | `model[].blind` | body | integer (int64) | — | Blind is how often this dimension took that neutral value for THIS organisation. | | `model[].citation` | body | string | — | Citation is where those words come from, so the claim is checkable rather than asserted. | | `model[].indicator` | body | string | — | Indicator is the supervisor's own words for the thing being looked for. | | `model[].name` | body | string | — | Name is the dimension. | | `model[].neutral` | body | number (double) | — | Neutral is the value the coordinate takes when the data cannot support it. | | `model[].severity` | body | string | — | Severity is how much weight an alert on it carries. | | `model[].typology` | body | string | — | Typology is the pattern this dimension detects. | | `model[].unit` | body | string | — | Unit is how to read the raw number, which is what turns a coordinate into a sentence an investigator can put in a file. | | `model[].window` | body | string | — | Window is the sliding aggregate it reads. | | `network` | body | risk.riskBand\[] | — | Network is the published cross-organisation baseline over the same window, so the surface above has something to be read AGAINST. | | `network[].day` | body | string (date-time) | — | Day is the day the band covers. | | `network[].dim` | body | string | — | Dim is the dimension, named as this API publishes it. | | `network[].kind` | body | string | — | Kind is the subject kind it was computed over. | | `network[].n` | body | integer (uint64) | — | N is how many subject-days went into it. | | `network[].orgs` | body | integer (uint32) | — | Orgs is how many organisations contributed, each weighted exactly one vote whatever its size. | | `network[].q10` | body | number (double) | — | Q10 is the quiet end of the network's day: a tenth of contributing organisations sit at or below it. | | `network[].q50` | body | number (double) | — | Q50 is the network's median day. | | `network[].q90` | body | number (double) | — | Q90 is the busy end: a tenth of contributing organisations sit at or above it. | | `surface` | body | risk.riskOrgFeature\[] | — | Surface is what this organisation's own event surface carries, per dimension, measured over the window. | | `surface[].blind` | body | boolean | — | Blind is true when the dimension is present in no bucket at all: this organisation's surface does not carry it, and saying so is the difference between no risk and no data. | | `surface[].buckets` | body | integer (int64) | — | Buckets is how many five-minute buckets of this organisation's surface were measured. | | `surface[].max` | body | number (double) | — | Max is the largest value it reached in the window. | | `surface[].mean` | body | number (double) | — | Mean is the dimension's average where it was present. | | `surface[].name` | body | string | — | Name is the dimension as this API publishes it. | | `surface[].present` | body | integer (int64) | — | Present is in how many of them the dimension carried a value at all. | | `surface[].source` | body | string | — | Source names the plane it is rolled up from, so a dimension that reads zero everywhere traces to a plane the organisation does not use rather than to a defect. | | `surface[].unit` | body | string | — | Unit is how to read the numbers below. | | `tenant` | body | string | — | Tenant is whose surface was measured. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo risk features ``` **SDK** **.ts** ```ts import { Configuration, RiskApi } from 'hanzoai'; const api = new RiskApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.riskFeatures(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import RiskApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = RiskApi(client).risk_features() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.RiskAPI.RiskFeatures(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, risk_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = risk_api::risk_features(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.RiskApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new RiskApi(client).riskFeatures(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/risk/features \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** Tool `risk`, op `riskFeatures` — POST the JSON-RPC envelope to `https://api.hanzo.ai/v1/mcp`. ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Authorization: Bearer $HANZO_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "risk", "arguments": { "op": "riskFeatures", "input": {} } } }' ``` --- [Risk API](https://docs.hanzo.ai/docs/openapi/risk) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)