<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# API Reference — Performing Identity Risk Scoring

## Identity Risk Scoring APIs

### Microsoft Entra ID — Risk APIs

| Endpoint | Description |
|---|---|
| `GET /identityProtection/riskyUsers` | Users with risk scores |
| `GET /identityProtection/riskyUsers/{id}/history` | Risk history |
| `GET /identityProtection/riskDetections` | Risk detection events |
| `POST /identityProtection/riskyUsers/confirmCompromised` | Confirm risk |

### Risk Score Calculation

| Component | Weight | Data Source |
|---|---|---|
| Behavioral | 30% | UEBA, auth logs |
| Credential | 25% | HIBP, IdP signals |
| Privilege | 25% | Directory roles, Graph API |
| Threat Intel | 20% | TI feeds, IP reputation |

### Agent Script

```bash
# Calculate risk score
node agent.js score --user-id user@example.com --detailed

# Get risk factors
node agent.js factors --user-id user@example.com

# Update risk model
node agent.js update-model --config risk_model_v2.json
```
