Risk Levels
riskLevel is the selected provider's discrete band mapped to the platform enum. It is not a cross-provider score and it does not describe workflow status.
The field is nullable. If the provider does not publish a band, the API omits it; the platform does not derive a missing band from the numeric score.
| API value | Level | Meaning |
|---|---|---|
RISK_LEVEL_CRITICAL | Critical | The provider's strongest mapped risk band. |
RISK_LEVEL_HIGH | High | A high mapped provider risk band. |
RISK_LEVEL_MEDIUM | Medium | A medium mapped provider risk band. |
RISK_LEVEL_LOW | Low | The provider's low mapped band; it is not proof that every optional intelligence field was supplied. |
Numeric scores stay provider-native
A score is separate from riskLevel. Read value together with scale, state, and polarity; never compare or rescale values across providers.
The scale and direction belong to the provider that answered, so read them from scale and polarity on the response rather than assuming a range: a higher value is safer under HIGHER_IS_SAFER and riskier under HIGHER_IS_RISKIER. NO_RULE_TRIGGERED and NOT_PROVIDED are not numeric zero.
UNKNOWN, omission, and UNSPECIFIED differ
Keep the discrete-band states separate:
RISK_LEVEL_UNKNOWNmeans the discrete band is unusable because it was unavailable or unrecognised. It must never be read as LOW, but it does not by itself mean that the whole screening failed; use the HTTP result and the other response fields.RISK_LEVEL_UNSPECIFIEDis the protobuf zero value reserved for an unset enum. Normal successful absence is an omitted or null riskLevel.
Branch on enum values and field presence, not display labels or score thresholds.