Assess identifier risk
A risk assessment scores more than the business as a whole. Identifier assessments score the individual identifiers on a business, including email addresses, phone numbers, and the website URL, so you can see which specific contact point carries the risk. Each scored identifier produces one entry in the identifier_assessments[] array on the risk assessment.
Identifier assessments complement risk dimensions. A dimension scores the business through one analytical lens, while an identifier assessment attaches a score and supporting facts to a single identifier Middesk evaluated.
Identifier assessment types
The object field on each entry identifies what kind of identifier the entry scores. There are three values:
| Value | Scores | Draws on |
|---|---|---|
email_risk | An email address on the business | Validity, disposable address detection, and deliverability signals |
phone_risk | A phone number on the business | Validity, line activity, risky-behavior flags, recent abuse, prepaid detection, breach exposure, and spam reports |
url_risk | The business’s website URL | Suspicion flags, phishing and malware detection, domain parking, and domain trust ratings |
The identifier assessment object
Every entry in identifier_assessments[] has the same shape regardless of type.
| Field | Type | Description |
|---|---|---|
object | string | The assessment type. One of email_risk, phone_risk, or url_risk. |
id | string | A stable identifier for the assessment entry, prefixed with idr_. |
resource | object | A pointer to the business sub-resource the assessment scored. |
resource.type | string | The type of sub-resource, such as email_address. |
resource.id | string | The ID of the sub-resource on the business. Use this ID to join the assessment back to the business. |
resource.value | string | The natural value of the resource, such as the email address itself, included for convenience. |
score | number | A risk score from 0 to 1. Higher scores indicate higher risk. |
attributes | object[] | The measured facts that back the score. |
attributes[].name | string | The attribute name, such as email_is_disposable or phone_is_prepaid. |
attributes[].type | string | The type of value. One of boolean, string, or number. |
attributes[].value | boolean, string, or number | The measured value. |
The attribute list varies by assessment type and by run. Middesk emits only measured facts: an attribute that was not measured on a run is omitted rather than reported with a default value.
Attributes by assessment type
The following tables list every attribute each assessment type can carry.
Email attributes
| Attribute | Type | Description |
|---|---|---|
email_is_valid | boolean | Whether the email address is valid. An invalid address signals risk. |
email_is_disposable | boolean | Whether the email is a disposable address. |
email_deliverability_low | boolean | Whether the email’s deliverability is low. |
Phone attributes
| Attribute | Type | Description |
|---|---|---|
phone_is_valid | boolean | Whether the phone number is valid. An invalid number signals risk. |
phone_is_active | boolean | Whether the phone line is active and reachable. An inactive line signals risk. |
phone_is_risky | boolean | Whether the phone shows risky characteristics, such as fraud, scams, robocalls, or fake accounts. |
phone_has_recent_abuse | boolean | Whether the phone has verified abuse activity within the past few days. |
phone_is_prepaid | boolean | Whether the phone is a prepaid number. |
phone_is_leaked | boolean | Whether the phone was recently exposed in a data breach. |
phone_is_spammer | boolean | Whether the phone was recently reported for spam or harassing calls or texts. |
URL attributes
| Attribute | Type | Description |
|---|---|---|
url_is_suspicious | boolean | Whether the URL is possibly malicious or used for abuse. |
url_has_phishing | boolean | Whether the URL is tied to phishing behavior. |
url_has_malware | boolean | Whether the URL is tied to malware or viruses. |
url_domain_parked | boolean | Whether the domain is parked with a for-sale notice. |
url_domain_trust_malicious | boolean | Whether the domain’s reputation is rated malicious. |
url_domain_trust_suspicious | boolean | Whether the domain’s reputation is rated suspicious. |
url_domain_trust_unrated | boolean | Whether the domain has no reputation rating. |
Mapping assessments back to the business
The resource object is the pointer from an assessment back to the business. resource.id is the ID of the sub-resource on the business: an email_risk entry points at an entry in the business’s email_addresses[] array, and a phone_risk entry points at an entry in phone_numbers[].
For example, this assessment scores an email address on the business:
On the business, the entry in email_addresses[] whose id matches resource.id is the scored address. Its sources[] array shows where the address came from. Here the profile source shows Middesk found the address on the business’s Yelp page, and submitted: false shows the applicant did not provide it.
Assessments are immutable, but the business is not. Later orders can refresh sub-resources, so the live business may no longer match what an assessment referenced. When investigating an assessment, always fetch the business as of the assessment’s order with GET /businesses/{id}?order_id={order_id}, or follow the assessment’s business_snapshot_url. See Get a risk assessment for snapshot semantics.
For url_risk, the resource points at the assessed website. The assessed URL in resource.value is authoritative for what Middesk scored. Don’t assume it equals the website submitted on the business: the assessed URL can differ, for example after redirect resolution or when Middesk discovers a website where none was submitted.
Absence is not a clean signal
Resources that were not scored produce no entry in identifier_assessments[]. Never read the absence of an identifier assessment as a signal that the identifier is low risk. It only means the identifier was not scored on that run.