Request Threat Scoring API Documentation

This API allows you to score HTTP requests for potential security threats. It analyzes various aspects of a request and returns a numerical score and risk level.

Score Current Request

GET https://score.edk.pw/api/score

Returns a threat score for the current request.

Example Response

{
  "total_score": 35,
  "risk_level": "medium",
  "factors": {
    "ip_reputation": {
      "score": 5,
      "value": "203.0.113.1",
      "max_score": 40,
      "percentage": 13
    },
    "user_agent": {
      "score": 0,
      "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
      "max_score": 30,
      "percentage": 0
    },
    "http_method": {
      "score": 0,
      "value": "GET",
      "max_score": 25,
      "percentage": 0
    },
    "query_parameters": {
      "score": 0,
      "count": 0,
      "max_score": 50,
      "percentage": 0
    },
    "headers": {
      "score": 5,
      "count": 10,
      "max_score": 30,
      "percentage": 17
    },
    "path_analysis": {
      "score": 10,
      "value": "/admin",
      "max_score": 20,
      "percentage": 50
    },
    "content_analysis": {
      "score": 0,
      "max_score": 30,
      "percentage": 0
    },
    "rate_analysis": {
      "score": 15,
      "max_score": 35,
      "percentage": 43
    }
  },
  "timestamp": "2025-04-30T12:34:56+00:00",
  "domain": "score.edk.pw",
  "processing_time": 0.1234,
  "max_possible_score": 260
}

Evaluate Custom Request

POST https://score.edk.pw/api/evaluate

Evaluates a custom request based on provided parameters.

Parameters

Name Description Required
ip IP address for the simulated request No
user_agent User agent string No
method HTTP method (GET, POST, etc.) No
path Request path No
headers Request headers as key-value pairs No
query Query parameters as key-value pairs No
body Request body content No

Example Response

{
  "total_score": 35,
  "risk_level": "medium",
  "factors": {
    "ip_reputation": {
      "score": 5,
      "value": "203.0.113.1",
      "max_score": 40,
      "percentage": 13
    },
    "user_agent": {
      "score": 0,
      "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
      "max_score": 30,
      "percentage": 0
    },
    "http_method": {
      "score": 0,
      "value": "GET",
      "max_score": 25,
      "percentage": 0
    },
    "query_parameters": {
      "score": 0,
      "count": 0,
      "max_score": 50,
      "percentage": 0
    },
    "headers": {
      "score": 5,
      "count": 10,
      "max_score": 30,
      "percentage": 17
    },
    "path_analysis": {
      "score": 10,
      "value": "/admin",
      "max_score": 20,
      "percentage": 50
    },
    "content_analysis": {
      "score": 0,
      "max_score": 30,
      "percentage": 0
    },
    "rate_analysis": {
      "score": 15,
      "max_score": 35,
      "percentage": 43
    }
  },
  "timestamp": "2025-04-30T12:34:56+00:00",
  "domain": "score.edk.pw",
  "processing_time": 0.1234,
  "max_possible_score": 260
}

Understanding the Score

The API analyzes the following factors to determine the threat level of a request:

Risk Levels

Level Score Range Description
Minimal 0-19 Normal, benign request with no suspicious characteristics.
Low 20-39 Slightly unusual request, but likely legitimate.
Medium 40-59 Suspicious request that shows some characteristics of potential threats.
High 60-79 Likely malicious request with multiple suspicious patterns.
Critical 80+ Almost certainly malicious, showing clear attack patterns.