action threatjammer_assess_ip_set_v1_assess_ip_post {
  label: "Get the risk score of all IP address passed in the body and other data signals."
  description: "### What\nObtain a numerical score and a risk assessment of all the IP addresses passed as argument.\n\n### Parameters\nA list of public IPv4 or IPv6 addresses is required in the body of the request.\n\n### Result\nThe result contains a list of the result for each IP address, with two main sets of data:\n- The score is a number **between 0 and 99** describing the probability of the IP address being a malicious one, being **0** means that the IP address is not malicious and is not a threat. Being **99** means that the service behind the IP address is probably malicious an certainly a threat.\n\n- The list of information gathered from the IP address to obtain the score.\n\nThe result is a JSON object with the following structure:\n- ``self``: the URI of the API call\n- ``score``: The score of the IP address. It ranges from 0 to 99.\n- ``risk``: The risk of the IP address. The allowed values are: LOW, MEDIUM, HIGH. It's a human readable representation of the score.\n- ``reason``: It's a human readable representation of the reason of the risk.\n- ``datasets``: The IP address was found in the these lists of datasets used to obtain the risk score. Datasets are described as a list of URIs.\n- ``sources``: The IP address was found in the these source lists at an specific time with a specific risk score. Sources are described as a list of URIs.\n- ``log``: The activity of the IP address in the different datasets used to obtain the risk score. The log is a URI reference.\n- ``asn``: The information about the Autonomous System (AS) of the IP address. The AS is described as an URI.\n- ``asn_prefix``: The information about the Autonomous System (AS) network prefix of the IP address. The prefix is described as an URI.\n- ``datacenter``: If the IP address is part of a datacenter pool, the information about the datacenter is described as an URI.\n- ``datacenter_prefix``: The information about the Datacenter network prefix of the IP address. The `asn_prefix` and `datacenter_prefix` can be the same, but it is not mandatory. The prefix is described as an URI.\n- ``denylisted``: If the IP address was denylisted by the user, the information about the denylisted IP address is described as an URI.\n- ``first_appearence``: URI to the first appearance of the IP address in the different datasets used to obtain the risk score.\n- ``last_appearence``: URI to the last appearance of the IP address in the different datasets used to obtain the risk score.\n\n### Errors\nThe endpoint will return the following errors:\n- a `422 Unprocessable Entity` error if the IP address is malformed.\n\nThe private IP addresses will be ignored, if any.\n\nIt will also return the API Global errors described in the API description."
  provider: threatjammer
  method: POST
  path: "/v1/assess/ip"
  encoding: json
  input: {
    type: "array"
    items: {
      type: "string"
      format: "ipvanyaddress"
    }
  }
  output: {
    type: "object"
    required: ["results", "self"]
    properties: {
      results: {
        type: "array"
        items: {
          type: "object"
          required: ["risk", "datasets", "sources", "first_appearance", "last_appearance", "asn", "asn_prefix", "reason", "denylisted", "allowlisted", "datacenter", "datacenter_prefix"]
          properties: {
            allowlisted: {
              type: "string"
            }
            asn: {
              type: "string"
            }
            asn_prefix: {
              type: "string"
            }
            datacenter: {
              type: "string"
            }
            datacenter_prefix: {
              type: "string"
            }
            datasets: {
              type: "array"
              items: {
                type: "string"
              }
            }
            denylisted: {
              type: "string"
            }
            first_appearance: {
              type: "array"
              items: {
                type: "string"
              }
            }
            last_appearance: {
              type: "array"
              items: {
                type: "string"
              }
            }
            reason: {
              type: "string"
            }
            risk: {
              type: "string"
              enum: ["UNKNOWN", "LOW", "MEDIUM", "HIGH"]
            }
            score: {
              type: "integer"
            }
            self: {
              type: "string"
            }
            sources: {
              type: "array"
              items: {
                type: "string"
              }
            }
          }
        }
      }
      self: {
        type: "string"
      }
    }
  }
}