API ENDPOINT DIRECTORY & INTEGRATION GUIDE

The AgentRisk Data-as-a-Service API delivers maintainer concentration (MCI), dormancy/reactivation (DRI), anomalous spike activity (ASI), and typosquatting detection across npm and PyPI ecosystems.

1. AUTHENTICATION

All API requests must include your provisioned cryptographic API key passed in the custom HTTP header X-API-Key.

X-API-Key: daas_live_a1b2c3d4e5f6...

2. RATE LIMITING & SLA

Production API keys are rate-limited to 60 requests per minute per key utilizing an in-memory Upstash Redis Lua sliding-window algorithm.

RATE_LIMIT_WINDOW: 60s | MAX_REQUESTS: 60 | ALGORITHM: LUA SLIDING WINDOW

3. QUICKSTART CODE SNIPPET

curl -X GET \
  "https://agentrisk-daas.onrender.com/api/v1/analytics/package-risk/npm/@modelcontextprotocol/sdk" \
  -H "X-API-Key: YOUR_API_KEY"

4. PRODUCTION ENDPOINT SPECIFICATIONS

GET/api/v1/package-risk/{package_name}

RAW TELEMETRY METRICS

Returns the latest unweighted telemetry row for a target package (e.g. npm/react or pypi/vllm). Supports scoped npm packages (npm/@modelcontextprotocol/sdk).

GET/api/v1/analytics/package-risk/{package_name}

COMPOSITE RISK INDICES

Synthesizes raw telemetry into composite risk indices: Maintainer Concentration Index (MCI), Dormancy Reactivation Index (DRI), and Anomalous Spike Index (ASI).

GET/api/v1/package-risk/{package_name}/history?limit=30

TIME-SERIES RETENTION

Returns historical telemetry snapshots and computed indices, newest first. limit accepts 1–100 and defaults to 30. One snapshot is retained per ingest cycle.

POST/webhooks/lemon-squeezy

CRYPTOGRAPHIC PROVISIONING

Receives HMAC-SHA256 signed subscription events from Lemon Squeezy Merchant of Record to instantly provision API keys or deactivate keys on cancellation.

5. HTTP RESPONSE CODES & TYPOSQUATTING MATRIX

HTTP 200 OK

Request resolved successfully. Telemetry or analytics object returned.

HTTP 401 UNAUTHORIZED

Missing, unauthenticated, or deactivated API key.

HTTP 404 NOT FOUND (TYPOSQUATTING)

Queried package identity does not exist in registry. Edit distance matching returns possible typosquatting target.

HTTP 504 GATEWAY TIMEOUT

Synchronous live resolution exceeded 5.0s threshold. Resolution offloaded to background revalidation task.

HTTP 503 SERVICE UNAVAILABLE

An upstream telemetry source was unreachable or its request budget was momentarily exhausted. This describes our service, never the queried package — a package is only reported untrackable when that is actually true.