LookupReportDto

indicatorstringrequired

The indicator that was looked up.

Example: malicious.example

typestringrequired

The indicator class that was fanned out to providers.

Possible values: [url, ip, domain, hash]

Example: domain

verdictstringrequired

The fused ROUNDBOX verdict.

Possible values: [clean, suspicious, malicious, unknown]

Example: malicious

scorenumberrequired

Final 0–100 risk score (higher = worse).

Example: 88

rationalestringrequired

Henrietta (H-AI) analyst rationale — vendor-name-free.

Example: ROUNDBOX Orbis Labs flags this domain as a known phishing host.

sourcesstring[]required

ROUNDBOX Labs attribution for the contributing intelligence — underlying providers/feeds are never surfaced.

Example: ["ROUNDBOX Orbis Labs","Henrietta (H-AI)"]

signalsstring[]required

Merged, de-duped, vendor-free evidence signals.

Example: ["Listed on a phishing block-list","Categorized as credential-harvesting"]

evidence objectrequired

Structured detail (aggregate/Henrietta scores + per-contributor summary).

property name*any

Structured detail (aggregate/Henrietta scores + per-contributor summary).

Example: {"aggregateScore":85,"contributingCount":2,"henriettaScore":88}

LookupReportDto

{
  "indicator": "malicious.example",
  "type": "domain",
  "verdict": "malicious",
  "score": 88,
  "rationale": "ROUNDBOX Orbis Labs flags this domain as a known phishing host.",
  "sources": [
    "ROUNDBOX Orbis Labs",
    "Henrietta (H-AI)"
  ],
  "signals": [
    "Listed on a phishing block-list",
    "Categorized as credential-harvesting"
  ],
  "evidence": {
    "aggregateScore": 85,
    "contributingCount": 2,
    "henriettaScore": 88
  }
}