The risk score is a 0–100 number that is the sum of named signals with published weights, capped at 100. It is arithmetic, not a model output, and you can recompute it yourself from the same response.
What Spaw answers
risk_score is the number, risk_level bands it, and risk_signals lists every signal that fired with its weight and the dataset that produced it. Four products carry one — email, phone, IP and postal address — and each publishes its own weights on its own documentation page.
The design rule is that nothing may raise a score without appearing in risk_signals. A score you cannot take apart is a score you cannot argue with, and a verification answer you cannot argue with is not much use when a customer is on the phone.
The two products with no score
Business verification and the cross-signal consistency check carry no score at all, by design. A register answer is a fact with a date on it, and a consistency report names which fields agree and which do not; turning either into a single number would add a judgement neither dataset supports. The consistency endpoint has no verdict and no recommendation either, and there will not be one.