Risk signals

Every entity and risk response carries a risk_signals object: a 0–100 score, the flags that contributed to it, and the flags that could not be evaluated. Codes are stable and only ever added to — safe to match against in code.

Flag codes

Code	Severity	Points	Source	Description
`INSOLVENCY_ACTIVE`	critical	+50	insolvency	The company has an active insolvency case.
`COMPANY_DISSOLVED`	critical	+50	ch	The company is dissolved at Companies House.
`DIRECTOR_DISQUALIFIED`	critical	+40	officers	At least one active director was confirmed by Companies House as disqualified from acting as a company director. The join is deterministic — it matches a CH-asserted identifier, never a name alone — and it is the highest-severity officer flag.
`ACCOUNTS_OVERDUE`	warning	+20	ch	Annual accounts are overdue at Companies House.
`CONFIRMATION_OVERDUE`	warning	+15	ch	The confirmation statement is overdue at Companies House.
`OUTSTANDING_CHARGES`	warning	+15	charges	The company has outstanding registered charges (security interests) over its assets. Part-satisfied charges count as live; fully satisfied history does not fire this flag.
`ALL_ASSETS_CHARGED`	warning	+10	charges	An outstanding floating charge covers the company's whole undertaking — all of its assets are pledged to a secured creditor (debenture-style).
`NO_ACTIVE_DIRECTORS`	warning	+20	officers	The company is still active but has no active director on record — either mid-transition (all directors resigned without a replacement) or a governance/data-quality problem. A confirmed empty officer set on an active company fires this by definition.
`SOLE_DIRECTOR_IS_CORPORATE`	info	+10	officers	The company has exactly one live directorship and that sole director is a corporate entity rather than a natural person. Legal, but reduces individual accountability and can obscure ultimate control.
`IDENTITY_VERIFICATION_OVERDUE`	info	+5	officers	A live director's ECCTA identity-verification statement is past its due date and still unverified — a low-weight signal most useful when specifically checking ECCTA compliance.
`COMPANY_VERY_NEW`	info	+5	ch	The company was incorporated very recently.
`NO_PSC_RECORDED`	info	+10	ch_psc	No person with significant control is recorded at Companies House.

The two charges flags stack: a live all-assets charge is by definition outstanding, so a company with a whole-undertaking debenture scores +25 (OUTSTANDING_CHARGES + ALL_ASSETS_CHARGED). Outstanding charges are routine for financed businesses — treat them as a prompt to review creditor priority, not a red flag on their own.

DIRECTOR_DISQUALIFIED has an extra indeterminacy rule on top of the usual source failure. A confirmed disqualified_count greater than zero always triggers it — a confirmed hit is authoritative even when some directors could not be checked. But when it would not fire, it goes indeterminate (and score_is_floor becomes true) if the disqualification checks were shed or incomplete: either disqualification_checks.unknown_count is greater than zero, or the slab is an older cached one carrying no disqualification_checks rollup at all. In those cases the officers source still resolved cleanly and stays in coverage — only this one flag is indeterminate. As with every tri-state slab, an unknown disqualification verdict is never read as clear.

Scoring

score — points from confirmed (triggered) flags only, 0–100.
score_is_floor — when true, a required source was unavailable so the score is a lower bound: a low value does not mean low risk.
potential_score — worst-case ceiling: score plus the points of every indeterminate flag, capped at 100. Equals score when nothing is indeterminate.
coverage — the risk-bearing sources actually consulted for this score. A source absent here was not assessed.
indeterminate — flags that could not be evaluated, each with a source and a reason (source_unavailable, not_requested, or feature_disabled).

sources_checked and sources_failed

Every entity response reports which sources contributed:

sources_checked — sources the API attempted for this request: the requested set (defaults to all sources available for your tier, or the ?sources= subset).
sources_failed — sources that could not be queried, as an object keyed by source name with a human-readable reason. Always present; empty when every attempted source succeeded.

sources_failed is always a subset of sources_checked: successfully consulted sources = checked minus failed. An unavailable upstream never fails the request — you get a partial 200 and, where relevant, score_is_floor set to true.