Risk signals

Screen company risk without overstating certainty

Use confirmed flags, indeterminate checks, coverage, and the score bounds together.

Updated 7 September 2026 6 min read

Risk screening is an evidence-reading task, not a single-number decision. The risk endpoint returns confirmed flags and the evidence that could not be evaluated, so a workflow can preserve uncertainty instead of silently treating it as clearance.

Call the risk-only endpoint

curl "https://api.rotuli.co.uk/v1/entity/00445790/risk" \
  -H "Authorization: Bearer $ROTULI_API_KEY"

GET /entity/{company_number}/risk returns a risk response for a company number. Risk signals require a Growth or Enterprise key. The equivalent object can appear in an entity response for eligible keys; an omitted risk_signals object on a free key means not entitled, not no risk.

Read all six evidence fields

Field	How to use it
`score`	Points from confirmed flags, from 0 to 100.
`score_is_floor`	When true, the score is a lower bound because a required source was unavailable.
`potential_score`	Worst-case ceiling after every indeterminate flag, capped at 100.
`coverage`	Risk-bearing sources that were actually consulted. A missing source was not assessed.
`flags`	Confirmed, triggered signals with a code, severity, description, and timestamp.
`indeterminate`	Checks that could not run, including their source and reason.

Separate signal from decision

Make your own decision policy explicit and reviewable. The API returns signals; it does not make a credit, onboarding, or compliance decision. A conservative branch can route incomplete evidence to manual review before applying any flag-specific rule.

const signals = response.risk_signals;

if (signals.score_is_floor || signals.indeterminate.length > 0) {
  return "manual_review"; // evidence is incomplete
}

if (signals.flags.some((flag) => flag.code === "INSOLVENCY_ACTIVE")) {
  return "escalate";
}

return "continue";

Expect indeterminate checks

Each indeterminate record names source_unavailable, not_requested, or feature_disabled. It is not a false positive and it is not a negative finding. A low score with score_is_floor: true does not establish low risk.

Use stable codes, not prose

Build rules around code and retain severity as a second input. The current public schema includes INSOLVENCY_ACTIVE, COMPANY_DISSOLVED, ACCOUNTS_OVERDUE, CONFIRMATION_OVERDUE, COMPANY_VERY_NEW, NO_PSC_RECORDED, OUTSTANDING_CHARGES, and ALL_ASSETS_CHARGED. The risk-signal reference explains their meaning and severity.