Intangic API (1.0.0)

Per-company financial impact across 4 severity tiers (Minor/Medium/Major/Catastrophic -- Low/Medium/High/HighestSeverity internally), each with its dollar economical_loss value and an NPV computed as the integral from 0 to that tier's economical_loss (clamped so implied frequency never exceeds 100%, reusing Rosie's existing formula as-is). All 4 sizes are returned by default; impact_size filters to one -- the response shape (an array under "impact") stays the same either way, so clients don't need to branch parsing logic based on whether a filter was applied. One entitlement grant covers all 4 sizes, not gated per-tier. Decided in INT-398/INT-399.

Per-company, per-month cyber risk time series: cyber_risk (Cy-Rank level) plus 2 breach frequency values -- minor_breach_probability (cbh.BreachProbability. FullBreachProbability / 100, the full/unsampled cohort) and major_breach_probability (cbh.BreachProbability.BreachProbability / 100, the main sampled cohort). Divided by 100 from the raw DB columns (which are stored on a 0-100+ scale) to express a true annual frequency instead -- e.g. 1.2 means "1.2 expected breaches per year," not "120%." Despite the field name, this is technically an expected frequency (a rate), not a probability in the strict sense, since it can exceed 1 -- kept as "Breach Probability" to match existing client-facing terminology. Both are broadcast per company from the shared CyRankLevel- segment value for that month (not independently computed per company) -- otherwise pure relabeling of already-production columns, no new computation. Formerly "Breach Probability," merged with Cy-Rank in the last redesign since Cy-Rank is the join key that determines which probability applies. Returns the most recent limit months by default (default 60 -- 5 years of monthly data). Filter with from_date/to_date (YYYY-MM-DD, inclusive) or with period=CURRENT/PREVIOUS (the most recent available month, or the one before it) -- period and from_date/to_date are mutually exclusive. A date range wider than limit still only returns the most recent limit months within it. Response shape (an array under "risk") stays the same regardless of filtering, so clients don't need to branch parsing logic based on which filter was used. clientCompanyId identifies which company -- the calling customer's identity itself (ClientID) is never a parameter here or anywhere in this API: it's resolved server-side from the x-api-key by the request-time authorizer, not supplied by the client, so it can't be omitted, mismatched, or spoofed.

Backbone feed underneath every other feed -- current firmographic snapshot for one company. Bundled into every subscription regardless of tier: the feed itself is never entitlement_denied, but the company must still be in the customer's tracked list (entitlement_denied for one that isn't, company_not_found for one that doesn't exist at all in Intangic's universe). company_name is the company's current name only (cbh.CompanyName.NewName where IsCurrent=TRUE) -- no name-history array in v1. sector is the raw CbhSector tag (INT-397 -- no scored variant); industry is GicIndustry. revenue/revenue_peer_group are TotalRevenue (raw) and TotalRevenueGroup (peer-relative quintile within Region+CbhSector, 1=smallest to 5=largest) -- both copied verbatim via ETL, not recomputed (INT-396). A fixed absolute-dollar revenue band was considered and deferred, not built for v1 (INT-417). peer_revenue_range (formerly scoped as a separate "Peer Benchmarking" feed, folded in here) is the [min, max] TotalRevenue among companies sharing this company's peer group (same Region + CbhSector + TotalRevenueGroup) -- the actual dollar range revenue_peer_group's quintile spans, not a methodology cutoff. Named distinctly from "revenue band" (INT-396/417) to avoid confusion with that deferred fixed-tier methodology -- this is a different concept: the range this specific company's existing peer group happens to span.

Core v1 feed. Per-company, per-week, per-signal-type time series (INT-390) -- weekly, not monthly, unlike Company Risk. Field contract decided independently of the sibling "Production pipeline for Z-scores" project's completion status (still in progress) -- the pipeline determines how these values get computed, not what shape the API returns. signal_type is OVERALL plus 6 dark-web signal categories (incomingDarkWebTraffic, forumPosts, darkWebMarketListings, pasteResults, osintResults, outgoingDarkWebTraffic) -- these names are provisional, not yet officially formalized. Filterable, all 7 returned by default -- same pattern as impact_size on Financial Impact. z_score_percentile is a percentile rank (0-100). status_cutoffs and percentiles are both arrays of raw Z-score values (NOT percentile ranks), each associated with a different reference population: status_cutoffs (exactly 5 values: minimum, OK-to-Monitor, Monitor-to-Elevated, Elevated-to-Critical, maximum) is derived from a breach-conditioned subset (companies that had an actual breach) and is the operative determinant of status; percentiles (exactly 3 values: the Z-scores at the 25th/50th/75th percentile) is computed against the full/general company population -- contextual, not itself the status determinant. Returns the most recent limit weeks by default (default 200 -- roughly 4 years of weekly data). Filter with from_date/to_date (YYYY-MM-DD, inclusive) or with period=CURRENT/PREVIOUS (the most recent available week, or the one before it) -- period and from_date/to_date are mutually exclusive. A date range wider than limit still only returns the most recent limit weeks within it. Response shape (an array under "scores") stays the same regardless of filtering.