> ## Documentation Index
> Fetch the complete documentation index at: https://developer.kyberis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Assessment Responses

> Interpret deterministic CVE, IOC, actor, environment, and generic threat assessment responses.

Assessment endpoints turn resolved subject context and evidence into deterministic decision support.

## Assessment Endpoints

* `/v2/threat-assessments`
* `/v2/cve-assessments`
* `/v2/actor-assessments`
* `/v2/environment-assessments`
* `/v2/ioc-assessments`

## Response Envelope

Assessment endpoints return:

| Field                 | Meaning                                                              |
| --------------------- | -------------------------------------------------------------------- |
| `assessment_type`     | Assessment family used for the response.                             |
| `trace_id`            | Request correlation ID for support and audit.                        |
| `input`               | Normalized request input used by the assessment.                     |
| `priority`            | Deterministic priority or verdict output.                            |
| `confidence`          | Confidence in the assessment result.                                 |
| `rationale_codes`     | Machine-readable reasons for the result.                             |
| `evidence_refs`       | Evidence references supporting the result.                           |
| `recommended_actions` | Bounded actions for the agent or analyst.                            |
| `signals`             | Structured signals considered by the assessment.                     |
| `caveats`             | Limits, assumptions, and unresolved gaps.                            |
| `metadata`            | Assessment metadata, degradation details, and implementation notes.  |
| `timestamp`           | Response generation timestamp.                                       |
| `resolution`          | Resolution context when the request started from a query or subject. |
| `debug`               | Optional diagnostics when debug access is granted.                   |

Batch assessment responses use the standard batch envelope described in [Batch responses](/responses/batches).

## What to Preserve

* assessment result or verdict
* score and confidence fields
* rationale fields
* evidence references
* caveats
* `trace_id`
* request correlation fields

## IOC Assessments

`/v2/ioc-assessments` focuses on the submitted IOC and returns deterministic disposition, confidence, caveats, and recommended actions for that observable. It does not include event-correlated IOC expansion inline.

When an agent needs related indicators, call `/v2/relationships` for the same IOC subject with `relationship_types: ["ioc"]`. This keeps assessment responses fast and separates verdict generation from pivot expansion.

## Subject and Query Modes

For evidence, relationships, and assessments, provide exactly one of `subject` or `query`.

Prefer `subject` after successful resolution. Use `query` for exact IOC strings, especially URLs or observables where canonicalization could lose important detail.

## Reporting Guidance

Do not output a decisive remediation recommendation without evidence IDs or report references. Separate facts from inference.