---
title: "Retrieve a risk assessment"
method: GET
path: "/v1/businesses/{business_id}/risk_assessments/{id}"
tags: ["riskAssessments"]
---

# Retrieve a risk assessment

`GET /v1/businesses/{business_id}/risk_assessments/{id}`

## Path parameters

- `business_id` string, required
- `id` string, required

## Headers

- `Authorization` string, required

## Response `200`

risk assessment found

- TypeRiskAssessment
  - `level` 'low' | 'moderate' | 'high' | 'not_available', required — Categorical risk verdict. `not_available` means a Risk order ran but could not produce a conclusive verdict. New values are not expected; `level` is a closed set.
  - `object` 'risk_assessment', required
  - `id` string, uuid, required
  - `created_at` string, date-time, required
  - `order_id` string, uuid, nullable, required — The order this assessment was produced against — the snapshot coordinate. Fetch the business as of this order with `GET /businesses/{id}?order_id={order_id}` to compare the assessment against the underlying record. Null for assessments not tied to an order.
  - `business_snapshot_url` string, uri, nullable, required — URL of the business as of this assessment's order (`GET /businesses/{id}?order_id={order_id}`), resolving to the per-order snapshot to compare against the assessment's results. Null for assessments not tied to an order.
  - `title` string, nullable, required — One-line headline synthesizing the assessment. Null on assessments produced before titles shipped.
  - `description_markdown` string, nullable, required — Narrative explanation of the assessment, in CommonMark markdown. Null on assessments recorded before markdown narratives shipped.
  - `score` integer, nullable, required — Overall risk score from 0 (lowest risk) to 100 (highest risk); `level` is banded from it. Null when the assessment could not be scored. Note the scale — the top-level score is a 0–100 integer, while nested dimension and identifier-assessment scores are 0–1 floats.
  - `dimensions` TypeRiskDimension[], required — Per-dimension risk scores with their top contributing factors.
    - `object` 'risk_dimension', required
    - `type` string, required — The dimension of risk being scored (e.g. `transaction_laundering`, `reputational`). Not a closed set — new dimensions may be added, so clients should tolerate unknown values.
    - `score` number, double, required — Dimension risk score from 0 (lowest risk) to 1 (highest risk). Unlike the assessment's top-level 0–100 integer `score`, nested scores are 0–1 floats.
    - `level` 'low' | 'moderate' | 'high' | 'not_available', required — Categorical band of this dimension's `score`, on the same scale as the assessment's `level`.
    - `top_factors` TypeRiskDimensionTopFactorsItem[], required — The measured facts that contributed most to this dimension's score, ranked by absolute contribution. Factor names are stable snake_case identifiers from a broader vocabulary than identifier-assessment attributes: website-content facts (e.g. `website_has_no_refund_language`) appear alongside identifier facts (e.g. `url_domain_parked`). Not a closed set.
      - `name` string, required — Stable factor name (e.g. `website_has_no_refund_language`, `url_domain_parked`).
      - `type` string, required — JSON type of `value`. Typically `boolean`, `integer`, or `double`; not a closed set.
      - `value` unknown, required
      - `contribution` number, double, required — Signed share of this factor's contribution to the dimension score; larger absolute values contributed more.
  - `identifier_assessments` TypeIdentifierAssessment[], required — Risk assessments of the business's individual identifiers (email address, phone number, website). Identifiers the order did not evaluate have no entry — absence means "not evaluated," never "evaluated and clear."
    - `object` string, required — The kind of identifier assessed — `email_risk`, `phone_risk`, or `url_risk`. Not a closed set: assessments of additional identifier types may be added, so clients should tolerate unknown values.
    - `id` string, required — Identifier-assessment ID (`idr_`-prefixed), stable for a given assessment and resource.
    - `resource` TypeIdentifierAssessmentResource, required — The business resource this assessment evaluated.
      - `type` string, required — Resource type — `email_address` for `email_risk`, `phone_number` for `phone_risk`, `website` for `url_risk`. Not a closed set.
      - `id` string, required — ID of the resource on the business.
      - `value` string, required — The value of the underlying business resource — the email address, the E.164 phone number, or the website URL. For websites, the URL the assessment actually crawled may differ (e.g. after redirects); this field mirrors the business resource, the join key back to the business.
    - `score` number, double, required — Identifier risk score from 0 (lowest risk) to 1 (highest risk). Unlike the assessment's top-level 0–100 integer `score`, nested scores are 0–1 floats.
    - `attributes` TypeIdentifierAssessmentAttributesItem[], required — Measured risk facts about the identifier, named with a stable per-type vocabulary. Current attributes — email: `email_is_valid`, `email_is_disposable`, `email_deliverability_low`; phone: `phone_is_valid`, `phone_is_active`, `phone_is_risky`, `phone_has_recent_abuse`, `phone_is_prepaid`, `phone_is_leaked`, `phone_is_spammer`; url: `url_is_suspicious`, `url_has_phishing`, `url_has_malware`, `url_domain_parked`, and the six `url_domain_trust_*` flags — `url_domain_trust_trusted`, `url_domain_trust_positive`, `url_domain_trust_neutral`, `url_domain_trust_malicious`, `url_domain_trust_suspicious`, `url_domain_trust_unrated` — of which a measured domain trust sets exactly one true. New attributes may be added over time. Only facts that were actually measured appear: a missing attribute means "not evaluated," never "evaluated and clear," while `value: false` means the fact was checked and not present.
      - `name` string, required — Stable attribute name (e.g. `email_is_valid`, `phone_is_risky`, `url_is_suspicious`).
      - `type` string, required — JSON type of `value`. Currently every attribute is `boolean`; `number` and `string` may appear as attributes are added.
      - `value` unknown, required

## Other responses

- `403` — account is not entitled to risk
- `404` — risk assessment not found

---

[API](https://skmtc.net/middesk/apis/middesk-api.md) · [All operations](https://skmtc.net/middesk/apis/middesk-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/middesk/middesk-api/revisions/9882e52b445b/schema)