---
title: "Get Document Risks"
method: GET
path: "/files/{file_id}/risks"
tags: ["files"]
---

# Get Document Risks

`GET /files/{file_id}/risks`

Get all risks associated with a document.

This is a cross-run file surface: a document's risks can span marketing, base,
and other run types. Reviewer-only free-text (``dismiss_note`` on any run, plus
the TipTap ``notes`` doc on marketing runs) is redacted for callers without write
access on the owning run's module, mirroring ``get_run_risks``/``get_risk_by_id``.
The write check runs once per distinct run type on the file, not once per risk.

## Path parameters

- `file_id` string, uuid, required

## Response `200`

Successful Response

- DocumentRiskResponseWithRun[]
  - `risk_id` string, uuid, required
  - `document_id` string, uuid, required
  - `short_text` string, required
  - `explanation` string, required
  - `document_clause` string, nullable
  - `source_clause` string, required
  - `remediation` string, nullable
  - `severity` 'low' | 'medium' | 'high', required
  - `status` 'reject' | 'allow' | 'flag' | 'dismissed', required
  - `dismiss_reason` 'valid_ok' | 'already_met' | 'incorrect' | 'out_of_scope' | 'pre_approved' | 'other' — Why a reviewer dismissed a marketing risk (status=dismissed).
  - `dismiss_note` string, nullable
  - `made_obsolete_by` string, uuid, nullable, required
  - `ignore_comment` string, nullable, required
  - `notes` unknown
  - `citations` DocumentRiskCitation[], nullable
    - `cited_text` string, required
    - `start_page_number` integer, required
    - `end_page_number` integer, required
    - `bounding_boxes` BoundingBox[]
      - `x0` number, required
      - `y0` number, required
      - `x1` number, required
      - `y1` number, required
  - `created_by_user_id` string, uuid, nullable
  - `run_id` string, uuid, required
  - `suppressed_by_rule_id` string, uuid, nullable
  - `filename` string, nullable
  - `resolved` string, date-time, nullable
  - `issue_id` string, uuid, nullable
  - `assignee_id` string, uuid, nullable
  - `assignee_first_name` string, nullable
  - `assignee_last_name` string, nullable
  - `due_date` string, date, nullable
  - `run_type` 'base' | 'soc' | 'soc1' | 'marketing' | 'overview' | 'contract_analysis' | 'drafting' | 'inherent_risk_assessment' | 'risk_assessment', required
  - `run_time` string, date-time, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/kobaltlabs/apis/fastapi.md) · [All operations](https://skmtc.dev/kobaltlabs/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kobaltlabs/fastapi/revisions/425d5b8a3c17/schema)