---
title: "Get Risk Citations"
method: GET
path: "/marketing/requirement-coverage/risks"
tags: ["marketing-requirement-coverage"]
---

# Get Risk Citations

`GET /marketing/requirement-coverage/risks`

The requirements each of these risks cites, rendered from the revisions that were judged.

Batched over risk ids rather than one route per risk: the risk list asks about every card on
screen at once, and a request per card is the shape that makes a twenty-risk analysis twenty
round trips.

Capped like its sibling: an uncapped repeated query param is an `IN` list whose size the caller
chooses. The client chunks well below this cap for a different reason — a request near it is
~11 KB of URL, past what a default proxy will accept — so this bound is the server's own floor
against a hand-made request, not the number the UI sends.

The query itself lives in `helpers/marketing_requirement_citations.py`, shared with the
rollout-consistency run viewer, which renders these same blocks for staff without a masquerade.

## Query parameters

- `risk_id` string[], required

## Response `200`

Successful Response

- RiskRequirementCitations[]
  - `risk_id` string, uuid, required
  - `requirements` RequirementRiskCitation[]
    - `requirement_id` string, uuid, required
    - `revision_id` string, uuid, required
    - `requirement_text` string, required
    - `section_label` string, nullable
    - `title` string, nullable
    - `source_page` integer, nullable
    - `judging_guidance` string, nullable
    - `collateral_types` MarketingCollateralType[], nullable
    - `matched_trigger_terms` string[]
    - `citation` RequirementCitation, required — Where the requirement itself sits in the standards document it came from. A serialized `GroundedSpan` plus the exact version its boxes were measured against. The version is the load-bearing half: the boxes are coordinates in the bytes the decomposition read, so resolving the document any other way draws the highlight in the wrong place on a standard that has since been re-uploaded.
      - `guideline_file_id` string, uuid, required
      - `guideline_filename` string, nullable
      - `guideline_upload_id` string, uuid, nullable
      - `grounding` object, nullable
    - `source` 'model' | 'deduped' — How a link between a risk and a requirement came to exist. `MODEL` is the ordinary case: the batch judge named this requirement's number. `DEDUPED` marks a link inherited when two findings about the same passage were merged — the risk on screen is the survivor, and without this the merged finding's requirement would look like one the model never cited. A reader deciding whether the citation is trustworthy needs the difference, because a deduped link is one step further from what the model actually said.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/kobaltlabs/apis/fastapi.md) · [All operations](https://skmtc.dev/kobaltlabs/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kobaltlabs/fastapi/revisions/425d5b8a3c17/schema)