---
title: "Export Risk Assessment"
method: GET
path: "/risk-assessment/assessments/{risk_assessment_id}/export"
tags: ["risk-assessment"]
---

# Export Risk Assessment

`GET /risk-assessment/assessments/{risk_assessment_id}/export`

## Request

- Base URL: `https://api.kobaltlabs.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.kobaltlabs.com/risk-assessment/assessments/{risk_assessment_id}/export`
- Auth: none declared

The whole run in one payload, for the client-rendered PDF.

The overview payload above carries no rationales and no citations — they are
the bulk of a factor and it is polled — so the export has its own route
rather than fattening the polled one. Citations come back in a single query
keyed by version, never one per factor (rule F-9).

The dossier is deliberately absent: it is the vendor research the subagents
read, not a rating anyone signed off on.

## Path parameters

- `risk_assessment_id` string, uuid, required

## Response `200`

Successful Response

- RiskAssessmentExport: The whole run, flat, for the "Export PDF" button. Factors carry `risk_area_name` rather than nesting under areas, mirroring `build_review_export_payload`'s flat requirement list: the document groups them itself, and one list is what a reader-facing renderer wants. The research dossier is **not** included — it is the vendor background the subagents read, not an output a reviewer signs off on.
  - `risk_assessment_id` string, uuid, required
  - `vendor_id` string, uuid, required
  - `status` 'queued' | 'running' | 'complete' | 'failed', required: Lifecycle of one whole assessment of one company.
  - `created` string, date-time, required
  - `started_at` string, date-time, nullable, required
  - `completed_at` string, date-time, nullable, required
  - `factor_count` integer, required
  - `factors_reviewed` integer, required
  - `factors_rated` integer, required
  - `error` string, nullable, required
  - `vendor_name` string, required
  - `exported_at` string, date-time, required
  - `rating_options` RatingOptionView[]
    - `option_id` string, uuid, required
    - `label` string, required
    - `position` integer, required
    - `hex_color` string, nullable, required
  - `factors` FactorExportView[]
    - `factor_assessment_id` string, uuid, required
    - `risk_factor` FactorRef, required
      - `risk_factor_id` string, uuid, nullable, required
      - `slug` string, required
      - `name` string, required
    - `status` 'queued' | 'running' | 'complete' | 'error', required: Lifecycle of one factor's assessment within a run. There is no deferral state: a factor either produces a rating its rationale can defend, or it errors. Missing evidence is narrated in the rationale.
    - `progress_pct` integer, nullable, required
    - `current_activity` string, nullable, required
    - `suggested_rating` RatingOptionView, required: One level of the tenant's INHERENT_RISK_LEVEL scale. The scale is per-tenant and variable length, so the UI renders N cells from this list rather than assuming five. `position` is 1-based and derived from order, not from `order_index`, which may be sparse.
      - `option_id` string, uuid, required
      - `label` string, required
      - `position` integer, required
      - `hex_color` string, nullable, required
    - `manual_rating` RatingOptionView, required: One level of the tenant's INHERENT_RISK_LEVEL scale. The scale is per-tenant and variable length, so the UI renders N cells from this list rather than assuming five. `position` is 1-based and derived from order, not from `order_index`, which may be sparse.
      - `option_id` string, uuid, required
      - `label` string, required
      - `position` integer, required
      - `hex_color` string, nullable, required
    - `effective_rating` RatingOptionView, required: One level of the tenant's INHERENT_RISK_LEVEL scale. The scale is per-tenant and variable length, so the UI renders N cells from this list rather than assuming five. `position` is 1-based and derived from order, not from `order_index`, which may be sparse.
      - `option_id` string, uuid, required
      - `label` string, required
      - `position` integer, required
      - `hex_color` string, nullable, required
    - `review_state` 'proposed' | 'approved' | 'overridden', required: Where a human reviewer stands on the agent's proposed rating. Written by the approval workflow (M5); until then every completed factor sits at PROPOSED, which is what renders the "Kobalt proposed" chip.
    - `reviewer_name` string, nullable, required
    - `reviewed_at` string, date-time, nullable, required
    - `citation_count` integer, required
    - `distinct_document_count` integer, required
    - `step_count` integer, nullable, required
    - `duration_ms` integer, nullable, required
    - `error` string, nullable, required
    - `agent_run_id` string, uuid, nullable, required
    - `risk_area_name` string, required
    - `rationale` string, nullable, required
    - `reviewer_note` string, nullable, required
    - `citations` CitationView[]
      - `citation_id` string, uuid, required
      - `target_kind` 'file_version' | 'artifact' | 'web' | 'prior_review', required: What is being cited. FILE_VERSION targets `file_versions.upload_id` — an immutable document *version*, never a filename and never `files.file_id`, so a re-upload can never silently repoint an old trace at text the agent never read.
      - `display_title` string, required
      - `locator` string, nullable, required
      - `quote` string, nullable, required
      - `rationale_offset` integer, nullable, required
      - `paragraph_index` integer, nullable, required
      - `offset_in_paragraph` integer, nullable, required
      - `anchor_text` string, nullable, required
      - `step_id` string, uuid, nullable, required
      - `upload_id` string, uuid, nullable, required
      - `start_page_number` integer, nullable, required
      - `end_page_number` integer, nullable, required
      - `artifact_id` string, uuid, nullable, required
      - `url` string, nullable, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kobaltlabs/apis/fastapi.md) - [All operations](https://skmtc.dev/kobaltlabs/apis/fastapi/llms.txt) - [OpenAPI document](https://skmtc.dev/kobaltlabs/apis/fastapi/revisions/8587332d5e43?raw)