---
title: "List risk resources in the authenticated environment"
method: GET
path: "/api/v1/risk/{resource}"
tags: ["Risk"]
---

# List risk resources in the authenticated environment

`GET /api/v1/risk/{resource}`

## Request

- Base URL: `https://api.korala.ai`
- URL: `https://api.korala.ai/api/v1/risk/{resource}`
- Auth: one of:
  - API key in header `X-API-Key`
  - `bearer` (a scheme the document does not define)

## Path parameters

- `resource` 'sources' | 'contexts' | 'subjects' | 'policies' | 'evidence' | 'assessments' | 'overrides' | 'actions' | 'events' | 'investigations' | 'investigation-reviews', required

## Query parameters

- `resourceId` string, uuid
- `investigationId` string, uuid
- `search` string
- `subjectId` string, uuid
- `offset` number

## Headers

- `Idempotency-Key` string
- `X-Risk-Mode` string
- `X-Korala-Mode` 'live' | 'test'

## Response `200`

- RiskRecordListDto
  - `items` RiskRecordDto[], required
    - `id` string, uuid, required
    - `resource` 'sources' | 'contexts' | 'subjects' | 'policies' | 'evidence' | 'assessments' | 'overrides' | 'actions' | 'events' | 'investigations' | 'investigation-reviews', required
    - `data` union, required: Typed persisted resource. Use the resource discriminator to select its data schema.
      - RiskContextDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `kind` string, required
        - `externalId` string, required
        - `createdBy` string, required
        - `policyRevision` number, required: Revision of the context policy configuration.
      - RiskSourceDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `scopes` RiskSourceScopesDto, required
          - `subject` boolean, required: Permit general subject evidence.
          - `contextKinds` string[], required: Context kinds this source may submit evidence for. General subject permission is configured separately.
        - `key` string, required
        - `facts` RiskSourceFactDto[], required
          - `key` string, required
          - `type` 'string' | 'number' | 'boolean' | 'list', required
          - `itemType` 'string' | 'number' | 'boolean'
        - `apiKeyIds` string[], required
        - `enabled` boolean, required
        - `revision` number, required
        - `createdBy` string, required
        - `updatedBy` string, required
        - `updatedAt` string, date-time, required
      - RiskInvestigationDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, required
        - `requestedBy` string, required
        - `externalProcessingConfirmedAt` string, date-time, nullable, required
        - `status` 'pending' | 'processing' | 'completed' | 'failed', required
        - `provider` string, required
        - `questionVersion` string, required
        - `snapshot` RiskInvestigationSnapshotDto, required
          - `capturedAt` string, date-time, required
          - `evidenceRevision` number, required
          - `assessmentRevision` number, required
          - `eventId` string, nullable, required
          - `eventCount` number, required
          - `truncated` boolean, required
          - `evidence` RiskInvestigationEvidenceDto[], required
            - `id` string, uuid, required
            - `fact` string, required
            - `source` string, required
            - `status` 'available' | 'unavailable' | 'revoked', required
            - `value` union, required
              - …
            - `expiresAt` string, date-time, nullable, required
          - `assessments` RiskInvestigationAssessmentDto[], required
            - `id` string, required
            - `policyKey` string, required
            - `policyVersionId` string, required
            - `band` string, nullable, required
            - `decision` string, required
            - `validUntil` string, date-time, nullable, required
            - `missing` RiskMissingFactDto[], required
              - …
          - `actions` RiskInvestigationActionDto[], required
            - `id` string, uuid, required
            - `key` string, required
            - `status` 'requested' | 'acknowledged' | 'completed' | 'failed' | 'cancelled', required
            - `revision` number, required
        - `findings` RiskInvestigationFindingDto[], required
          - `id` string, required
          - `kind` 'rule' | 'comparison_candidate' | 'mock_judgment' | 'ai_judgment', required
          - `title` string, required
          - `detail` string, required
          - `outcome` 'attention' | 'uncertain', required
          - `sources` RiskInvestigationSourceDto[], required
            - `resource` 'evidence' | 'assessments' | 'actions' | 'events', required
            - `id` string, uuid, required
          - `suggestedQuestion` string, required
        - `completedAt` string, date-time, nullable, required
        - `failure` string, nullable, required
      - RiskInvestigationReviewDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, required
        - `investigationId` string, uuid, required
        - `findingId` string, required
        - `disposition` 'accepted' | 'dismissed', required
        - `reason` string, required
        - `actor` string, required
      - RiskSubjectDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `kind` string, required
        - `externalId` string, required
        - `evidenceRevision` number, required
        - `assessmentRevision` number, required
      - RiskPolicyDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `key` string, required
        - `version` number, required
        - `definition` object, required
          - `schemaVersion` string: Policy format version. Omission denotes legacy version 1; unrelated to the published policy revision.
          - `inputs` object[], required
            - `key` string, required
            - `scope` 'subject' | 'current_context'
            - `derivedReuse` object
              - …
            - `verification` object
              - …
            - `label` string
            - `kind` 'text' | 'number' | 'boolean' | 'list' | 'country' | 'choice' | 'money' | 'date' | 'datetime'
            - `allowedValues` string[]
            - `currency` string
            - `decimalPlaces` integer
            - `unit` string
            - `itemType` 'string' | 'number' | 'boolean'
            - `type` 'string' | 'number' | 'boolean' | 'list', required
            - `evidenceKind` 'observed' | 'model_signal'
            - `requirement` 'required' | 'supporting'
            - `acceptedSources` string[], required
            - `maxAgeSeconds` integer, required
          - `applicability` object[]
            - `id` string, required
            - `all` object[], required
              - …
          - `eligibility` object[]
            - `id` string, required
            - `reason` string, required
            - `all` object[], required
              - …
          - `factors` object[], required
            - `id` string, required
            - `label` string, required
            - `match` 'first' | 'highest', required
            - `weight` number, required
            - `defaultPoints` number
            - `cases` object[], required
              - …
          - `aggregation` 'sum' | 'max', required
          - `floor` number, required
          - `ceiling` number, required
          - `bands` object[], required
            - `id` string, required
            - `min` number, required
            - `effect` object, required
              - …
          - `rules` object[], required
            - `id` string, required
            - `reason` string, required
            - `all` object[], required
              - …
            - `forceBand` string
            - `effect` object, required
              - …
          - `missingEvidence` 'awaiting_evidence' | 'review', required
          - `reviewAfterSeconds` integer
        - `status` 'draft' | 'published', required
        - `createdBy` string, required
        - `publishedBy` string, nullable, required
        - `publishedAt` string, date-time, nullable, required
      - RiskEvidenceDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `provenance` RiskReceiptProvenanceDto, required
          - `sourceRegistrationId` string, uuid, required
          - `sourceRevision` number, required
          - `assertedBy` string, required
          - `adapter` 'registered-external-v1', required
          - `evidenceClass` 'assertion', required
        - `subjectId` string, uuid, required
        - `fact` string, required
        - `source` string, required
        - `status` 'available' | 'unavailable' | 'revoked', required
        - `value` union, required
          - string
          - number
          - boolean
          - union[]
            - union
              - …
        - `observedAt` string, date-time, required
        - `expiresAt` string, date-time, nullable, required
        - `providerRef` string, nullable, required
        - `modelProvenance` RiskModelProvenanceDto, required
          - `provider` string, required
          - `model` string, required
          - `criteriaVersion` string, required
          - `inputDigest` string, required: SHA-256 of the exact model input snapshot
          - `runId` string, required
        - `revision` number, required
        - `supersedesId` string, uuid, nullable, required
      - RiskAssessmentDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, required
        - `policyVersionId` string, uuid, required
        - `policyKey` string, required
        - `policySnapshot` object, required
          - `schemaVersion` string: Policy format version. Omission denotes legacy version 1; unrelated to the published policy revision.
          - `inputs` object[], required
            - `key` string, required
            - `scope` 'subject' | 'current_context'
            - `derivedReuse` object
              - …
            - `verification` object
              - …
            - `label` string
            - `kind` 'text' | 'number' | 'boolean' | 'list' | 'country' | 'choice' | 'money' | 'date' | 'datetime'
            - `allowedValues` string[]
            - `currency` string
            - `decimalPlaces` integer
            - `unit` string
            - `itemType` 'string' | 'number' | 'boolean'
            - `type` 'string' | 'number' | 'boolean' | 'list', required
            - `evidenceKind` 'observed' | 'model_signal'
            - `requirement` 'required' | 'supporting'
            - `acceptedSources` string[], required
            - `maxAgeSeconds` integer, required
          - `applicability` object[]
            - `id` string, required
            - `all` object[], required
              - …
          - `eligibility` object[]
            - `id` string, required
            - `reason` string, required
            - `all` object[], required
              - …
          - `factors` object[], required
            - `id` string, required
            - `label` string, required
            - `match` 'first' | 'highest', required
            - `weight` number, required
            - `defaultPoints` number
            - `cases` object[], required
              - …
          - `aggregation` 'sum' | 'max', required
          - `floor` number, required
          - `ceiling` number, required
          - `bands` object[], required
            - `id` string, required
            - `min` number, required
            - `effect` object, required
              - …
          - `rules` object[], required
            - `id` string, required
            - `reason` string, required
            - `all` object[], required
              - …
            - `forceBand` string
            - `effect` object, required
              - …
          - `missingEvidence` 'awaiting_evidence' | 'review', required
          - `reviewAfterSeconds` integer
        - `previousId` string, uuid, nullable, required
        - `evidenceRevision` number, required
        - `sequence` number, required
        - `trigger` string, required
        - `result` RiskEvaluationDto, required
          - `eligibility` RiskEligibilityResultDto
            - `evaluatorVersion` 'risk-eligibility-v1', required
            - `status` 'eligible' | 'ineligible' | 'unknown', required
            - `criteria` RiskRuleResultDto[], required
              - …
            - `missing` RiskMissingFactDto[], required
              - …
            - `validUntil` string, date-time, nullable, required
          - `evaluatorVersion` 'risk-v1', required
          - `status` 'complete' | 'incomplete', required
          - `score` number, nullable, required
          - `band` string, nullable, required
          - `decision` 'none' | 'review' | 'restrict' | 'reject' | 'awaiting_evidence', required
          - `missing` RiskMissingFactDto[], required
            - `fact` string, required
            - `reason` string, required
          - `inputs` RiskEvaluationInputDto[], required
            - `provenance` RiskReceiptProvenanceDto
              - …
            - `providerRef` string, nullable
            - `modelProvenance` RiskModelProvenanceDto
              - …
            - `id` string, uuid, required
            - `fact` string, required
            - `value` union, required
              - …
            - `source` string, required
            - `status` 'available' | 'unavailable' | 'revoked', required
            - `observedAt` string, date-time, required
            - `receivedAt` string, date-time, required
            - `expiresAt` string, date-time, nullable, required
          - `coverage` RiskInputCoverageDto[]
            - `fact` string, required
            - `requirement` 'required' | 'supporting', required
            - `status` 'available' | 'unavailable', required
            - `reason` string, nullable, required
          - `factors` RiskFactorResultDto[], required
            - `id` string, required
            - `points` number, required
            - `weight` number, required
            - `contribution` number, required
            - `matchedCases` number[], required
          - `rules` RiskRuleResultDto[], required
            - `id` string, required
            - `matched` boolean, nullable, required
            - `reason` string, required
          - `actions` string[], required
          - `validUntil` string, date-time, nullable, required
        - `validUntil` string, date-time, nullable, required
      - RiskOverrideDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, required
        - `assessmentId` string, uuid, required
        - `sequence` number, required
        - `decision` 'none' | 'review' | 'restrict' | 'reject', required
        - `reason` string, required
        - `actor` string, required
        - `expiresAt` string, date-time, required
        - `revokedAt` string, date-time, nullable, required
      - RiskActionDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, required
        - `assessmentId` string, uuid, required
        - `key` string, required
        - `status` 'requested' | 'acknowledged' | 'completed' | 'failed' | 'cancelled', required
        - `revision` number, required
        - `updatedAt` string, date-time, required
      - RiskEventDataDto
        - `id` string, uuid, required
        - `organizationId` string, uuid, required
        - `sandbox` boolean, required
        - `createdAt` string, date-time, required
        - `subjectId` string, uuid, nullable, required
        - `resourceId` string, uuid, required
        - `type` string, required
        - `actor` string, required
        - `detail` object, required
  - `nextOffset` number, nullable, required

---

[API](https://skmtc.dev/korala/apis/korala-public-api.md) · [All operations](https://skmtc.dev/korala/apis/korala-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/korala/apis/korala-public-api/revisions/5c4d7810c507?raw)