---
title: "Retrieve a risk assessment"
method: GET
path: "/v1/businesses/{business_id}/risk_assessments/{id}"
tags: ["riskAssessments"]
---

# Retrieve a risk assessment

`GET /v1/businesses/{business_id}/risk_assessments/{id}`

## Request

- Base URL: `https://api.middesk.com`
- URL: `https://api.middesk.com/v1/businesses/{business_id}/risk_assessments/{id}`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/middesk/apis/middesk-api/docs/v1/businesses/:business_id/risk_assessments/:id/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `business_id` string, required
- `id` string, required

## Response `200`

risk assessment found

- RiskAssessment
  - `level` 'low' | 'moderate' | 'high' | 'not_available', required: Categorical risk verdict. `not_available` means a Risk order ran but could not produce a conclusive verdict. New values are not expected; `level` is a closed set.
  - `object` 'risk_assessment', required
  - `id` string, uuid, required
  - `created_at` string, date-time, required
  - `order_id` string, uuid, nullable, required: The order this assessment was produced against — the snapshot coordinate. Fetch the business as of this order with `GET /businesses/{id}?order_id={order_id}` to compare the assessment against the underlying record. Null for assessments not tied to an order.
  - `business_snapshot_url` string, uri, nullable, required: URL of the business as of this assessment's order (`GET /businesses/{id}?order_id={order_id}`), resolving to the per-order snapshot to compare against the assessment's results. Null for assessments not tied to an order.
  - `title` string, nullable, required: One-line headline synthesizing the assessment. Null on assessments produced before titles shipped.
  - `description_markdown` string, nullable, required: Narrative explanation of the assessment, in CommonMark markdown. Null on assessments recorded before markdown narratives shipped.
  - `score` integer, nullable, required: Overall risk score from 0 (lowest risk) to 100 (highest risk); `level` is banded from it. Null when the assessment could not be scored. Note the scale — the top-level score is a 0–100 integer, while nested dimension and identifier-assessment scores are 0–1 floats.
  - `dimensions` RiskDimension[], required: Per-dimension risk scores with their top contributing factors.
    - `object` 'risk_dimension', required
    - `type` string, required: The dimension of risk being scored (e.g. `transaction_laundering`, `reputational`). Not a closed set — new dimensions may be added, so clients should tolerate unknown values.
    - `score` string, required: Dimension risk score from 0 (lowest risk) to 1 (highest risk). Unlike the assessment's top-level 0–100 integer `score`, nested scores are 0–1 floats.
    - `level` 'low' | 'moderate' | 'high' | 'not_available', required: Categorical band of this dimension's `score`, on the same scale as the assessment's `level`.
    - `top_factors` RiskDimensionTopFactorsItem[], required: The measured facts that contributed most to this dimension's score, ranked by absolute contribution. Factor names are stable snake_case identifiers from a broader vocabulary than identifier-assessment attributes: website-content facts (e.g. `website_has_no_refund_language`) appear alongside identifier facts (e.g. `url_domain_parked`). Not a closed set.
      - `name` string, required: Stable factor name (e.g. `website_has_no_refund_language`, `url_domain_parked`).
      - `type` string, required: JSON type of `value`. Typically `boolean`, `integer`, or `double`; not a closed set.
      - `value` unknown, required
      - `contribution` string, required: Signed share of this factor's contribution to the dimension score; larger absolute values contributed more.

## Other responses

- `403`: account is not entitled to risk
- `404`: risk assessment not found

## Changes

- **2026-10-20** `410a449f7a40`: 2 breaking
  - the `dimensions/items/score` response's property type changed from `number` to `string`, and format from `double` to no format for status `200`
  - the `dimensions/items/top_factors/items/contribution` response's property type changed from `number` to `string`, and format from `double` to no format for status `200`
- **2026-09-29** `e9c8c0f52777`: 1 breaking
  - removed the required property `identifier_assessments` from the response with the `200` status
- **2026-09-17** `4c9cd4e834ba`: 1 warning, 1 info
  - deleted the `header` request parameter `Authorization`
  - the endpoint scheme security `bearer_auth` was added to the API
- **2026-09-12** `668373c892ce`: 1 info
  - api operation id `getRiskAssessment` removed and replaced with `riskAssessments_getRiskAssessment`
- **2026-09-03** `ac0d9be94846`: 2 info
  - added the optional property `errors/items/parameter` to the response with the `403` status
  - added the optional property `errors/items/parameter` to the response with the `404` status

[Operation history](https://skmtc.dev/middesk/apis/middesk-api/changes/v1/businesses/:business_id/risk_assessments/:id/get.md)

---

[API](https://skmtc.dev/middesk/apis/middesk-api.md) - [All operations](https://skmtc.dev/middesk/apis/middesk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/middesk/apis/middesk-api/revisions/adc98c847a77?raw)