---
title: "Assess risk for a single agent action"
method: POST
path: "/risk/assess"
tags: ["Risk"]
---

# Assess risk for a single agent action

`POST /risk/assess`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/risk/assess`
- Auth: HTTP bearer

Compute an individual risk assessment for an agent about to take an action. Requires JWT auth and the `risk_assessment` feature flag on the caller's plan. Dispatches a ZK proof request asynchronously (best-effort; check `/risk/proofs/{proof_id}` to retrieve). Cached for 5 minutes per `{agent_id, action_type, risk_tolerance, amount}` tuple. An agent whose reputation is private can be assessed only by a member of its governing org (403 `reputation_private` otherwise); a tombstoned agent returns 404.

## Request body

- object
  - `agent_id` string, required
  - `source` 'api' | 'playground'
  - `context` object, required
    - `action_type` 'financial_transaction' | 'data_access' | 'task_delegation' | 'tool_invocation' | 'autonomous_operation' | 'multi_agent_coordination', required
    - `amount` number
    - `counterparty_id` string
    - `use_case` string
    - `risk_tolerance` 'conservative' | 'moderate' | 'aggressive'

## Response `200`

Risk assessment.

- RiskAssessment: Individual risk assessment row (`ra-…`). Produced by `POST /risk/assess`.
  - `assessment_id` string
  - `agent_id` string
  - `risk_score` number: 0–1000 integer (higher = riskier).
  - `risk_level` 'low' | 'moderate' | 'high' | 'critical'
  - `recommendation` 'proceed' | 'proceed_with_caveats' | 'require_approval' | 'block'
  - `confidence` 'insufficient' | 'low' | 'medium' | 'high'
  - `contributing_factors` object[]
  - `suggested_thresholds` object
  - `explanation` string
  - `proof_id` string, nullable
  - `proof_status` 'none' | 'pending' | 'completed' | 'failed'
  - `created_at` string, date-time

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `402`: Paid feature gate — the caller's plan doesn't include this operation's feature flag. Emitted by `requireFeature` / `requireEntitlement` in `src/org/rbac.ts`.
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `503`: An upstream dependency is currently unavailable. The request was not processed; retry after the cooldown window.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)