Get a risk evaluation · Ownrecord docs

One payment attempt's risk evaluation: the decision and score, every reason (which rule, what it asked for, its points, in plain words), the signals the rules used (the email's domain, the truncated IP network, the IP, billing and card countries, the card's fingerprint, the amount, whether the customer was new) and every run of the rules. When the payment was held, review says how the review went.

At a glance

REST: GET /api/v1/risk/evaluations/{id}
MCP tool: risk_evaluations_get
Operation ID: risk.evaluations.get
Scope: Brand
Permission: payments:read
Risk tier: read
Dry run: Not supported
Idempotency: Not needed (read only)
Modes: Test and live
Authentication: API key with the payments:read scope
Since: M9

Request

Path parameters

Field	Type	Description
`id`	`rsk_…` ID

Query parameters

This operation takes no query parameters.

Response

200 OK with a JSON object:

Field	Type	Description
`id`	`rsk_…` ID
`object`	`"risk_evaluation"`
`livemode`	boolean
`brandId`	`brd_…` ID
`subject`	object
`subject.type`	one of `checkout_session`, `auto_reload`
`subject.checkoutSessionId`	`cs_…` ID or null
`subject.walletId`	`wal_…` ID or null
`customerId`	`cus_…` ID or null
`paymentId`	`pay_…` ID or null
`stage`	one of `intent`, `payment_method`, `confirm`, `off_session`
`decision`	one of `allow`, `require_3ds`, `review`, `block`
`score`	integer
`reasons`	array of object
`reasons[].code`	one of 21 values, e.g. `customer_blocked`, `customer_elevated`, `blocklist_email` (all in the OpenAPI document)
`reasons[].action`	one of `block`, `review`, `require_3ds`, `score`
`reasons[].points`	integer or null
`reasons[].detail`	string
`signals`	object
`signals.emailDomain`	string or null
`signals.ipNetwork`	string or null
`signals.ipCountry`	string or null
`signals.billingCountry`	string or null
`signals.cardCountry`	string or null
`signals.cardFingerprint`	string or null
`signals.amount`	money or null
`signals.topup`	boolean
`signals.newCustomer`	boolean
`signals.firstPayment`	boolean
`signals.disposableEmail`	boolean
`history`	array of object
`history[].at`	date-time
`history[].stage`	one of `intent`, `payment_method`, `confirm`, `off_session`
`history[].decision`	one of `allow`, `require_3ds`, `review`, `block`
`history[].score`	integer
`review`	object or null
`createdAt`	date-time
`updatedAt`	date-time

Examples

A held first top-up

HTTP

GET /api/v1/risk/evaluations/rsk_01m4ttwd3veh9apbewxheq5xr1
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "id": "rsk_01m4ttwd3veh9apbewxheq5xr1",
  "object": "risk_evaluation",
  "livemode": true,
  "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5",
  "subject": {
    "type": "checkout_session",
    "checkoutSessionId": "cs_01m4ttwd3veh9apbewxheq5xr4",
    "walletId": null
  },
  "customerId": "cus_01m4ttwd3veh9apbewxheq5xr5",
  "paymentId": "pay_01m4ttwd3veh9apbewxheq5xr6",
  "stage": "confirm",
  "decision": "review",
  "score": 70,
  "reasons": [
    {
      "code": "first_payment",
      "action": "require_3ds",
      "points": null,
      "detail": "The customer's first payment."
    },
    {
      "code": "new_customer",
      "action": "score",
      "points": 10,
      "detail": "A new customer."
    },
    {
      "code": "country_mismatch_ip_billing",
      "action": "score",
      "points": 20,
      "detail": "IP country DE isn't the billing country HR."
    },
    {
      "code": "country_mismatch_card_billing",
      "action": "score",
      "points": 25,
      "detail": "Card country US isn't the billing country HR."
    },
    {
      "code": "country_mismatch_ip_card",
      "action": "score",
      "points": 15,
      "detail": "IP country DE isn't the card country US."
    },
    {
      "code": "score_review",
      "action": "review",
      "points": null,
      "detail": "Score 70 ≥ 70."
    }
  ],
  "signals": {
    "emailDomain": "corp.example",
    "ipNetwork": "203.0.113.0",
    "ipCountry": "DE",
    "billingCountry": "HR",
    "cardCountry": "US",
    "cardFingerprint": "Xo1abC9dEf2GhI3j",
    "amount": {
      "amount": "90000000",
      "currency": "EUR"
    },
    "topup": true,
    "newCustomer": true,
    "firstPayment": true,
    "disposableEmail": false
  },
  "history": [
    {
      "at": "2026-10-20T09:00:00.000Z",
      "stage": "intent",
      "decision": "require_3ds",
      "score": 30
    },
    {
      "at": "2026-10-20T09:01:00.000Z",
      "stage": "payment_method",
      "decision": "review",
      "score": 70
    },
    {
      "at": "2026-10-20T09:01:30.000Z",
      "stage": "confirm",
      "decision": "review",
      "score": 70
    }
  ],
  "review": {
    "status": "pending",
    "openedAt": "2026-10-20T09:02:00.000Z",
    "decidedAt": null,
    "decidedBy": null,
    "note": null,
    "refundId": null,
    "blocklistEntryIds": [],
    "frozenWalletIds": ["wal_01m4ttwd3veh9apbewxheq5xr7"]
  },
  "createdAt": "2026-10-20T09:00:00.000Z",
  "updatedAt": "2026-10-20T09:02:00.000Z"
}

Errors

Code	HTTP status	When	What to do
`resource_not_found`	404	No risk evaluation with this ID in this brand and mode.	Check the ID and that your credentials are scoped to the right organization, entity, brand and mode.
`permission_denied`	403	You can't see this brand's payments.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: validation_failed, api_version_unsupported, authentication_required, api_key_invalid, scope_required, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Path parameters#

Query parameters#

Response#

Examples#

A held first top-up#

Errors#