# Get a risk review > The risk.reviews.get operation: GET /api/v1/risk/reviews/{id} in the REST API and the risk_reviews_get tool in the MCP server. One held payment of the review queue: its risk evaluation (the decision, the score, every reason and the signals the rules used: the email's domain, the truncated IP network, the IP, billing and card countries, the card's fingerprint), the payment and customer, and the review (pending, approved or rejected, by whom, the refund and blocklist entries of a rejection, the wallets the hold froze). An evaluation that held nothing is `risk_evaluation_not_held`: read it with `risk.evaluations.get`. ## At a glance - **REST:** `GET /api/v1/risk/reviews/{id}` - **MCP tool:** `risk_reviews_get` - **Operation ID:** `risk.reviews.get` - **Scope:** Brand - **Permission:** `customers:read` - **Risk tier:** `read` - **Dry run:** Not supported - **Idempotency:** Not needed (read only) - **Modes:** Test and live - **Authentication:** API key with the `customers:read` scope - **Since:** M9 ## Request ### Path parameters | Field | Type | Description | | ----- | ---------- | ----------- | | `id` | `rsk_…` ID | | ### Query parameters This operation takes no query parameters. ## Response `200 OK` with a JSON object: | Field | Type | Description | | --------------------------- | --------------------------------------------------------------------------------------------------------------- | ----------- | | `id` | `rsk_…` ID | | | `object` | `"risk_evaluation"` | | | `livemode` | boolean | | | `brandId` | `brd_…` ID | | | `subject` | object | | | `subject.type` | one of `checkout_session`, `auto_reload` | | | `subject.checkoutSessionId` | `cs_…` ID or null | | | `subject.walletId` | `wal_…` ID or null | | | `customerId` | `cus_…` ID or null | | | `paymentId` | `pay_…` ID or null | | | `stage` | one of `intent`, `payment_method`, `confirm`, `off_session` | | | `decision` | one of `allow`, `require_3ds`, `review`, `block` | | | `score` | integer | | | `reasons` | array of object | | | `reasons[].code` | one of 21 values, e.g. `customer_blocked`, `customer_elevated`, `blocklist_email` (all in the OpenAPI document) | | | `reasons[].action` | one of `block`, `review`, `require_3ds`, `score` | | | `reasons[].points` | integer or null | | | `reasons[].detail` | string | | | `signals` | object | | | `signals.emailDomain` | string or null | | | `signals.ipNetwork` | string or null | | | `signals.ipCountry` | string or null | | | `signals.billingCountry` | string or null | | | `signals.cardCountry` | string or null | | | `signals.cardFingerprint` | string or null | | | `signals.amount` | money or null | | | `signals.topup` | boolean | | | `signals.newCustomer` | boolean | | | `signals.firstPayment` | boolean | | | `signals.disposableEmail` | boolean | | | `history` | array of object | | | `history[].at` | date-time | | | `history[].stage` | one of `intent`, `payment_method`, `confirm`, `off_session` | | | `history[].decision` | one of `allow`, `require_3ds`, `review`, `block` | | | `history[].score` | integer | | | `review` | object or null | | | `createdAt` | date-time | | | `updatedAt` | date-time | | ## Examples ### A held first top-up ```http GET /api/v1/risk/reviews/rsk_01m4ttwd3veh9apbewxheq5xr1 Authorization: Bearer or_test_… ``` Response (`200`): ```json { "id": "rsk_01m4ttwd3veh9apbewxheq5xr1", "object": "risk_evaluation", "livemode": true, "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5", "subject": { "type": "checkout_session", "checkoutSessionId": "cs_01m4ttwd3veh9apbewxheq5xr4", "walletId": null }, "customerId": "cus_01m4ttwd3veh9apbewxheq5xr5", "paymentId": "pay_01m4ttwd3veh9apbewxheq5xr6", "stage": "confirm", "decision": "review", "score": 70, "reasons": [ { "code": "first_payment", "action": "require_3ds", "points": null, "detail": "The customer's first payment." }, { "code": "new_customer", "action": "score", "points": 10, "detail": "A new customer." }, { "code": "country_mismatch_ip_billing", "action": "score", "points": 20, "detail": "IP country DE isn't the billing country HR." }, { "code": "country_mismatch_card_billing", "action": "score", "points": 25, "detail": "Card country US isn't the billing country HR." }, { "code": "country_mismatch_ip_card", "action": "score", "points": 15, "detail": "IP country DE isn't the card country US." }, { "code": "score_review", "action": "review", "points": null, "detail": "Score 70 ≥ 70." } ], "signals": { "emailDomain": "corp.example", "ipNetwork": "203.0.113.0", "ipCountry": "DE", "billingCountry": "HR", "cardCountry": "US", "cardFingerprint": "Xo1abC9dEf2GhI3j", "amount": { "amount": "90000000", "currency": "EUR" }, "topup": true, "newCustomer": true, "firstPayment": true, "disposableEmail": false }, "history": [ { "at": "2026-10-20T09:00:00.000Z", "stage": "intent", "decision": "require_3ds", "score": 30 }, { "at": "2026-10-20T09:01:00.000Z", "stage": "payment_method", "decision": "review", "score": 70 }, { "at": "2026-10-20T09:01:30.000Z", "stage": "confirm", "decision": "review", "score": 70 } ], "review": { "status": "pending", "openedAt": "2026-10-20T09:02:00.000Z", "decidedAt": null, "decidedBy": null, "note": null, "refundId": null, "blocklistEntryIds": [], "frozenWalletIds": ["wal_01m4ttwd3veh9apbewxheq5xr7"] }, "createdAt": "2026-10-20T09:00:00.000Z", "updatedAt": "2026-10-20T09:02:00.000Z" } ``` ## Errors | Code | HTTP status | When | What to do | | ---------------------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404 | No risk evaluation with this ID in this brand and mode. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. | | [`risk_evaluation_not_held`](https://ownrecord.io/docs/reference/errors.md#risk_evaluation_not_held) | 400 | The evaluation held no payment for review. | Only payments the risk rules held are in the review queue (`risk.reviews.list`). Refund other payments with `refunds.create`. | | [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403 | You can't see this brand's customers. | Ask an organization owner or admin for a role or scope that allows this action. | It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed), [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`scope_required`](https://ownrecord.io/docs/reference/errors.md#scope_required), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).