List risk reviews · Ownrecord docs

The brand's risk review queue in the mode of the request, newest first: payments the risk rules held. A held payment went through and is invoiced; the customer's wallet that took its credits is frozen until someone approves it (risk.reviews.approve) or refunds it and blocks the customer (risk.reviews.reject). Each review is the payment's risk evaluation: the decision, the score and every reason.

status is pending by default; approved and rejected list the decided ones. Paginate with limit (1–100, default 10) and starting_after.

At a glance

REST: GET /api/v1/risk/reviews
MCP tool: risk_reviews_list
Operation ID: risk.reviews.list
Scope: Brand
Permission: customers:read
Risk tier: read
Dry run: Not supported
Idempotency: Not needed (read only)
Modes: Test and live
Pagination: limit (at most 100) and starting_after
Authentication: API key with the customers:read scope
Since: M9

Request

Query parameters

Field	Type	Required	Description
`status`	one of `pending`, `approved`, `rejected`	No	Default `pending`: the queue.
`customerId`	`cus_…` ID	No	Reviews of one customer (`cus_…`).
`limit`	integer (1 to 100)	No
`starting_after`	`rsk_…` ID	No	The `next_cursor` of the previous page.

Response

200 OK with a JSON object, a page of the list (newest first):

Field	Type	Description
`object`	`"list"`
`data`	array of object
`data[].id`	`rsk_…` ID
`data[].object`	`"risk_evaluation"`
`data[].livemode`	boolean
`data[].brandId`	`brd_…` ID
`data[].subject`	object
`data[].subject.type`	one of `checkout_session`, `auto_reload`
`data[].subject.checkoutSessionId`	`cs_…` ID or null
`data[].subject.walletId`	`wal_…` ID or null
`data[].customerId`	`cus_…` ID or null
`data[].paymentId`	`pay_…` ID or null
`data[].stage`	one of `intent`, `payment_method`, `confirm`, `off_session`
`data[].decision`	one of `allow`, `require_3ds`, `review`, `block`
`data[].score`	integer
`data[].reasons`	array of object
`data[].reasons[].code`	one of 21 values, e.g. `customer_blocked`, `customer_elevated`, `blocklist_email` (all in the OpenAPI document)
`data[].reasons[].action`	one of `block`, `review`, `require_3ds`, `score`
`data[].reasons[].points`	integer or null
`data[].reasons[].detail`	string
`data[].signals`	object
`data[].signals.emailDomain`	string or null
`data[].signals.ipNetwork`	string or null
`data[].signals.ipCountry`	string or null
`data[].signals.billingCountry`	string or null
`data[].signals.cardCountry`	string or null
`data[].signals.cardFingerprint`	string or null
`data[].signals.amount`	money or null
`data[].signals.topup`	boolean
`data[].signals.newCustomer`	boolean
`data[].signals.firstPayment`	boolean
`data[].signals.disposableEmail`	boolean
`data[].history`	array of object
`data[].history[].at`	date-time
`data[].history[].stage`	one of `intent`, `payment_method`, `confirm`, `off_session`
`data[].history[].decision`	one of `allow`, `require_3ds`, `review`, `block`
`data[].history[].score`	integer
`data[].review`	object or null
`data[].createdAt`	date-time
`data[].updatedAt`	date-time
`has_more`	boolean
`next_cursor`	`rsk_…` ID or null

Examples

The queue

HTTP

GET /api/v1/risk/reviews
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "object": "list",
  "data": [
    {
      "id": "rsk_01m4ttwd3veh9apbewxheq5xr1",
      "object": "risk_evaluation",
      "livemode": true,
      "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5",
      "subject": {
        "type": "checkout_session",
        "checkoutSessionId": "cs_01m4ttwd3veh9apbewxheq5xr4",
        "walletId": null
      },
      "customerId": "cus_01m4ttwd3veh9apbewxheq5xr5",
      "paymentId": "pay_01m4ttwd3veh9apbewxheq5xr6",
      "stage": "confirm",
      "decision": "review",
      "score": 70,
      "reasons": [
        {
          "code": "first_payment",
          "action": "require_3ds",
          "points": null,
          "detail": "The customer's first payment."
        },
        {
          "code": "new_customer",
          "action": "score",
          "points": 10,
          "detail": "A new customer."
        },
        {
          "code": "country_mismatch_ip_billing",
          "action": "score",
          "points": 20,
          "detail": "IP country DE isn't the billing country HR."
        },
        {
          "code": "country_mismatch_card_billing",
          "action": "score",
          "points": 25,
          "detail": "Card country US isn't the billing country HR."
        },
        {
          "code": "country_mismatch_ip_card",
          "action": "score",
          "points": 15,
          "detail": "IP country DE isn't the card country US."
        },
        {
          "code": "score_review",
          "action": "review",
          "points": null,
          "detail": "Score 70 ≥ 70."
        }
      ],
      "signals": {
        "emailDomain": "corp.example",
        "ipNetwork": "203.0.113.0",
        "ipCountry": "DE",
        "billingCountry": "HR",
        "cardCountry": "US",
        "cardFingerprint": "Xo1abC9dEf2GhI3j",
        "amount": {
          "amount": "90000000",
          "currency": "EUR"
        },
        "topup": true,
        "newCustomer": true,
        "firstPayment": true,
        "disposableEmail": false
      },
      "history": [
        {
          "at": "2026-10-20T09:00:00.000Z",
          "stage": "intent",
          "decision": "require_3ds",
          "score": 30
        },
        {
          "at": "2026-10-20T09:01:00.000Z",
          "stage": "payment_method",
          "decision": "review",
          "score": 70
        },
        {
          "at": "2026-10-20T09:01:30.000Z",
          "stage": "confirm",
          "decision": "review",
          "score": 70
        }
      ],
      "review": {
        "status": "pending",
        "openedAt": "2026-10-20T09:02:00.000Z",
        "decidedAt": null,
        "decidedBy": null,
        "note": null,
        "refundId": null,
        "blocklistEntryIds": [],
        "frozenWalletIds": ["wal_01m4ttwd3veh9apbewxheq5xr7"]
      },
      "createdAt": "2026-10-20T09:00:00.000Z",
      "updatedAt": "2026-10-20T09:02:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Errors

Code	HTTP status	When	What to do
`validation_failed`	400	A filter or pagination value is invalid.	Fix the fields listed in `details.issues` and send the request again.
`permission_denied`	403	You can't see this brand's customers.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: api_version_unsupported, authentication_required, api_key_invalid, scope_required, resource_not_found, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Query parameters#

Response#

Examples#

The queue#

Errors#