# List risk reviews > The risk.reviews.list operation: GET /api/v1/risk/reviews in the REST API and the risk_reviews_list tool in the MCP server. The brand's risk review queue in the mode of the request, newest first: payments the risk rules held. A held payment went through and is invoiced; the customer's wallet that took its credits is frozen until someone approves it (`risk.reviews.approve`) or refunds it and blocks the customer (`risk.reviews.reject`). Each review is the payment's risk evaluation: the decision, the score and every reason. `status` is `pending` by default; `approved` and `rejected` list the decided ones. Paginate with `limit` (1–100, default 10) and `starting_after`. ## At a glance - **REST:** `GET /api/v1/risk/reviews` - **MCP tool:** `risk_reviews_list` - **Operation ID:** `risk.reviews.list` - **Scope:** Brand - **Permission:** `customers:read` - **Risk tier:** `read` - **Dry run:** Not supported - **Idempotency:** Not needed (read only) - **Modes:** Test and live - **Pagination:** `limit` (at most 100) and `starting_after` - **Authentication:** API key with the `customers:read` scope - **Since:** M9 ## Request ### Query parameters | Field | Type | Required | Description | | ---------------- | ---------------------------------------- | -------- | --------------------------------------- | | `status` | one of `pending`, `approved`, `rejected` | No | Default `pending`: the queue. | | `customerId` | `cus_…` ID | No | Reviews of one customer (`cus_…`). | | `limit` | integer (1 to 100) | No | | | `starting_after` | `rsk_…` ID | No | The `next_cursor` of the previous page. | ## Response `200 OK` with a JSON object, a page of the list (newest first): | Field | Type | Description | | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- | ----------- | | `object` | `"list"` | | | `data` | array of object | | | `data[].id` | `rsk_…` ID | | | `data[].object` | `"risk_evaluation"` | | | `data[].livemode` | boolean | | | `data[].brandId` | `brd_…` ID | | | `data[].subject` | object | | | `data[].subject.type` | one of `checkout_session`, `auto_reload` | | | `data[].subject.checkoutSessionId` | `cs_…` ID or null | | | `data[].subject.walletId` | `wal_…` ID or null | | | `data[].customerId` | `cus_…` ID or null | | | `data[].paymentId` | `pay_…` ID or null | | | `data[].stage` | one of `intent`, `payment_method`, `confirm`, `off_session` | | | `data[].decision` | one of `allow`, `require_3ds`, `review`, `block` | | | `data[].score` | integer | | | `data[].reasons` | array of object | | | `data[].reasons[].code` | one of 21 values, e.g. `customer_blocked`, `customer_elevated`, `blocklist_email` (all in the OpenAPI document) | | | `data[].reasons[].action` | one of `block`, `review`, `require_3ds`, `score` | | | `data[].reasons[].points` | integer or null | | | `data[].reasons[].detail` | string | | | `data[].signals` | object | | | `data[].signals.emailDomain` | string or null | | | `data[].signals.ipNetwork` | string or null | | | `data[].signals.ipCountry` | string or null | | | `data[].signals.billingCountry` | string or null | | | `data[].signals.cardCountry` | string or null | | | `data[].signals.cardFingerprint` | string or null | | | `data[].signals.amount` | money or null | | | `data[].signals.topup` | boolean | | | `data[].signals.newCustomer` | boolean | | | `data[].signals.firstPayment` | boolean | | | `data[].signals.disposableEmail` | boolean | | | `data[].history` | array of object | | | `data[].history[].at` | date-time | | | `data[].history[].stage` | one of `intent`, `payment_method`, `confirm`, `off_session` | | | `data[].history[].decision` | one of `allow`, `require_3ds`, `review`, `block` | | | `data[].history[].score` | integer | | | `data[].review` | object or null | | | `data[].createdAt` | date-time | | | `data[].updatedAt` | date-time | | | `has_more` | boolean | | | `next_cursor` | `rsk_…` ID or null | | ## Examples ### The queue ```http GET /api/v1/risk/reviews Authorization: Bearer or_test_… ``` Response (`200`): ```json { "object": "list", "data": [ { "id": "rsk_01m4ttwd3veh9apbewxheq5xr1", "object": "risk_evaluation", "livemode": true, "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5", "subject": { "type": "checkout_session", "checkoutSessionId": "cs_01m4ttwd3veh9apbewxheq5xr4", "walletId": null }, "customerId": "cus_01m4ttwd3veh9apbewxheq5xr5", "paymentId": "pay_01m4ttwd3veh9apbewxheq5xr6", "stage": "confirm", "decision": "review", "score": 70, "reasons": [ { "code": "first_payment", "action": "require_3ds", "points": null, "detail": "The customer's first payment." }, { "code": "new_customer", "action": "score", "points": 10, "detail": "A new customer." }, { "code": "country_mismatch_ip_billing", "action": "score", "points": 20, "detail": "IP country DE isn't the billing country HR." }, { "code": "country_mismatch_card_billing", "action": "score", "points": 25, "detail": "Card country US isn't the billing country HR." }, { "code": "country_mismatch_ip_card", "action": "score", "points": 15, "detail": "IP country DE isn't the card country US." }, { "code": "score_review", "action": "review", "points": null, "detail": "Score 70 ≥ 70." } ], "signals": { "emailDomain": "corp.example", "ipNetwork": "203.0.113.0", "ipCountry": "DE", "billingCountry": "HR", "cardCountry": "US", "cardFingerprint": "Xo1abC9dEf2GhI3j", "amount": { "amount": "90000000", "currency": "EUR" }, "topup": true, "newCustomer": true, "firstPayment": true, "disposableEmail": false }, "history": [ { "at": "2026-10-20T09:00:00.000Z", "stage": "intent", "decision": "require_3ds", "score": 30 }, { "at": "2026-10-20T09:01:00.000Z", "stage": "payment_method", "decision": "review", "score": 70 }, { "at": "2026-10-20T09:01:30.000Z", "stage": "confirm", "decision": "review", "score": 70 } ], "review": { "status": "pending", "openedAt": "2026-10-20T09:02:00.000Z", "decidedAt": null, "decidedBy": null, "note": null, "refundId": null, "blocklistEntryIds": [], "frozenWalletIds": ["wal_01m4ttwd3veh9apbewxheq5xr7"] }, "createdAt": "2026-10-20T09:00:00.000Z", "updatedAt": "2026-10-20T09:02:00.000Z" } ], "has_more": false, "next_cursor": null } ``` ## Errors | Code | HTTP status | When | What to do | | -------------------------------------------------------------------------------------- | ----------- | ---------------------------------------- | ------------------------------------------------------------------------------- | | [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed) | 400 | A filter or pagination value is invalid. | Fix the fields listed in `details.issues` and send the request again. | | [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied) | 403 | You can't see this brand's customers. | Ask an organization owner or admin for a role or scope that allows this action. | It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`scope_required`](https://ownrecord.io/docs/reference/errors.md#scope_required), [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).