> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.middesk.com/api-reference/risk-assessments/get-latest-risk-assessment/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.middesk.com/_mcp/server.

# Retrieve the latest scored risk assessment for a business

GET https://api.middesk.com/v1/businesses/{business_id}/risk_assessments/latest

Reference: https://docs.middesk.com/api-reference/risk-assessments/get-latest-risk-assessment

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Path parameters

- `business_id` (string, required) — Business ID

## Response

### 200

latest risk assessment

- `business_snapshot_url` (string, required, nullable) — URL of the business as of this assessment's order (`GET /businesses/{id}?order_id={order_id}`), resolving to the per-order snapshot to compare against the assessment's results. Null for assessments not tied to an order.
- `created_at` (datetime, required)
- `description_markdown` (string, required, nullable) — Narrative explanation of the assessment, in CommonMark markdown. Null on assessments recorded before markdown narratives shipped.
- `dimensions` (list of RiskDimension, required) — Per-dimension risk scores with their top contributing factors.
- `id` (string, required)
- `level` (enum, required) — Categorical risk verdict. `not_available` means a Risk order ran but could not produce a conclusive verdict. New values are not expected; `level` is a closed set.
  - Allowed values: `low`, `moderate`, `high`, `not_available`
- `object` (enum, required)
  - Allowed values: `risk_assessment`
- `order_id` (string, required, nullable) — The order this assessment was produced against — the snapshot coordinate. Fetch the business as of this order with `GET /businesses/{id}?order_id={order_id}` to compare the assessment against the underlying record. Null for assessments not tied to an order.
- `score` (integer, required, nullable) — Overall risk score from 0 (lowest risk) to 100 (highest risk); `level` is banded from it. Null when the assessment could not be scored. Note the scale — the top-level score is a 0–100 integer, while nested dimension and identifier-assessment scores are 0–1 floats.
- `title` (string, required, nullable) — One-line headline synthesizing the assessment. Null on assessments produced before titles shipped.

## Errors

### 403 Get Latest Risk Assessment Request Forbidden Error

account is not entitled to risk

- `errors` (list of ErrorResponseErrorsItem, required)

### 404 Get Latest Risk Assessment Request Not Found Error

no risk assessment for this business

- `errors` (list of ErrorResponseErrorsItem, required)

## Types

### RiskDimension

A score for one dimension of merchant risk, with the measured facts that contributed most to it.

- `object` (enum, required)
  - Allowed values: `risk_dimension`
- `type` (string, required) — The dimension of risk being scored (e.g. `transaction_laundering`, `reputational`). Not a closed set — new dimensions may be added, so clients should tolerate unknown values.
- `score` (double, required) — Dimension risk score from 0 (lowest risk) to 1 (highest risk). Unlike the assessment's top-level 0–100 integer `score`, nested scores are 0–1 floats.
- `level` (enum, required) — Categorical band of this dimension's `score`, on the same scale as the assessment's `level`.
  - Allowed values: `low`, `moderate`, `high`, `not_available`
- `top_factors` (list of RiskDimensionTopFactorsItem, required) — The measured facts that contributed most to this dimension's score, ranked by absolute contribution. Factor names are stable snake_case identifiers from a broader vocabulary than identifier-assessment attributes: website-content facts (e.g. `website_has_no_refund_language`) appear alongside identifier facts (e.g. `url_domain_parked`). Not a closed set.

### ErrorResponseErrorsItem

- `message` (string, required)
- `parameter` (string, optional) — Request parameter associated with the error, when applicable

### RiskDimensionTopFactorsItem

- `name` (string, required) — Stable factor name (e.g. `website_has_no_refund_language`, `url_domain_parked`).
- `type` (string, required) — JSON type of `value`. Typically `boolean`, `integer`, or `double`; not a closed set.
- `value` (any, required)
- `contribution` (double, required) — Signed share of this factor's contribution to the dimension score; larger absolute values contributed more.

## Examples

**Response**

```json
{
  "business_snapshot_url": "https://api.middesk.com/v1/businesses/0793f2a2-e315-4b6a-9f0c-2d1e3c4b5a69?order_id=a58a4f4e-7f3b-4c8e-9d2a-1b0c9d8e7f6a",
  "created_at": "2026-07-21T18:03:11Z",
  "description_markdown": "Acme Home Goods presents as a small home furnishings retailer, but its storefront shows several traits common to laundering fronts.\n\n- The checkout flow displays no-refund language ([acmehomegoods.com/checkout](https://acmehomegoods.com/checkout))\n- The product catalog reuses stock imagery found on unrelated storefronts ([acmehomegoods.com/shop](https://acmehomegoods.com/shop))",
  "dimensions": [
    {
      "object": "risk_dimension",
      "type": "transaction_laundering",
      "score": 0.72,
      "level": "high",
      "top_factors": [
        {
          "name": "website_has_no_refund_language",
          "type": "boolean",
          "value": true,
          "contribution": 0.28
        },
        {
          "name": "url_risk_score",
          "type": "double",
          "value": 0,
          "contribution": -0.17
        }
      ]
    }
  ],
  "id": "5f8c9d0e-1a2b-4c3d-8e9f-6a7b8c9d0e1f",
  "level": "high",
  "object": "risk_assessment",
  "order_id": "a58a4f4e-7f3b-4c8e-9d2a-1b0c9d8e7f6a",
  "score": 68,
  "title": "Likely transaction laundering: the storefront cannot support its stated sales volume."
}
```

**SDK Code**

```python Risk assessment
import requests

url = "https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript Risk assessment
const url = 'https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Risk assessment
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Risk assessment
require 'uri'
require 'net/http'

url = URI("https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Risk assessment
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Risk assessment
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Risk assessment
using RestSharp;

var client = new RestClient("https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Risk assessment
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.middesk.com/v1/businesses/business_id/risk_assessments/latest")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```