Assess business risk

Middesk Risk is a web-native risk analysis of a business. A Risk order studies the business’s website, third-party profiles, and other public web footprint, then produces a scored risk assessment along with enriched, source-attributed data on the Business record.

Risk is built for fraud and risk teams at payment processors, platforms, marketplaces, and fintechs that need to evaluate a business beyond its registration records.

How the Risk order works

Order Risk when you create a business by including orders: [{ "product": "risk" }] in the request, or order it on an existing business with POST /businesses/{business_id}/orders. Risk can be combined with a Verify order on the same business, so a single submission returns both KYB results and a risk assessment.

Required inputs

A Risk order accepts three input combinations:

You submitWhat Middesk does
Website URL onlyCrawls and scores the submitted website directly.
Business name and address onlyAttempts to discover the business’s website before assessing the business.
BothScores the submitted website, anchored to the business identity. The most complete analysis.

A request with none of these is rejected.

If you combine a Risk order with other order types (such as business_verification_verify), the name and address may still be required by those other orders.
Create a business with a Risk order
$curl -X POST https://api.middesk.com/v1/businesses \
>  -H "Authorization: Bearer YOUR_API_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{
>    "name": "Acme Corporation",
>    "website": {
>      "url": "https://www.acmecorp.com"
>    },
>    "addresses": [
>      {
>        "address_line1": "123 Main Street",
>        "city": "San Francisco",
>        "state": "CA",
>        "postal_code": "94105"
>      }
>    ],
>    "orders": [
>      { "product": "risk" }
>    ]
>  }'

A completed Risk order writes to the business:

  • Web-sourced names, people, addresses, email addresses, and phone numbers, each carrying a sources[] array that attributes where Middesk found it
  • A website analysis of the business’s site
  • Third-party profiles discovered for the business
  • Risky keyword results from website and profile content
  • Industry classification with card network program flags
  • The top-level risk verdict

Retrieving risk results

Risk results land in two places. The business carries a top-level risk verdict, and the full scored assessment lives on the Risk Assessments API.

1

Configure webhooks

Subscribe to the business.updated event so Middesk can notify you when a Risk order completes. See Implement webhooks to set up an endpoint.

2

Create a business with a Risk order

Submit the business with a risk order, as shown above.

3

Receive the verdict

When the order completes, Middesk sends a business.updated event. The business in data.object carries the risk verdict.

business.updated payload, trimmed to the risk verdict
1{
2  "object": "event",
3  "id": "c8f1a4d2-9b03-4e57-8a61-2d4f7c9e1b30",
4  "account_id": "884ff296-3b9d-41e7-ba0a-7fb236c34c1d",
5  "type": "business.updated",
6  "data": {
7    "object": {
8      "object": "business",
9      "id": "0793f2a2-e315-4b6a-9f0c-2d1e3c4b5a69",
10      "name": "Acme Corporation",
11      "risk": {
12        "object": "risk",
13        "level": "high",
14        "latest_assessment_id": "5f8c9d0e-1a2b-4c3d-8e9f-6a7b8c9d0e1f"
15      }
16    }
17  },
18  "created_at": "2026-07-21T18:03:11.402Z"
19}
4

Fetch the full assessment

The verdict tells you the outcome, not the reasoning. Use latest_assessment_id to retrieve the scored assessment with its dimensions and identifier assessments.

Get the assessment behind the verdict
$curl https://api.middesk.com/v1/businesses/0793f2a2-e315-4b6a-9f0c-2d1e3c4b5a69/risk_assessments/5f8c9d0e-1a2b-4c3d-8e9f-6a7b8c9d0e1f \
>  -H "Authorization: Bearer YOUR_API_KEY"

Webhook payloads carry the risk verdict only. Dimensions and identifier assessments are available on the Risk Assessments API and not in the webhook, so reading them always takes a follow-up request.

To poll instead of receiving webhooks, GET /v1/businesses/{business_id} returns the same risk verdict.

Reading the verdict

level is one of low, moderate, high, or not_available. This set is closed, so you can build decisioning logic against it directly. not_available means a Risk order ran but could not produce a conclusive verdict. latest_assessment_id always points at the newest scored assessment for the business.

Next steps

Get a risk assessment

Retrieve the full scored assessment behind the verdict.

Assess identifier risk

Read per-resource assessments for email addresses, phone numbers, and the website URL.

Understand risk dimensions

Interpret business-level scored dimensions and their top factors.

Get a demo
Contact your account manager or contact sales to inquire about access.