> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.middesk.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.middesk.com/_mcp/server.

# Assess business risk

> Order Middesk Risk to get a scored risk assessment and enriched, source-attributed data about a business

Middesk Risk is a web-native risk analysis of a business. A Risk order studies the business's website, third-party profiles, and other public web footprint, then produces a scored risk assessment along with enriched, source-attributed data on the Business record.

Risk is built for fraud and risk teams at payment processors, platforms, marketplaces, and fintechs that need to evaluate a business beyond its registration records.

## How the Risk order works

Order Risk when you create a business by including `orders: [{ "product": "risk" }]` in the request, or order it on an existing business with `POST /businesses/{business_id}/orders`. Risk can be combined with a Verify order on the same business, so a single submission returns both KYB results and a risk assessment.

### Required inputs

A Risk order accepts three input combinations:

| You submit                     | What Middesk does                                                                            |
| ------------------------------ | -------------------------------------------------------------------------------------------- |
| Website URL only               | Crawls and scores the submitted website directly.                                            |
| Business name and address only | Attempts to discover the business's website before assessing the business.                   |
| Both                           | Scores the submitted website, anchored to the business identity. The most complete analysis. |

A request with none of these is rejected.

> **Note**
>
> If you combine a Risk order with other order types (such as `business_verification_verify`), the name and address may still be required by those other orders.

**`Create a business with a Risk order`**

```bash title="Create a business with a Risk order"
curl -X POST https://api.middesk.com/v1/businesses \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corporation",
    "website": {
      "url": "https://www.acmecorp.com"
    },
    "addresses": [
      {
        "address_line1": "123 Main Street",
        "city": "San Francisco",
        "state": "CA",
        "postal_code": "94105"
      }
    ],
    "orders": [
      { "product": "risk" }
    ]
  }'
```

A completed Risk order writes to the business:

* Web-sourced names, people, addresses, email addresses, and phone numbers, each carrying a `sources[]` array that attributes where Middesk found it
* A website analysis of the business's site
* Third-party profiles discovered for the business
* [Risky keyword](/online-presence/risky-keywords) results from website and profile content
* [Industry classification](/online-presence/industry-classification) with card network program flags
* The top-level risk verdict

## Retrieving risk results

Risk results land in two places. The business carries a top-level `risk` verdict, and the full scored assessment lives on the Risk Assessments API.

#### Configure webhooks

Subscribe to the `business.updated` event so Middesk can notify you when a Risk order completes. See [Implement webhooks](/build/webhooks) to set up an endpoint.

#### Create a business with a Risk order

Submit the business with a `risk` order, as shown above.

#### Receive the verdict

When the order completes, Middesk sends a `business.updated` event. The business in `data.object` carries the `risk` verdict.

**`business.updated payload, trimmed to the risk verdict`**

```json title="business.updated payload, trimmed to the risk verdict"
{
  "object": "event",
  "id": "c8f1a4d2-9b03-4e57-8a61-2d4f7c9e1b30",
  "account_id": "884ff296-3b9d-41e7-ba0a-7fb236c34c1d",
  "type": "business.updated",
  "data": {
    "object": {
      "object": "business",
      "id": "0793f2a2-e315-4b6a-9f0c-2d1e3c4b5a69",
      "name": "Acme Corporation",
      "risk": {
        "object": "risk",
        "level": "high",
        "latest_assessment_id": "5f8c9d0e-1a2b-4c3d-8e9f-6a7b8c9d0e1f"
      }
    }
  },
  "created_at": "2026-07-21T18:03:11.402Z"
}
```

#### Fetch the full assessment

The verdict tells you the outcome, not the reasoning. Use `latest_assessment_id` to retrieve the scored assessment with its dimensions and identifier assessments.

**`Get the assessment behind the verdict`**

```bash title="Get the assessment behind the verdict"
curl https://api.middesk.com/v1/businesses/0793f2a2-e315-4b6a-9f0c-2d1e3c4b5a69/risk_assessments/5f8c9d0e-1a2b-4c3d-8e9f-6a7b8c9d0e1f \
  -H "Authorization: Bearer YOUR_API_KEY"
```

> **Note**
>
> Webhook payloads carry the `risk` verdict only. Dimensions and identifier assessments are available on the [Risk Assessments API](/business-risk/risk-assessments) and not in the webhook, so reading them always takes a follow-up request.

To poll instead of receiving webhooks, `GET /v1/businesses/{business_id}` returns the same `risk` verdict.

### Reading the verdict

`level` is one of `low`, `moderate`, `high`, or `not_available`. This set is closed, so you can build decisioning logic against it directly. `not_available` means a Risk order ran but could not produce a conclusive verdict. `latest_assessment_id` always points at the newest scored assessment for the business.

## Next steps

#### [Get a risk assessment](/business-risk/risk-assessments)

Retrieve the full scored assessment behind the verdict.

#### [Assess identifier risk](/business-risk/identifier-risk)

Read per-resource assessments for email addresses, phone numbers, and the website URL.

#### [Understand risk dimensions](/business-risk/dimensions)

Interpret business-level scored dimensions and their top factors.

> **Get a demo**
>
> Contact your account manager or [contact sales](https://www.middesk.com/contact-sales) to inquire about access.