Preview

List payment risk assessments

GET
/providers/{providerID}/payments/{paymentID}/risk-assessments

List the risk assessments for one payment, ordered by assessment time and then assessment ID. This response contains no device observations.

Returns an empty list when the payment has no assessments. Returns 404 when the payment belongs to another provider or does not exist.

Pagination is cursor-based. Omit cursor to fetch the first page. Use nextCursor from each response to fetch the next page. The cursor is bound to this provider and this payment.

Auth: API key or bearer token. Scoped to the calling provider.

Request
cURL
curl -X GET https://api.moov.money/providers/{providerID}/payments/{paymentID}/risk-assessments \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403 404
The request completed successfully.
{
  "assessments": [
    {
      "assessedOn": "2026-10-06T15:00:00Z",
      "assessmentID": "ras_01HF5J9ZKQT4RXP8M2VYBN3D",
      "customerEvidence": {
        "signals": [
          {
            "key": "addressRiskLevel",
            "value": "low"
          }
        ]
      },
      "decision": "allow",
      "level": "low",
      "participantID": "3v2whagmwvbujhwbt7v3nl6ffq_user",
      "paymentID": "pay_01HF5J9ZKQT4RXP8M2VYBN3D",
      "reviewIDs": [
        "prv_01HF5J9ZKQT4RXP8M2VYBN3D"
      ],
      "score": 0,
      "transactionEvidence": {
        "amlLevel": "low",
        "level": "low"
      }
    }
  ]
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

paymentID

string required
Payout ID or request ID.

Query parameters

cursor

string
Opaque pagination cursor from a previous response’s nextCursor. Omit to fetch the first page.

limit

integer <int32>
Maximum number of assessments to return. Defaults to 25. Values outside 1-100 return 400.

Response

Response envelope for a payment’s risk assessments.

assessments

array<object> required
This page of assessments, ordered by assessment time and then assessment ID.
Show child attributes

assessments[]

assessmentID

string required
Unique system-assigned assessment identifier.

participantID

string
Participant this assessment is about. Omitted when the subject is unknown.

paymentID

string
Payment this assessment is about. Omitted when the assessment has no payment.

assessedOn

string<date-time> required
When the assessment was recorded.

decision

string<enum> required
Recorded decision.
Possible values: allow, review, deny

level

string<enum>
Recorded level. Omitted when no level was recorded.
Possible values: low, medium, high, very_high

score

number<double>
Recorded score from 0 to 100. A recorded zero is a real score. Omitted when no score was recorded.

reasons

array<string>
Recorded reasons for the decision. Omitted when none were recorded.

customerEvidence

object
Customer signals recorded for this assessment.
Show child attributes

assessments[].customerEvidence

signals

array<object> required
Recorded customer signals.
Show child attributes

assessments[].customerEvidence.signals[]

key

string<enum> required
Signal name from the published set.
Possible values: addressRiskLevel, emailDomainLevel, emailLevel, pepLevel, phoneLevel, sanctionLevel

value

string<enum> required
Recorded level for this signal.
Possible values: low, medium, high, very_high, unknown

transactionEvidence

object
Transaction level and AML level recorded for this assessment.
Show child attributes

assessments[].transactionEvidence

level

string<enum>
Recorded transaction level. Omitted when it was not recorded.
Possible values: low, medium, high, very_high, unknown

amlLevel

string<enum>
Recorded AML level. Omitted when it was not recorded.
Possible values: low, medium, high, very_high, unknown

rules

array<object>
Rules returned with this assessment. Omitted when no rules were returned.
Show child attributes

assessments[].rules[]

ruleID

integer<int32> required
Rule identifier.

name

string required
Rule name.

isLive

boolean required
Whether the rule was live when it was returned.

isAllowlisted

boolean required
Whether the rule was on the allowlist when it was returned.

reviewIDs

array<string>
Reviews linked to this assessment that belong to your provider. Omitted when none are linked.

nextCursor

string
Opaque cursor for the next page. Absent on the last page.

hasMore

boolean required
Whether another page of results follows this one.