# create

URL: /business/nouns/risk/create · Id: `verb:Risk.create` · Call: `await $.Risk.create({ … })` (SDK) or the `do` tool at `https://api.sb/mcp`. Inputs says what to pass, Outputs what returns, When it waits who approves.

> Creates a Risk.

Create makes a new [Risk](/business/nouns/risk) from the inputs below. It is inherited: every [Noun](/business/nouns/noun) has `get`, `list`, `create`, `update` and `delete`.

## Inputs
| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `scope` | `string` | Yes | Whose Risk it is: `startup` or `portfolio`, for exposure shared across siblings. |
| `likelihood` | `integer` | Yes | How likely it is within a year, from 1 (rare) to 5 (expected). |
| `impact` | `integer` | Yes | How much harm it does if it happens, from 1 (minor) to 5 (ends the Startup). |
| `treatment` | `string` | No | The chosen response: `treat`, `accept`, `transfer`, or `avoid`. |
| `owner` | [Role](/business/nouns/role) | Yes | The Role that owns the Risk and its next review. |
| `reviewBy` | `date` | No | When the owner next scores it again. |
| `portfolio` | [Portfolio](/business/nouns/portfolio) | No | Exposure shared across sibling Startups, such as one upstream every sibling relies on. |

## Outputs
| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The Risk. |

## Effects
- Emits `Risk.created`.
- Two-way: `try`, `send`, `do`.

## Refuses when
| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | [Risk.create](/business/nouns/risk/create) |

## When it waits
| Gate | Default |
| --- | --- |
| Decision class | Low: two-way, nothing at stake |
| [Delay window](/systems/trust-and-governance/controls/one-way-windows) | None: it runs once review passes. |
| Limit | The call [Limit](/business/nouns/limit) of the [Permission](/business/nouns/permission) it runs under. |
| Over the Limit | It waits `pending` for an [Approval](/business/nouns/approval) from the [Founder](/agents/founding/founder). Approved, it runs; refused, it ends `refused` with [`limit-exceeded`](/code/api/errors/limit-exceeded); unanswered by its deadline, it ends `canceled`. |

## Example

**Ask**

```text
Add a risk to PatentPad with a role.
```

**API**

```bash
curl -X POST https://api.sb/patentpad.com/risks \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"scope":"Example scope","likelihood":1,"impact":1,"owner":"role_1"}'
```

```json
{
  "api": "https://api.sb/patentpad.com",
  "risk": {
    "$id": "https://api.sb/patentpad.com/risks/risk_1",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_1"
  },
  "action": {
    "$id": "https://api.sb/patentpad.com/actions/action_1",
    "operation": "Risk.create",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/patentpad.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const risk = await $.Risk.create({ scope: 'Example scope', likelihood: 1, impact: 1, owner: 'role_1' })
```

**CLI**

```bash
npx startup-builder do Risk.create --json '{"scope":"Example scope","likelihood":1,"impact":1,"owner":"role_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Risk.create({ scope: 'Example scope', likelihood: 1, impact: 1, owner: 'role_1' })"
  }
}
```