# Risk routes: accept, assess, close, treat

URL: /code/api/risk/verbs · Id: `page:code/api/risk/verbs`

> The Risk Verbs accept, assess, close, treat as api.sb routes, with inputs, result, refusals and an example.

Reference for [Risk](/business/nouns/risk), one group of [Risk routes](/code/api/risk).

### Risk.accept
Accept records an officer’s signed Decision to carry a Risk untreated until its next review. [Verb page](/business/nouns/risk/accept?interface=api).

```text
POST /{namespace}/risks/{risk}/accept
```

Path: `risk`. Body, as JSON: the other inputs. Emits [`Risk.accepted`](/business/events/Risk.accepted).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The Risk to carry. |
| `reason` | `text` | Yes | Why it is carried, recorded as a Decision. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The accepted Risk. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy/accept \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Example reason"}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "risk": {
    "$id": "https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_oloMFMUeCH"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Risk.accept",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Risk.assess
Assess scores a Risk’s likelihood and impact from the Startup’s records and sets its next review date. [Verb page](/business/nouns/risk/assess?interface=api).

```text
POST /{namespace}/risks/{risk}/assess
```

Path: `risk`. Body, as JSON: the other inputs. Emits [`Risk.assessed`](/business/events/Risk.assessed).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The Risk to score. |
| `likelihood` | `integer` | Yes | Likelihood from 1 to 5. |
| `impact` | `integer` | Yes | Impact from 1 to 5. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The scored Risk. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy/assess \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"likelihood":1,"impact":1}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "risk": {
    "$id": "https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_oloMFMUeCH"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Risk.assess",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Risk.close
Close ends a Risk that can no longer happen and keeps it, with its scores and treatments, forever. [Verb page](/business/nouns/risk/close?interface=api).

```text
POST /{namespace}/risks/{risk}/close
```

Path: `risk`. Body, as JSON: the other inputs. Emits [`Risk.closed`](/business/events/Risk.closed).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The Risk to close. |
| `reason` | `text` | Yes | Why it can no longer happen. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The closed Risk, kept forever. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy/close \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Example reason"}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "risk": {
    "$id": "https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_oloMFMUeCH"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Risk.close",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```

### Risk.treat
Treat links a Risk to the Controls that lower it and records the score it should reach. [Verb page](/business/nouns/risk/treat?interface=api).

```text
POST /{namespace}/risks/{risk}/treat
```

Path: `risk`. Body, as JSON: the other inputs. Emits [`Risk.treated`](/business/events/Risk.treated).

**Inputs**

| Input | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The Risk to treat. |
| `controls` | list of [Control](/business/nouns/control) | Yes | The Controls that lower it. |

**Returns**

| Output | Type | Required | Description |
| --- | --- | --- | --- |
| `risk` | [Risk](/business/nouns/risk) | Yes | The treated Risk. |

**Refuses when**

| Check | Error | Fix | Then call |
| --- | --- | --- | --- |
| The key is valid, but its scopes do not allow this operation. | [`forbidden`](/code/api/errors/forbidden) | Use a key whose scopes cover the operation, or ask an owner of the namespace to grant them. | None. |

**Example**

```bash
curl -X POST https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy/treat \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"controls":["control_o4pMmXUeCH"]}'
```

```json
{
  "api": "https://api.sb/leaseline.app",
  "risk": {
    "$id": "https://api.sb/leaseline.app/risks/risk_a3Rw0qcmRy",
    "$type": "Risk",
    "scope": "Example scope",
    "likelihood": 1,
    "impact": 1,
    "owner": "role_oloMFMUeCH"
  },
  "action": {
    "$id": "https://api.sb/leaseline.app/actions/act_br07HsG8MG",
    "operation": "Risk.treat",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/leaseline.app/actions/act_br07HsG8MG"
  }
}
```