Risk

Webhook Event	Description
`risk.policy_alert`	Triggered when a risk policy you configured in Risk Monitoring fires for a business.
`risk.alert`	Triggered when a Worth Score based risk alert is generated for a business.

Which of these two applies to your account depends on your Risk Monitoring version. Accounts on Risk Monitoring v2 use risk.policy_alert, which reports a policy you defined and tells you which condition made it fire. Accounts on the earlier version use risk.alert, which reports the score based alerts configured from your score ranges. Your account is offered the event that matches its version, so in practice you subscribe to one of the two, not both. risk.alert is being phased out as accounts move to Risk Monitoring v2. If you are unsure which applies to you, the event list on your webhook endpoint shows the one your account uses.

risk.policy_alert

One event is delivered per alert. A monitoring run that trips three policies delivers three events, each carrying only its own policy’s conditions.

{
  "event_id": "5d456789-abcd-ef01-2345-678901234567",
  "event_type": "risk.policy_alert",
  "timestamp": "2026-08-11T14:02:11.482Z",
  "payload": {
    "customer_id": "c0ffee00-1111-4222-8333-444455556666",
    "business_id": "2f2616ae-d695-42c8-ba94-da023abee546",
    "risk_alert_id": "7a1b2c3d-4e5f-4a7b-8c9d-0e1f2a3b4c5d",
    "risk_alert_subtype": "Adverse Media",
    "risk_level": "Medium",
    "policy_name": "New adverse media",
    "run_id": "9f8e7d6c-5b4a-4938-8271-605f4e3d2c1b",
    "triggered_conditions": [
      {
        "field": "facts.adverse_media_hits",
        "operator": "INCREASED_BY_AT_LEAST",
        "expected_value": 1,
        "actual_value": 3
      }
    ]
  }
}

Fields

Field	Notes
`risk_alert_id`	Stable identifier of the policy that fired. Use this to correlate an alert across events and API reads.
`risk_alert_subtype`	The policy’s category label, falling back to the policy name when the policy has no category. Free text you define, not a fixed set of values.
`risk_level`	The label of the risk bucket the policy is assigned to. Free text you define, renameable at any time in the dashboard, and may be `null` if the policy has no bucket.
`policy_name`	The policy’s name. Equal to `risk_alert_subtype` when the policy has no category.
`run_id`	The monitoring run this alert was linked on. May be `null`.
`triggered_conditions`	Every condition that evaluated true for this alert, and only this alert.

risk_alert_subtype and risk_level carry your own labels, not values from a fixed list. Both are editable in the dashboard, so renaming a category or a risk bucket changes what arrives in these fields. Do not branch your integration on their exact string values. Use risk_alert_id to identify a policy, and triggered_conditions[].field to identify what was measured — both are stable.

run_id tells you which monitoring run the alert surfaced on. It does not always identify what caused it: data written by a business update can land inside a run’s comparison window and be reported by that run.

Condition entries

Each entry in triggered_conditions describes one condition that evaluated true.

Field	Notes
`field`	The monitored attribute, for example `facts.adverse_media_hits`.
`operator`	The comparison that matched, for example `INCREASED_BY_AT_LEAST`, `CROSSED_BELOW`, `CHANGED`.
`expected_value`	The threshold configured on the condition. Type depends on the attribute.
`actual_value`	The observed value that satisfied the condition. Type depends on the attribute.

risk.alert

The Worth Score based alert. Fires on a score refresh, an application edit, or a manual refresh.

{
  "event_id": "4c345678-9abc-def0-1234-567890123456",
  "event_type": "risk.alert",
  "timestamp": "2025-11-20T16:15:00.000Z",
  "payload": {
    "business_id": "2f2616ae-d695-42c8-ba94-da023abee546",
    "business_name": "Example Holdings LLC",
    "risk_level": "LOW | MODERATE | HIGH",
    "risk_alert_subtype": "score_range | worth_score_change | score_risk_tier_transition | new_lien | new_judgement | new_bankruptcy | equifax_credit_score | integration_failure"
  }
}

On this event risk_level and risk_alert_subtype are fixed sets of values, unlike risk.policy_alert.

Webhooks (Beta)

Sample Payloads

risk.policy_alert

Fields

Condition entries

risk.alert

​risk.policy_alert

​Fields

​Condition entries

​risk.alert

risk.policy_alert

Fields

Condition entries

risk.alert