How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Shift4 Risk API

The Risk API from Shift4 — 1 operation(s) for risk.

Shift4 Risk API is one of 21 APIs that Shift4 publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Risk. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 1 operation across 1 path, and defines 63 schemas. It is described by OpenAPI 3.2.0, at version 1.7.57.

Requests are made against 2 base URLs: https://api.shift4test.com/api/rest/v1, https://api.shift4api.net/api/rest/v1.

1 operations 1 paths 63 schemas 1 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.7.57
Base URL
https://api.shift4api.net/api/rest/v1
Authentication
API Key, HTTP Hmac-Sha256
Resource Areas
1

Authentication & Security 2

Shift4 Risk API declares 2 security schemes for authenticating requests. An API key is passed in the header as AccessToken (AccessToken). It uses HTTP hmac-sha256 authentication (HMAC-SHA256).

  • AccessToken — A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20re…
  • HMAC-SHA256 — Authentication using HMAC-256 signatures as the authorization scheme. Sent in the Authorization header in the following format: Authorization: HMAC-SHA256 Cred…

Paths & Operations 1

Across 1 path, the API surfaces 1 operation — 1 POST. Each is listed below with its method, path, parameters, and response codes.

Risk 1
POST
/risk/assess
Risk Assess
riskassess 4 params body → 200400504

Schemas 63

The contract defines 63 schemas that model the data the API accepts and returns. The most detailed are Error (6 properties), MerchantResponse (2 properties), AmountRisk (2 properties), CardTokenResponse (1 property). Each schema is shown below with its type and property counts.

ShippingAddressLine1
string
Shipping street address - Line 1
PurchaseCardCustomerReference
string
A unique value used to identify the consumer or transaction. If a merchant has a significant amount of revenue from purchasing card customers, the interface wo…
ShippingType
string
Shipping type. Value| Description -----|------------ SD | Same Day ND | Next Day 2D | Second Day ST | Standard
CardTypeRisk
string
Payment Type submitted by merchant: Value| Description -----|------------ AP | Apple Pay CC | Credit Card PP | PayPal GC | Gift Card
CardPresent
string
Conditional: Send in the initial authorization/sale request Indicates whether a card was present (‘Y’) or not (‘N’) at the time a transaction took place. This…
BillingCity
string
Billing address - City
ShippingRegion
string
Shipping address - A level 2 country subdivision code according to ISO-3166-2.
TransactionOrderId
string
Merchant’s Order Number
BillingAddressLine1
string
Billing street address - Line 1
BillingRegion
string
Billing address - State/Province
MerchantMID
number
The merchant ID associated with the merchant account.
ShoppingCartPrice
number
Shopping cart data array attribute for the price of the single item. Must be a natural number including 0.
BillingEmailAddress
string
This is the email address submitted by the customer.
RiskAssessment
string
This is the answer to the risk assessment. If the response is Escalate then transaction needs 3DS authentication. Value| Description -----|------------ A | App…
Error
object
6 properties
ShippingPhoneNumber
string
Ship-to Phone Number
ShippingEmailAddress
string
Shipping address - Email address of recipient
ShippingCountry
string
Shipping address - 2 character ISO Country Code.
CardNumber
string
The payment card number entered in an initial authorization/sale request. This field will always be masked when returned in a response.
TransactionToShip
string
Merchants acknowledgement to ship/process the order.
ShoppingCartType
string
Shopping cart data array attribute high level or generalized description of the item added to the shopping cart; this value should be free from any markup or U…
CardTokenResponse
object
1 property
ShoppingCartDescription
string
Shopping cart data array attribute for a specific description of the item being purchased.
BillingPhoneNumber
string
Bill-to Phone Number
MerchantName
string
The merchant’s business name as configured with Shift4.
MerchantResponse
object
2 properties
ShoppingCartSKU
string
Shopping cart data array attribute typically the SKU for an item; this value should be free from any markup or Unicode values. This value should be passed as p…
TransactionS4RiskId
string
Unique transaction identification number generated by Shift4 to identify a specific risk transaction and a field that can be searched in LTM.
BillingFullName
string
Name submitted with the order
TransactionVendorReference
string
Optional field for information that can be searched in the merchant portal.
ErrorSeverity
string
Severity level of the error. | Severity | Description | | -------- | ---------------------------------------------------------------- | | Info | Action not req…
DateTime
string
The date and time in ISO 8601 format including the timezone offset (yyyy-mm-ddThh:mm:ss.nnn+hh:mm). Must be sent as the local date/time of the merchant. For ex…
TransactionInvoice
string
10-digit invoice number assigned by the interface to identify a transaction. An invoice number serves as a unique key that identifies a transaction within a ba…
HostResponseReasonDescriptionRisk
string
Returns a description from the host.
ErrorLongText
string
Extended error message that is returned if an error condition exists.
CardTokenRequired
object
1 property 1 required
ShippingCity
string
Shipping address - City
HostResponseReasonCodeRisk
string
Returns a response code from the host. Value |Reason Description ------|------------------ 201 | Missing version of provider, this is built into SDK but must b…
risk_assess_token_gtv
object
ErrorShortText
string
Abbreviated error message that is always returned if an error condition exists
ShippingAddressLine2
string
Shipping street address - Line 2
ShoppingCartArray
array
Array of objects detailing the individual items being purchased
risk_assess_unencryptedcard
object
AmountTotal
number
The amount being charged for a particular transaction. If other amount fields are sent, they must be included in the total amount. Amount cannot be zero.
ErrorPrimaryCode
integer
Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details.
BillingCountry
string
Billing address - Country
AmountRisk
object
Object containing information regarding the amount being requested. The total field within the object is required and specifies the amount being requested. All…
2 properties 1 required
BillingPostalCode
string
Billing address - Postal Code
CardExpirationDate
integer
Conditional: Send only when card data is manually entered or when using a token. This field should not be specified when using an encrypted device. Card expira…
SourceIP
string
Public source IP Address where the request originates, not the IP Address of the web server.
CardEntryMode
string
Conditional: The Card Entry Mode should be sent in an initial request; in subsequent requests, it should be left blank or not sent. When using a Universal Tran…
ShippingFullName
string
Shipping address - Name of recipient
CardTokenValue
string
This field is used to specify a card token. Whenever CHD is sent in a request, a card token will be returned in this field. Your interface should be designed t…
ErrorCode
integer
Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details. Note: Th…
RiskTranId
string
This is the unique transaction ID for this response from the 3rd party risk provider. Store this value and use it to find additional details about this transac…
CardTypeRiskToken
string
Payment Type submitted by merchant: Value| Description -----|------------ TK | Token
ShippingPostalCode
string
Shipping address - Postal Code
BillingAddressLine2
string
Billing street address - Line 2
RiskSessionId
string
Unique Session ID. Must be unique over a 30-day span.
ShoppingCartQuantity
integer
Shopping cart data array attribute signifying the quantity of the item being purchased.
ErrorSecondaryCode
integer
This code supplements the code specified in the error.primaryCode field to provide additional information about the error that occurred.
AmountTax
number
The amount of sales tax charged for a transaction. The tax amount is used by businesses to track tax expenses for accounting purposes. Identifying the tax amou…
CurrencyCode
string
Transaction currency code. See the [Currency Codes](/guides/appendices/currency-codes) section for details. Note: This is currently supported when processing f…

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

shift4-risk-api-openapi.yml Raw ↑

Other APIs Shift4 publishes across the network.

Shift4 3D Secure API
Shift4 ACH API
Shift4 Batches API
Shift4 Cards API
Shift4 Checkout Sessions API
Shift4 Credentials API
Shift4 DCC API
Shift4 Devices API
Shift4 Gift Cards API
Shift4 Merchants API
Shift4 Mode API
Shift4 OCT API
Where this information came from

This is an independent, third-party profile of Shift4 Risk API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.