The REST Admin API now disallows requests to either create or update order risks without specifying an order ID.
Previously, the REST Admin API allowed you to create OrderRisk models using
order_id: null. This could have been used to create checkout order risks that exist prior to creating the order and block checkout. External apps do not use this feature.
This change is not breaking.