---
title: >-
  Creating or updating an order risk with the REST Admin API now requires an
  order_id - Shopify developer changelog
description: >-
  Shopify’s developer changelog documents all changes to Shopify’s platform.
  Find the latest news and learn about new platform opportunities.
source_url:
  html: >-
    https://shopify.dev/changelog/creating-or-updating-an-order-risk-with-the-rest-admin-api-now-requires-an-order_id
  md: >-
    https://shopify.dev/changelog/creating-or-updating-an-order-risk-with-the-rest-admin-api-now-requires-an-order_id.md
metadata:
  effectiveApiVersion: 2022-01
  affectedApi: []
  primaryTag:
    displayName: API
    handle: api
  secondaryTag:
    displayName: Update
    handle: update
  indicatesActionRequired: false
  createdAt: '2022-07-18T05:10:13-04:00'
  postedAt: '2022-10-01T00:00:00-04:00'
  updatedAt: '2024-12-13T17:24:34-05:00'
  effectiveAt: '2022-10-01T00:00:00-04:00'
---

October 1, 2022

Tags:

* API
* 2022-01

# Creating or updating an order risk with the REST Admin API now requires an `order_id`

The REST Admin API now disallows requests to either create or update [order risks](https://shopify.dev/api/admin-rest/2022-01/resources/order-risk#%5Bpost%5D/admin/api/2022-07/orders/%7Border_id%7D/risks.json) without specifying an order ID.

Previously, the REST Admin API allowed you to create OrderRisk models using `order_id: null`. This could have been used to create checkout order risks that exist prior to creating the order and block checkout. External apps do not use this feature.

This change is not breaking.