I have been working on a program that needs to check Order Risks, here are some notes from my partial implementation and questions to Shopify support:

I copied from another entity and service, I think it was Transaction. I made minimal modifications to add the different fields, and only implemented the get methods.

Order Risks contain an undocumented field, "merchant_message". In some cases, but not all, it is a duplicate of the "message" field. Support initially claimed the field was deprecated since it has been undocumented and is a duplicate of "message". When I found ones that were not duplicates and pointed it out to support, they reported that a Solutions Engineer confirmed that "message" is what Shopify sees in logs and "merchant_message" is what the merchant sees on the order. In a manual test, it ignored "merchant_message" and set both to the value I gave in "message". I was not able to get it to set a unique value for "merchant_message".

{ /* sent */
    "risk": {
        "message": "Test Med risk flag (message)",
        "merchant_message": "Test Med risk flag (merchant_message)",
        "recommendation": "investigate",
        "score": 0.5,
        "source": "External",
        "cause_cancel": false,
        "display": true
    }
}

{ /* received */
    "risk": {
        "id": <risk ID>
        "order_id": <order ID>
        "checkout_id": <checkout ID>
        "source": "External"
        "score": "0.5"
        "recommendation": "investigate"
        "display": true
        "cause_cancel": false
        "message": "Test Med risk flag (message)"
        "merchant_message": "Test Med risk flag (message)"
    }
}