feat: riskAssessments integration

[josh-cain]

🔧 Changes

Add the ability manage risk assessment settings (/v2/risk-assessments/settings) via the CLI. This change includes two settings:

Examples

YAML format

(from tenant.yaml)

riskAssessments:
  enabled: true
  newDevice:
    remember_for: 30

JSON format

(from risk-assessments/settings.json)

{
  "enabled": true,
  "newDevice": {
    "remember_for": 15
  }
}

📚 References

• https://auth0.com/docs/api/management/v2/risk-assessments/get-risk-assessments-settings

🔬 Testing

Unit tests passing ✅

Smoke tested locally with:

node lib/index.js export -c config.json -f yaml -o ./local-export/

Everything seemed fine, the tenant.json file rendered correctly with riskAssessment.

Next, ran the import script:

node lib/index.js import -c config.json -i ./local-export/tenant.yaml
.
2025-12-01T23:59:09.571Z - info: Updated [riskAssessments]: {"enabled":false}
.
2025-12-01T23:59:45.590Z - info: Import Successful

Everything checked out, and was properly reflected in tenant logs and the tenant:

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[kushalshit27]

Hi, @josh-cain
Thank you for submitting this PR! Please add proper PR description (e.g #1204).

Contributing guideline: https://github.com/auth0/auth0-deploy-cli/blob/master/CONTRIBUTING.md

Let me know if you have any questions. Looking forward to your updates!

[josh-cain]

Hey @kushalshit27 , will when I go to move it out of draft state, build is passing, etc. Thanks 👍

[josh-cain]

Should be ready to go. Only issue is the e2e tests, for which it looks like I'd need to record prior to running, is that accurate @kushalshit27 ?

[kushalshit27]

Hi, @josh-cain
E2E tests sometimes fail for fork PRs; I will handle that.

[kushalshit27]

Please add PR description similar to #1204

[kushalshit27]

HI, @josh-cain ,
Since there are no multiple risk assessments, use the singular riskAssessment.

Please keep a single file for riskAssessment , riskAssessmentsNewDevice.ts is not needed.

Refer to attackProtection for a reference on combining multiple APIs under a single resource.

[josh-cain]

@kushalshit27 Updated ✅ . Please LMK if those changes are what you had in mind.

[kushalshit27]

@josh-cain
One small request, renaming all the files and variables:

riskAssessments to riskAssessment

[kushalshit27]

@claude

[josh-cain]

@josh-cain One small request, renaming all the files and variables:

riskAssessments to riskAssessment

🤔 The API endpoint + docs are riskAssessments, I thought we would want to match?

[kushalshit27]

Hi, @josh-cain ,

🤔 The API endpoint + docs are riskAssessments, I thought we would want to match?

Since there are no multiple risk assessments, we should use the singular riskAssessment here.
Example: tenant though API has /v2/tenants/.....