> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Export an account > Get one consistent snapshot of retained account records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. The export excludes secrets, restricted source information, other workspaces' data and investigator notes. Use the separate review export for investigator records. The same export, source and response-mode permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. For larger accounts, create an asynchronous export with POST /v1/workspaces/{workspace_id}/exports. The manifest identifies historical decisions that NoResponse did not capture. ## OpenAPI ````yaml /openapi.json get /v1/accounts/{account_id}/export openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/accounts/{account_id}/export: get: tags: - accounts summary: Export an account description: >- Get one consistent snapshot of retained account records, including assessment revisions, account decisions, feedback, key associations, enforcements and request diagnostics. The export excludes secrets, restricted source information, other workspaces' data and investigator notes. Use the separate review export for investigator records. The same export, source and response-mode permissions apply. An export exceeding 10000 records or 8 MiB returns export_too_large without a partial result. For larger accounts, create an asynchronous export with POST /v1/workspaces/{workspace_id}/exports. The manifest identifies historical decisions that NoResponse did not capture. operationId: exportAccount parameters: - $ref: '#/components/parameters/AccountId' - name: response_mode in: query required: false schema: enum: - standard - detailed default: standard responses: '200': $ref: '#/components/responses/ExportAccount200' '400': $ref: '#/components/responses/InvalidAccountRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/ExportAccount413' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request GET \ --url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c/export' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.accounts.export({ accountId: "acct_7f3a9c", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.accounts.export(account_id="acct_7f3a9c") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Accounts.Export(ctx, \"acct_7f3a9c\", nil)\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.ExportAccountResponse; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); ExportAccountResponse res = sdk.accounts().export() .accountId("acct_7f3a9c") .call(); if (res.accountExport().isPresent()) { System.out.println(res.accountExport().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Accounts.ExportAsync(accountId: "acct_7f3a9c"); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $response = $sdk->accounts->export( accountId: 'acct_7f3a9c' ); $result = $response->result; // handle response - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.accounts.export(account_id: 'acct_7f3a9c') unless res.nil? # handle response end components: parameters: AccountId: name: account_id in: path required: true schema: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ description: >- The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request. responses: ExportAccount200: description: >- Export an account. The retained snapshot; no current decision is substituted for historical evidence. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AccountExport' InvalidAccountRequest: description: >- account_id does not match its shape, a query parameter is unknown, repeated or out of range, or the cursor fails its MAC, belongs to another workspace or account, or has expired. invalid_params names the offending parameters, never their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef NotFound: description: >- No unexpired assessment with this id for the calling workspace, or a malformed assessment_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found ExportAccount413: description: 'export_too_large: no partial export was returned.' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - export_too_large headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: AccountExport: title: Account export description: >- One repeatable-read snapshot of all retained customer-accessible records for the account, including earlier revisions. Source-private evidence, raw credentials, cross-customer links and legacy notes are not exported. Standard/detailed authorization is unchanged. A synchronous export is at most 10000 records and 8 MiB: larger exports fail with export_too_large rather than truncate. Earlier account decisions that were never captured are not fabricated. type: object additionalProperties: false required: - schema_version - account_id - exported_at - complete - current_risk_version - assessments - decisions - outcomes - assessment_outcomes - credentials - bindings - enforcements - requests - exclusions properties: schema_version: const: '1' description: Version of the body shape. account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ exported_at: type: string format: date-time complete: const: true current_risk_version: type: integer minimum: 0 assessments: type: array maxItems: 10000 items: title: Historical assessment revision description: >- One stored assessment revision with its original decision, policy, flow and depth. Never re-scored and never paired with current account risk. Current retention and detailed-scope restrictions still apply. type: object additionalProperties: false required: - schema_version - id - status - flow - depth - detail properties: schema_version: const: '1' description: Version of the body shape. id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: This assessment's id, equal to detail.assessment_id. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' status: enum: - complete - partial - pending description: The status of this exact stored revision. flow: enum: - account_creation - login - purchase description: The flow that created the assessment. depth: enum: - quick - full description: >- The depth the assessment was served at: the request's, or its flow's default. An assessment made before depths existed reports full. detail: title: Assessment detail description: >- This assessment's own facts: its score, recommendation, signals, coverage and timing. type: object additionalProperties: false required: - schema_version - assessment_id - account_id - status - confidence - incomplete_sources - policy_version - policy_basis - assessment_version - created_at - updated_at - expires_at - timing properties: schema_version: const: '1' description: Version of the body shape. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ identifiers: type: object additionalProperties: false minProperties: 1 description: >- The identifiers this assessment was sent, exactly as received. Served only to a key holding the history scope, on GET /v1/assessments/{assessment_id} and every history read: an exact version, search, the account's assessments and its export. Absent from the POST /v1/assessments answer (the caller holds what it sent), from every webhook, for a key without the history scope, and for an assessment made before NoResponse kept them. properties: email: type: string minLength: 3 maxLength: 254 description: identifiers.email as the request sent it. username: type: string minLength: 1 maxLength: 64 description: identifiers.username as the request sent it. phone: type: string minLength: 9 maxLength: 16 description: identifiers.phone as the request sent it. name: type: string minLength: 1 maxLength: 128 description: >- identifiers.name as the request sent it, before NFC normalisation. ip: type: string minLength: 2 maxLength: 39 description: identifiers.ip as the request sent it. request_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ description: >- An optional provider correlation id, echoed back. It is not an idempotency key. Refuses an exact-shape JWT or a bare 40, 64 or 128 character hex digest; a UUID is accepted. not: description: >- refused_text plus secret_hex_digest and secret_encoded, for request_id and username. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exactly 40, 64 or 128 hex characters (SHA-1, SHA-256, SHA-512) and nothing else. Refused in username and request_id, where such a value is almost certainly a credential hash; a 39 or 41 character hex string, a short hex word such as 'deadbeef' or a UUID is accepted. Not refused in account_id: a hex digest of an internal id is a common pseudonymous account id and not a secret under. pattern: >- ^(?:[0-9A-Fa-f]{40}|[0-9A-Fa-f]{64}|[0-9A-Fa-f]{128})$ - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ status: enum: - complete - partial - pending description: >- Processing state, separate from evidence coverage. complete: final; nothing is still running, but unsupported, failed or unanswered lanes remain in incomplete_sources. partial: a recommendation exists and evidence is incomplete; assessment_url identifies continuing work when present. pending: no recommendation yet; poll or wait for the webhook. Finished processing does not mean all sources answered. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. confidence: enum: - low - medium - high - unavailable description: >- Evidence coverage: how much of the planned source evidence gave a definite answer. This is not confidence that an identity is genuine, agreement between identifiers, a risk score or a probability. unavailable means no usable evidence answered; a terminal uncovered assessment can have this value and recommend review. risk: type: object additionalProperties: false required: - score - band - recommendation - confidence - policy_version - policy_basis - reasons - coverage description: >- the one risk decision for this assessment. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned policy. The policy's weights are not published: each reason carries its direction and a coarse impact band instead. Every served answer with a recommendation carries it, and there the top-level recommendation equals risk.recommendation. block is true from the workspace's block threshold (block_threshold), off by default. It names no source or provider. properties: score: type: integer minimum: 0 maximum: 100 band: enum: - low - medium - high - critical description: low 0-29, medium 30-59, high 60-84, critical 85-100. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. block: type: boolean description: >- true when the workspace's block threshold is set and score reached it. A provider hook can deny the account creation on it; the provider decides and enforces. It does not change recommendation. It is false while blocking is off, the default, and a body from before the flag existed omits it: read absent as false. block_threshold: type: integer minimum: 1 maximum: 100 description: >- The block threshold this answer used: block is true exactly when score is at least this value. Absent while blocking is off. NoResponse sets it per workspace on request, at or above the review threshold. step_up_threshold: type: integer minimum: 1 maximum: 100 description: >- The score at which this answer's flow starts to recommend step_up. Absent from an answer stored before it was recorded. review_threshold: type: integer minimum: 1 maximum: 100 description: >- The score at which this answer's flow starts to recommend review. An answer nothing answered recommends review below it, with confidence unavailable. Absent from an answer stored before it was recorded. confidence: enum: - low - medium - high description: >- How much of the planned evidence answered; it says nothing about risk. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' policy_basis: const: heuristic_unvalidated reasons: type: array maxItems: 32 description: >- Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band. items: type: object additionalProperties: false description: >- One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high. required: - code - direction - impact properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. direction: enum: - raises - lowers - neutral impact: enum: - none - low - medium - high identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The list entry a list_match reason applied. No other reason carries it. summary: type: object additionalProperties: false properties: phone: type: object additionalProperties: false properties: line_type: enum: - mobile - voip - landline - toll_free - other country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n report_count: type: integer minimum: 0 description: >- Highest report count any source gave for the number. carrier: type: string minLength: 1 maxLength: 128 description: >- Carrier-network metadata from privately weighted sources; not upstream provider attribution. email: type: object additionalProperties: false properties: disposable: type: boolean accounts_found: type: integer minimum: 0 description: Accounts found for the email. breach: type: object additionalProperties: false required: - found description: >- Breach facts for the email. Replaces the boolean breached. properties: found: type: boolean breach_count: type: integer minimum: 0 description: >- Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed username: type: object additionalProperties: false properties: accounts_found: type: integer minimum: 0 description: Accounts found for the username. breach: type: object additionalProperties: false required: - found description: Breach facts for the username. properties: found: type: boolean breach_count: type: integer minimum: 0 description: >- Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed ip: type: object additionalProperties: false description: >- Facts about the submitted IP from the offline database and this workspace's own recent assessments. Every member is optional; absent makes no claim. properties: country: type: string pattern: ^[A-Z]{2}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: ISO 3166-1 alpha-2 country of the address. type: enum: - residential - hosting - vpn - proxy - tor - mobile - unknown description: The address's network type. asn: type: integer minimum: 1 maximum: 4294967295 description: >- Autonomous system number of the network that announces the address, from the offline database. Absent when unknown. seen_in_workspace: type: integer minimum: 0 description: >- Assessments in this workspace with the same IP in the last 24 hours, this one included. A count only. consistency: type: object additionalProperties: false description: >- Cross-identifier agreement, computed from facts only. Every member is optional; absent makes no claim. properties: name: enum: - match - partial - mismatch - unknown description: >- The submitted name against breach names and caller-ID names. phone: enum: - match - partial - mismatch - unknown description: >- The submitted phone against numbers found next to the email in breach records. ip: enum: - match - partial - mismatch - unknown description: >- The submitted IP against IPs found next to the email or username in breach records. country: enum: - consistent - mismatch - unknown description: >- IP country, phone country, breach countries and policy_context.region together. When the breach records give a country, the timezone and locale countries count too. The IP country of a proxy or hosting network does not count. footprint: type: object additionalProperties: false description: >- How long and how widely the signup's email and username have existed, and how far independent sources agree on the person behind them, in years and counts only. families are the kinds of evidence that found either identifier. Omitted when nothing found them: a footprint lookup that failed makes no claim, and absence is no_digital_footprint's to state. required: - families properties: email: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). username: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). coherence: type: object additionalProperties: false minProperties: 1 properties: birth_date: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 gender: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 nationality: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 country: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 city: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 zip: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 name: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 company: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 website: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 social: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 description: >- A few typed facts per identifier. Every fact is optional: absent means the evidence did not answer and makes no claim, while false or 0 is a definite answer. Lanes that do not exist yet leave their members absent. coverage: type: object additionalProperties: false required: - answered - failed - pending description: >- Counts of planned source-identifier pairs by evidence outcome, deduplicated across signals and incomplete entries. These counts do not measure identity agreement or prove that processing is still running. A lane that was not searched is not an answered source. properties: answered: type: integer minimum: 0 description: >- Source-identifier pairs that gave a definite found or not_found answer. failed: type: integer minimum: 0 description: >- Source-identifier pairs that could not answer, including unsupported coverage markers and source failures. Read detailed signals to distinguish Not covered from Failed. pending: type: integer minimum: 0 description: >- Source-identifier pairs with deferred or timed_out evidence. A terminal timeout can remain here after processing finishes; use assessment status and continuation metadata to determine whether work is still running. details: type: object additionalProperties: false description: >- Detailed view only (response_mode=detailed, which needs the detailed scope); a standard answer never carries it. Merged observations: no provider, source, origin, raw breach record, value or score. properties: phone_names: type: array maxItems: 32 items: type: object additionalProperties: false required: - value - seen_by properties: value: type: string minLength: 1 maxLength: 128 seen_by: type: integer minimum: 1 breaches: type: array maxItems: 100 items: type: object additionalProperties: false required: - name - kind - matched_on description: >- One breach table that matched, detailed view only. No member carries a record, value, password or hash. properties: name: type: string minLength: 1 maxLength: 128 not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The breached site's domain, lower case. Absent when the table has none (a credential list, for example). category: type: string pattern: ^[a-z0-9_]{1,64}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The table's category from its name, lower case (social, gaming, combolist...). kind: enum: - site_breach - credential_list - stealer_log - scrape - hacking_forum - abuse_service - darkweb_site description: >- Who is in the table: site_breach, a site's own users; credential_list, a combolist or compilation; stealer_log, malware or botnet victims; scrape; hacking_forum, a criminal hacking, cracking or carding community; abuse_service, the customers of DDoS-for-hire, account generators, dump or card shops, darknet markets, stalkerware or breach-lookup services; darkweb_site, an onion site of unknown purpose. year: type: integer minimum: 1970 maximum: 2100 description: A breach table's date year. month: type: integer minimum: 1 maximum: 12 description: Absent when only the year is known. matched_on: enum: - email - username - ip description: >- The submitted email or username whose own search matched the table. The phone is never searched. A submitted full name is searched as well, and what that search finds feeds the identity's facts and reasons rather than this list. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. conduct: type: array minItems: 1 maxItems: 3 uniqueItems: true items: enum: - chargeback - declined_payment - forum_sanction description: >- What a breach table's rows record against the identifier: chargeback, one or more chargebacks; declined_payment, one or more declined payments; forum_sanction, a forum ban, warning or infraction. A category and not a value: the schema has no member for one. description: >- What this table's rows record against the matched email or username: the tables behind the forum_sanctioned and prior_payment_abuse reasons. Absent when the rows record none, for a table matched on an IP address, and from an answer stored before it was recorded. description: >- The matching breach tables, newest first, at most 100. breach_names: type: array maxItems: 32 description: >- Names found next to the identifiers in breach records, merged, with the number of distinct tables each was seen in and the sites of those tables. items: type: object additionalProperties: false required: - value - seen_in properties: value: type: string minLength: 1 maxLength: 128 seen_in: type: integer minimum: 1 sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables hold the name, lower case, each once, newest breach first, at most 32: the domain values of breaches[]. Covers the email's and the username's tables together. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables that hold the name have no site, such as a credential list or a stealer log. Absent when none. events: type: array maxItems: 300 description: >- The identity's dated footprint events, newest first, at most 300: the year and month, what happened (created, last_active, breached), the site, its category, the kind of evidence and the identifier it belongs to. No breach value: dates are coarsened to the month. items: type: object additionalProperties: false required: - year - kind - site - category - family - identifier properties: year: type: integer minimum: 1970 maximum: 2100 month: type: integer minimum: 1 maximum: 12 kind: enum: - created - last_active - breached site: type: string minLength: 1 maxLength: 128 not: pattern: '[\x00-\x1f\x7f]' category: type: string pattern: ^[a-z0-9_]{1,64}$ family: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). identifier: enum: - email - username accounts: type: array maxItems: 64 description: >- Every online-account search of the email or username: the platform, what the search came to and, for an account found, what the platform returned beside it. Found first, then not found, then searches that failed or are still running, each by platform name; at most 64. A failed or running search keeps its own outcome and is not reported as not_found. items: type: object additionalProperties: false required: - name - domain - identifier - outcome description: >- One online-account search of the signup's email or username, detailed view only. name and domain name the platform searched, not a provider. outcome is the search's signal outcome: found, not_found, or a failure (blocked, unavailable, inconclusive) with its reason; a failure is not reported as not_found. The members after reason are what the platform returned beside an account it found, each absent when it did not say. properties: name: type: string minLength: 1 maxLength: 64 description: >- The platform's name, such as Adobe or GitHub. domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ description: >- The platform's domain, lower case: the host its logo is fetched for. identifier: enum: - email - username description: The identifier searched. outcome: enum: - found - not_found - inconclusive - blocked - unavailable description: >- Per-signal outcome. A failure is never not_found: a source that timed out, was blocked or errored reports blocked, unavailable or inconclusive with a reason, and is listed in incomplete_sources. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a signal or source did not produce a definite found/not_found. timed_out means the source missed the request deadline; a continuation may still settle it. deferred means the (source, identifier) pair is async-only and was not attempted on the synchronous path; a continuation settles it. sign_in: type: array minItems: 1 maxItems: 7 uniqueItems: true items: enum: - password - google - facebook - apple - microsoft - sso - other description: >- How the account signs in, as the platform reports it, sorted: a password, a Google, Facebook, Apple or Microsoft account, the organisation's single sign-on, or another method. email_verified: type: boolean description: >- Whether the platform says the account's email is verified. blocked: type: boolean description: >- Whether the platform says the account is blocked or suspended. account_type: enum: - personal - business description: >- personal, or business: an account a company or school manages. has_avatar: type: boolean description: >- Whether the account has its own profile picture rather than the platform's default. The picture is not returned. first_name_prefix: type: string minLength: 1 maxLength: 32 description: >- The first letters of the account holder's first name, as the platform shows them (Life360 shows two and hides the rest). It is evidence only: it does not change the score or the consistency results. attribute_conflicts: type: array maxItems: 4 description: >- What an identity_attribute_conflict reason weighed: each attribute the records disagree on and the sites reporting it. Absent when the reason did not fire, and on an answer stored before conflicts were recorded. No value is served. items: type: object additionalProperties: false required: - attribute properties: attribute: enum: - birth_date - gender - nationality - name_gender description: >- name_gender is the records' gender against the submitted first name's usual one. sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables report the attribute, newest breach first, at most 32. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables reporting the attribute have no site, such as a credential list or a stealer log. Absent when none. allOf: - if: properties: block: const: true required: - block then: required: - block_threshold signals: type: array maxItems: 256 items: type: object additionalProperties: false required: - type - identifier - outcome - source_id - freshness properties: type: type: string minLength: 1 maxLength: 64 pattern: ^[a-z][a-z0-9_]{0,63}$ description: >- The producer emits only registered, active types with a registered identifier kind and outcome. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' identifier: enum: - email - username - phone - ip description: >- Which submitted identifier a signal concerns. ip is a selector of breach_exposure only. outcome: enum: - found - not_found - inconclusive - blocked - unavailable description: >- Per-signal outcome. A failure is never not_found: a source that timed out, was blocked or errored reports blocked, unavailable or inconclusive with a reason, and is listed in incomplete_sources. source_id: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9_.-]{0,63}$ description: >- Opaque, workspace-scoped projection of the source that produced a signal. It remains stable for this workspace while the projection key is unchanged, but never identifies an upstream provider, feed, breach table or source record. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a signal or source did not produce a definite found/not_found. timed_out means the source missed the request deadline; a continuation may still settle it. deferred means the (source, identifier) pair is async-only and was not attempted on the synchronous path; a continuation settles it. evidence_ref: type: string pattern: ^evr_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque pointer to evidence NoResponse holds for this signal. It never encodes the evidence itself (no breach value, credential or page body). not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' observed_at: type: string format: date-time description: When the evidence was first observed. last_checked_at: type: string format: date-time description: >- When the source was last queried for this identifier. freshness: enum: - fresh - stale - unknown description: >- Freshness class of the evidence behind a signal. unknown whenever no evidence was obtained. enrichment: type: object additionalProperties: false required: - fields properties: fields: type: object minProperties: 1 additionalProperties: false properties: phone: type: string maxLength: 8192 name: type: string maxLength: 8192 carrier: type: string maxLength: 8192 line_type: type: string maxLength: 8192 entity_type: type: string maxLength: 8192 country_code: type: string maxLength: 8192 country: type: string maxLength: 8192 state: type: string maxLength: 8192 city: type: string maxLength: 8192 location: type: string maxLength: 8192 national_format: type: string maxLength: 8192 job_title: type: string maxLength: 8192 company_name: type: string maxLength: 8192 email: type: string maxLength: 8192 website: type: string maxLength: 8192 first_call_at: type: string maxLength: 8192 last_call_at: type: string maxLength: 8192 matched_name: type: string maxLength: 8192 alternate_names: type: array maxItems: 1024 items: type: - string - number - boolean - object - array name_candidates: type: array maxItems: 1024 items: type: - string - number - boolean - object - array timezones: type: array maxItems: 1024 items: type: - string - number - boolean - object - array emails: type: array maxItems: 1024 items: type: - string - number - boolean - object - array websites: type: array maxItems: 1024 items: type: - string - number - boolean - object - array locations: type: array maxItems: 1024 items: type: - string - number - boolean - object - array social_profiles: type: array maxItems: 1024 items: type: - string - number - boolean - object - array report_count: type: integer minimum: 0 tag_count: type: integer minimum: 0 total_calls: type: integer minimum: 0 calls_60_days: type: integer minimum: 0 reports_60_days: type: integer minimum: 0 searches_60_days: type: integer minimum: 0 comment_count: type: integer minimum: 0 names_count: type: integer minimum: 0 spam_report_count: type: integer minimum: 0 description: >- Only present for a found phone signal. Curated facts about the number, not raw upstream documents and never the provider's identity, scores or verdicts; follows normal record retention/deletion. allOf: - if: properties: outcome: const: found required: - outcome then: required: - evidence_ref - observed_at - last_checked_at properties: freshness: enum: - fresh - stale not: required: - reason description: >- A definite presence: evidence exists, so its freshness is known. - if: properties: outcome: const: not_found required: - outcome then: required: - last_checked_at not: anyOf: - required: - reason - required: - evidence_ref description: >- A definite absence. Carries no failure reason: a timeout, block or error is never encoded as not_found. - if: properties: outcome: enum: - inconclusive - blocked - unavailable required: - outcome then: required: - reason - if: properties: outcome: enum: - blocked - unavailable required: - outcome then: properties: freshness: const: unknown not: anyOf: - required: - evidence_ref - required: - observed_at description: >- No evidence was obtained, so there is nothing observed and nothing to reference. - if: required: - enrichment then: properties: identifier: const: phone outcome: const: found description: >- Detailed view only (response_mode=detailed, which needs the detailed scope): a standard answer omits signals[], and a detailed one always carries it, possibly empty. At most one signal per (type, source_id, identifier). incomplete_sources: type: array maxItems: 256 items: type: object additionalProperties: false required: - lane - reason description: >- One lane with missing evidence and why. It can mean unsupported input, source failure or unfinished work. It names a lane, never a source: detailed signals distinguish the source-identifier pairs behind it. A lane is listed once. A complete assessment can retain missing lanes; completion never establishes a successful search. A lane that missed its deadline is timed_out, never not_found. properties: lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred description: >- Why a lane did not settle. insufficient_evidence is a settled verdict (an inconclusive signal), never a reason to list a lane as incomplete. deferred means the lane is async-only and still running; a continuation settles it. timed_out means the lane missed its deadline. description: >- The lanes that did not settle, each listed once with a reason; never a source. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' policy_basis: const: heuristic_unvalidated assessment_version: type: integer minimum: 1 maximum: 1000 description: >- Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version. created_at: type: string format: date-time description: >- When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at. updated_at: type: string format: date-time expires_at: type: string format: date-time description: >- After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus the workspace's retention period at creation (default 365 days, at most 365). Fixed per record: a later async revision never extends it, and a new assessment for the same account never renews an older one. If the workspace later shortens retention, the effective expiry becomes created_at + min(retention at creation, current retention). assessment_url: type: string maxLength: 64 pattern: ^/v1/assessments/asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Server-relative path of the authoritative assessment, GET /v1/assessments/{assessment_id}. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' timing: type: object additionalProperties: false required: - deadline_ms - elapsed_ms properties: deadline_ms: type: integer minimum: 50 maximum: 3000 description: >- The budget the server applied to the synchronous answer. elapsed_ms: type: integer minimum: 0 maximum: 600000 description: >- Server time from HTTP ingress to this revision of the assessment. auth_context: type: object additionalProperties: false required: - provider - issuer - verified - transport description: >- The identity fields of the auth context the assessment was made with, echoed for the workspace's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score. properties: provider: type: string pattern: ^[a-z0-9][a-z0-9._-]{1,31}$ description: The provider slug the context named. issuer: type: string maxLength: 256 pattern: ^https://[^\s]+$ description: The issuer the context named. subject: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The subject the context named; absent when it named none (a pre_registration hook). session_id: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The session identifier the context named, when it named one. organization_id: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The organization identifier the context named, when it named one. verified: type: boolean description: >- The verified flag the context carried. A provider_hook context is always false. transport: type: string enum: - backend - browser - provider_hook description: >- Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook. hook_point: type: string enum: - pre_registration - post_registration - pre_login - post_login - token_issuance description: >- The provider event a provider_hook context was sent for; absent for any other transport. if: properties: transport: const: provider_hook then: required: - hook_point properties: verified: const: false else: not: required: - hook_point allOf: - if: properties: status: const: complete required: - status then: required: - recommendation properties: incomplete_sources: items: properties: reason: not: const: deferred description: >- A complete assessment may list lanes that failed or timed out, never one still running. not: required: - assessment_url - if: properties: status: const: partial required: - status then: required: - recommendation properties: incomplete_sources: minItems: 1 - if: properties: status: const: pending required: - status then: required: - assessment_url not: anyOf: - required: - recommendation - required: - risk properties: confidence: const: unavailable incomplete_sources: minItems: 1 - if: properties: confidence: const: unavailable required: - confidence then: properties: recommendation: const: review - if: properties: risk: required: - details required: - risk then: required: - signals decisions: type: array maxItems: 10000 items: title: Historical account decision description: >- The account decision at one recorded risk_version. Its stored assessment revision and frozen account inputs are rendered under the named immutable overlay version. Later evidence, feedback and policy changes never change this decision. Versions predating decision-history capture, or whose base assessment has expired or been deleted, return 404 rather than reconstructed guesses. type: object additionalProperties: false required: - account - assessment_version - policy_version - overlay_version - changed_at properties: account: title: Account description: >- Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments). type: object additionalProperties: false required: - schema_version - id - risk - decisions_by_flow - assessment_id - updated_at - risk_version properties: schema_version: const: '1' description: Version of the body shape. id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id the workspace sends with its assessments. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk: type: object additionalProperties: false required: - score - decision - reasons properties: score: type: integer minimum: 0 maximum: 100 description: >- 0 (safe) to 100 (risky), as risk.score of the assessment. decision: enum: - allow - step_up - review - block - held description: >- The decision for the flow of the assessment this account is served with: on GET /v1/accounts/{account_id}, the flow of the current assessment; inside an assessment, that assessment's flow. reasons: type: array maxItems: 32 description: >- Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band. items: type: object additionalProperties: false description: >- One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high. required: - code - direction - impact properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. direction: enum: - raises - lowers - neutral impact: enum: - none - low - medium - high identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The list entry a list_match reason applied. No other reason carries it. decisions_by_flow: type: object additionalProperties: false required: - account_creation - login - purchase description: >- The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed. properties: account_creation: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. login: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. purchase: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: The assessment the current risk comes from. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' updated_at: type: string format: date-time description: updated_at of that assessment's latest revision. risk_version: type: integer minimum: 1 description: >- The version of the account's current risk. It increases every time the account's current risk or decisions_by_flow changes, and does not decrease. Of two copies of an account, the one with the higher risk_version is newer. account.risk_changed carries the risk_version that its change made. $defs: account_decision: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessment_version: type: integer minimum: 1 maximum: 1000 description: >- Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' overlay_version: type: integer const: 1 changed_at: type: string format: date-time feedback_outcome_id: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' outcomes: type: array maxItems: 10000 items: title: Account outcome description: >- Immutable acceptance receipt. risk_version is the account version after this report committed, not the version when a retry reads it. effective_outcome_id names the effective head at that write. The effective expiration may shorten under retention changes. A legitimate report or correction removes only the account-feedback contribution, not unrelated risk. type: object additionalProperties: false required: - id - account_id - outcome - observed_at - received_at - expires_at - actor - risk_version_before - risk_version properties: id: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. supersedes: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' observed_at: type: string format: date-time received_at: type: string format: date-time expires_at: type: string format: date-time external_ref: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ description: >- The provider's own opaque reference for the outcome, such as a case or ticket id. Stored and never interpreted. It must not contain a direct identifier. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' actor: type: object additionalProperties: false required: - type properties: type: enum: - api_key - user key_id: type: string minLength: 1 maxLength: 64 external_user_id: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]{1,256}$ description: >- The user's id at the identity provider the console signs people in with: 1 to 256 printable ASCII characters with no space, compared exactly. console_credential_id: type: string minLength: 1 maxLength: 64 principal_id: type: string pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Opaque, server-assigned member id: mem_ and a 26-character ULID. It stays the same when a removed member is invited back. allOf: - if: properties: type: const: api_key then: required: - key_id properties: external_user_id: false console_credential_id: false principal_id: false else: required: - external_user_id - console_credential_id properties: key_id: false risk_version_before: type: integer minimum: 1 risk_version: type: integer minimum: 1 effective_outcome_id: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' assessment_outcomes: type: array maxItems: 10000 items: title: Exported legacy outcome description: >- Structured fields of a retained per-assessment outcome. Legacy notes remain private as promised by the existing outcome contract. type: object additionalProperties: false required: - id - assessment_id - outcome - observed_at - received_at properties: id: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. observed_at: type: string format: date-time received_at: type: string format: date-time external_ref: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ description: >- The provider's own opaque reference for the outcome, such as a case or ticket id. Stored and never interpreted. It must not contain a direct identifier. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' credentials: type: array maxItems: 10000 items: title: Issued credential association description: >- An issued-key association, without the raw key or its digest. Retirement disables this association, never the actual key at the customer service. type: object additionalProperties: false required: - id - account_id - created_at - actor properties: id: type: string pattern: ^cred_[0-9A-HJKMNP-TV-Z]{26}$ account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ created_at: type: string format: date-time retired_at: type: string format: date-time actor: type: object additionalProperties: false required: - type - key_id properties: type: const: api_key key_id: type: string minLength: 1 maxLength: 64 retired_by: type: object additionalProperties: false required: - type - key_id properties: type: const: api_key key_id: type: string minLength: 1 maxLength: 64 bindings: type: array maxItems: 10000 items: title: Recorded provisional binding description: >- Binding appends an assessment revision and preserves earlier versions. Continuations use the same assessment. Erasing either the provisional or canonical name erases the canonical account, including the bound assessment. type: object additionalProperties: false required: - assessment_id - provisional_account_id - account_id - assessment_version - created_at - actor properties: assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' provisional_account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ assessment_version: type: integer minimum: 1 maximum: 1000 description: >- Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version. created_at: type: string format: date-time actor: type: object additionalProperties: false required: - type - key_id properties: type: const: api_key key_id: type: string minLength: 1 maxLength: 64 enforcements: type: array maxItems: 10000 items: title: Recorded enforcement description: >- The answer of POST /v1/accounts/{account_id}/enforcements: one enforcement of one of the calling workspace's accounts, kept once per (account, risk_version, flow, action). The first report answers 201 with the new record. A repeat answers 200 with the record as first stored, whatever the repeat's state_before, status, provider or error_code. The one exception is a stored failed record followed by an applied report: the record becomes applied, keeps its id and created_at, takes the applied report's state_before and provider, drops error_code and answers 201, so a successful retry after a failure is recorded. Only an applied record at the account's current risk_version takes the account out of GET /v1/accounts?unenforced=true. type: object additionalProperties: false required: - id - account_id - risk_version - flow - action - state_before - status - provider - created_at properties: id: type: string pattern: ^enf_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded enforcement: 'enf_' and 26 Crockford base32 characters. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id of the request path. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk_version: type: integer minimum: 1 description: >- The account's risk_version the workspace acted on. It can be older than the account's current risk_version: such a record is kept and does not count for unenforced. flow: enum: - account_creation - login - purchase description: The flow whose decision the workspace acted on. action: enum: - revoke_sessions - restrict - unrestrict - fail_onboarding - reject_activation - activate - none description: >- What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account), activate (let a held onboarding or provisional account in) or none (decided to take no action). state_before: enum: - onboarding - provisional - active - restricted - rejected description: >- The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected. status: enum: - applied - failed description: >- applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced. provider: enum: - clerk - workos - auth0 - custom description: >- The identity provider the action ran in; custom for the workspace's own user store. error_code: type: string minLength: 1 maxLength: 128 pattern: ^[a-z0-9_.-]+$ description: >- Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' created_at: type: string format: date-time description: >- When NoResponse first recorded this enforcement, in UTC. A failed record that becomes applied keeps it. if: required: - status properties: status: const: applied then: not: required: - error_code $defs: enforcement_id: type: string pattern: ^enf_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded enforcement: 'enf_' and 26 Crockford base32 characters. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' enforcement_action: enum: - revoke_sessions - restrict - unrestrict - fail_onboarding - reject_activation - activate - none description: >- What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account), activate (let a held onboarding or provisional account in) or none (decided to take no action). enforcement_state: enum: - onboarding - provisional - active - restricted - rejected description: >- The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected. enforcement_status: enum: - applied - failed description: >- applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced. enforcement_provider: enum: - clerk - workos - auth0 - custom description: >- The identity provider the action ran in; custom for the workspace's own user store. enforcement_error_code: type: string minLength: 1 maxLength: 128 pattern: ^[a-z0-9_.-]+$ description: >- Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' requests: type: array maxItems: 10000 items: title: Request diagnostic description: >- One authenticated HTTP attempt. An attempt id is independent of the caller correlation id. No raw body, path parameter, credential or source payload is retained. write_complete means the server wrote/flushed its response, not proof the client processed it. Collection is bounded best effort; ii_signup_request_diagnostic_failures_total exposes gaps. Retained for seven days or the shorter environment retention. type: object additionalProperties: false required: - id - request_id - route - http_status - duration_ms - started_at - completed_at - expires_at - idempotent_replayed - write_complete properties: id: type: string pattern: ^req_[0-9a-f]{32}$ request_id: type: string pattern: ^[0-9a-f]{32}$ route: type: string minLength: 1 maxLength: 160 http_status: type: integer minimum: 100 maximum: 599 duration_ms: type: integer minimum: 0 started_at: type: string format: date-time completed_at: type: string format: date-time expires_at: type: string format: date-time error_code: type: string pattern: ^[a-z0-9_]+$ idempotent_replayed: type: boolean write_complete: type: boolean decision: title: Served decision receipt description: >- The public decision prepared for one HTTP attempt, never reconstructed from GET latest. The account is the exact account projection served for that attempt. type: object additionalProperties: false required: - assessment_id - assessment_version - flow - status properties: assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' assessment_version: type: integer minimum: 1 maximum: 1000 description: >- Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. status: enum: - complete - partial - pending description: >- Processing state, separate from evidence coverage. complete: final; nothing is still running, but unsupported, failed or unanswered lanes remain in incomplete_sources. partial: a recommendation exists and evidence is incomplete; assessment_url identifies continuing work when present. pending: no recommendation yet; poll or wait for the webhook. Finished processing does not mean all sources answered. score: type: integer minimum: 0 maximum: 100 account: title: Account description: >- Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/keys/usage). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments). type: object additionalProperties: false required: - schema_version - id - risk - decisions_by_flow - assessment_id - updated_at - risk_version properties: schema_version: const: '1' description: Version of the body shape. id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The account_id the workspace sends with its assessments. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk: type: object additionalProperties: false required: - score - decision - reasons properties: score: type: integer minimum: 0 maximum: 100 description: >- 0 (safe) to 100 (risky), as risk.score of the assessment. decision: enum: - allow - step_up - review - block - held description: >- The decision for the flow of the assessment this account is served with: on GET /v1/accounts/{account_id}, the flow of the current assessment; inside an assessment, that assessment's flow. reasons: type: array maxItems: 32 description: >- Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band. items: type: object additionalProperties: false description: >- One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high. required: - code - direction - impact properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. direction: enum: - raises - lowers - neutral impact: enum: - none - low - medium - high identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The list entry a list_match reason applied. No other reason carries it. decisions_by_flow: type: object additionalProperties: false required: - account_creation - login - purchase description: >- The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed. properties: account_creation: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. login: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. purchase: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: The assessment the current risk comes from. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' updated_at: type: string format: date-time description: updated_at of that assessment's latest revision. risk_version: type: integer minimum: 1 description: >- The version of the account's current risk. It increases every time the account's current risk or decisions_by_flow changes, and does not decrease. Of two copies of an account, the one with the higher risk_version is newer. account.risk_changed carries the risk_version that its change made. $defs: account_decision: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. api_key_id: type: string pattern: ^[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Public authenticated API key identifier. Absent for member requests and older unattributed diagnostics. exclusions: type: array maxItems: 7 uniqueItems: true items: enum: - expired_or_erased_records - secrets_and_credential_digests - private_source_and_work_payloads - cross_customer_data - legacy_outcome_notes - uncaptured_historical_decisions - investigator_reviews_require_review_export Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.