> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # List changed accounts > Lists your accounts whose risk changed, oldest change first. Each item is the account as `GET /v1/accounts/{account_id}` returns it. An account is listed when its `risk_version` goes up and it has a current risk. Every page has `next_cursor`. Send it back as `changed_since` to get the changes after that page. Without `changed_since`, the list starts at the oldest change. When nothing changed, `items` is empty and `next_cursor` is the cursor you sent. To poll, call again with the latest `next_cursor`. There is no last page. An account comes back each time its risk changes again, with a higher `risk_version`. Keep the copy with the highest `risk_version`. A change is listed only after all earlier changes are visible, so polling does not skip a change. `unenforced=true` lists only the accounts that need action: a decision other than `allow` for at least one flow, and no `applied` enforcement at the current `risk_version`. The cursor also moves past the accounts that this filter removes, so a page can have fewer than `limit` items, or none, before later changes. Continue to poll with `next_cursor`. Read-only and safe to retry. A changed or foreign cursor answers 400 `invalid_cursor`. Requires the `history` scope. ## OpenAPI ````yaml /openapi.json get /v1/accounts openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/accounts: get: tags: - accounts summary: List changed accounts description: >- Lists your accounts whose risk changed, oldest change first. Each item is the account as `GET /v1/accounts/{account_id}` returns it. An account is listed when its `risk_version` goes up and it has a current risk. Every page has `next_cursor`. Send it back as `changed_since` to get the changes after that page. Without `changed_since`, the list starts at the oldest change. When nothing changed, `items` is empty and `next_cursor` is the cursor you sent. To poll, call again with the latest `next_cursor`. There is no last page. An account comes back each time its risk changes again, with a higher `risk_version`. Keep the copy with the highest `risk_version`. A change is listed only after all earlier changes are visible, so polling does not skip a change. `unenforced=true` lists only the accounts that need action: a decision other than `allow` for at least one flow, and no `applied` enforcement at the current `risk_version`. The cursor also moves past the accounts that this filter removes, so a page can have fewer than `limit` items, or none, before later changes. Continue to poll with `next_cursor`. Read-only and safe to retry. A changed or foreign cursor answers 400 `invalid_cursor`. Requires the `history` scope. operationId: listAccounts parameters: - name: changed_since in: query required: false description: >- next_cursor from an earlier page, unchanged. Absent, the list starts from the oldest change. schema: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ not: pattern: \n - name: limit in: query required: false description: Most accounts per page. schema: type: integer minimum: 1 maximum: 100 default: 50 - name: unenforced in: query required: false description: >- true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version. schema: type: boolean default: false responses: '200': $ref: '#/components/responses/AccountList' '400': $ref: '#/components/responses/InvalidAccountRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request GET \ --url 'https://api.noresponse.org/v1/accounts?limit=50&unenforced=false' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.accounts.listChanged({}); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.accounts.list_changed(limit=50, unenforced=False) # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v7\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Accounts.ListChanged(ctx, nil, noresponse.Pointer[int64](50), noresponse.Pointer(false))\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.ListAccountsResponse; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); ListAccountsResponse res = sdk.accounts().listChanged() .limit(50L) .unenforced(false) .call(); if (res.accountList().isPresent()) { System.out.println(res.accountList().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Accounts.ListChangedAsync( limit: 50, unenforced: false ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $response = $sdk->accounts->listChanged( limit: 50, unenforced: false ); if ($response->accountList !== null) { // handle response } - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.accounts.list_changed(limit: 50, unenforced: false) unless res.nil? # handle response end components: responses: AccountList: description: >- One page of the accounts whose risk changed after changed_since, oldest change first, with the cursor to poll from next. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AccountList' examples: page: value: items: - schema_version: '1' id: acct_7f3a9c risk: score: 35 decision: step_up reasons: - code: new_email weight: 20 identifier: email - code: proxy_ip weight: 15 identifier: ip decisions_by_flow: account_creation: step_up login: step_up purchase: step_up assessment_id: asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM updated_at: '2026-10-14T09:00:00.412Z' risk_version: 3 - schema_version: '1' id: acct_2b81d0 risk: score: 90 decision: block reasons: - code: disposable_email weight: 40 identifier: email - code: proxy_ip weight: 30 identifier: ip - code: many_recent_accounts weight: 20 decisions_by_flow: account_creation: block login: block purchase: block assessment_id: asm_01JA2ZB4C5D6E7F8G9HJKMNPQR updated_at: '2026-10-14T09:02:11.087Z' risk_version: 1 next_cursor: eyJ4IjoxMDQyLCJhIjoiOWYyYyJ9 caughtUp: value: items: [] next_cursor: eyJ4IjoxMDQyLCJhIjoiOWYyYyJ9 InvalidAccountRequest: description: >- account_id does not match its shape, a query parameter is unknown, repeated or out of range, or the cursor fails its MAC, belongs to another workspace or account, or has expired. invalid_params names the offending parameters, never their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: AccountList: title: Changed accounts description: >- Body of the 200 answer to GET /v1/accounts: the calling workspace's accounts whose risk changed after changed_since, in the environment of the calling key, oldest change first. An account is listed when its risk_version advanced and it has a current risk, and each item is the account exactly as GET /v1/accounts/{account_id} answers it. An account appears once per page, at its latest change; when its risk changes again later, it appears again on a later page with the newer risk_version. next_cursor is always present: pass it back as changed_since to read the changes made after this page. type: object additionalProperties: false required: - items - next_cursor properties: items: type: array maxItems: 100 items: title: Account description: >- Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments). type: object additionalProperties: false required: - schema_version - id - risk - decisions_by_flow - assessment_id - updated_at - risk_version properties: schema_version: const: '1' description: Version of the body shape. id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id the workspace sends with its assessments. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk: type: object additionalProperties: false required: - score - decision - reasons properties: score: type: integer minimum: 0 maximum: 100 description: 0 (safe) to 100 (risky), as risk.score of the assessment. decision: enum: - allow - step_up - review - block - held description: >- The decision for the flow of the assessment this account is served with: on GET /v1/accounts/{account_id}, the flow of the current assessment; inside an assessment, that assessment's flow. reasons: type: array maxItems: 32 description: >- Every reason that fired, highest weight first. The weights sum to score before clamping. items: type: object additionalProperties: false required: - code - weight properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key description: >- A risk reason from the reviewed list. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its weight is the scenario the magic email or phone chose, and 0 for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/key_usage/batches). weight: type: integer minimum: -100 maximum: 100 identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. decisions_by_flow: type: object additionalProperties: false required: - account_creation - login - purchase description: >- The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed. properties: account_creation: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. login: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. purchase: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: The assessment the current risk comes from. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' updated_at: type: string format: date-time description: updated_at of that assessment's latest revision. risk_version: type: integer minimum: 1 description: >- The version of the account's current risk. It increases every time the account's current risk or decisions_by_flow changes, and does not decrease. Of two copies of an account, the one with the higher risk_version is newer. account.risk_changed carries the risk_version that its change made. $defs: account_decision: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. next_cursor: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ description: >- Opaque cursor after the last change this page read, bound to the workspace and the environment of the calling key. Pass it back unchanged as changed_since. It is present on every page, the last one included: when nothing changed after changed_since it is the cursor that was sent, so a poller keeps calling with the latest next_cursor. A tampered or foreign cursor answers 400 invalid_cursor. Consumers do not parse it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk, the accounts whose risk changed and an account's history, records enforcements and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.