> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Record an enforcement > Records what you did to an account in your identity provider: the `action` (or `none`) for the decision of one `flow` at one `risk_version`, the account's `state_before`, the `provider`, and whether the action was `applied` or `failed`. An enforcement is your action, not an outcome. It does not change the account's risk. To report what you learned about an assessment, use `POST /v1/assessments/{assessment_id}/outcomes`. NoResponse keeps one record for each account, `risk_version`, `flow` and `action`. The first report answers 201. A repeat answers 200 with the stored record and changes nothing, so you can retry without an `Idempotency-Key`. One exception: an `applied` report after a `failed` record makes the record `applied`, keeps its `id` and `created_at`, removes `error_code` and answers 201. A `risk_version` older than the account's current one is accepted and stored. Only an `applied` record at the current `risk_version` removes the account from `GET /v1/accounts?unenforced=true`. A `risk_version` newer than the current one answers 409 `risk_version_ahead`. An account with no current risk answers 404 `not_found`. Send `error_code` only with `status: "failed"`. Requires the `history` scope. ## OpenAPI ````yaml /openapi.json post /v1/accounts/{account_id}/enforcements openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/accounts/{account_id}/enforcements: post: tags: - accounts summary: Record an enforcement description: >- Records what you did to an account in your identity provider: the `action` (or `none`) for the decision of one `flow` at one `risk_version`, the account's `state_before`, the `provider`, and whether the action was `applied` or `failed`. An enforcement is your action, not an outcome. It does not change the account's risk. To report what you learned about an assessment, use `POST /v1/assessments/{assessment_id}/outcomes`. NoResponse keeps one record for each account, `risk_version`, `flow` and `action`. The first report answers 201. A repeat answers 200 with the stored record and changes nothing, so you can retry without an `Idempotency-Key`. One exception: an `applied` report after a `failed` record makes the record `applied`, keeps its `id` and `created_at`, removes `error_code` and answers 201. A `risk_version` older than the account's current one is accepted and stored. Only an `applied` record at the current `risk_version` removes the account from `GET /v1/accounts?unenforced=true`. A `risk_version` newer than the current one answers 409 `risk_version_ahead`. An account with no current risk answers 404 `not_found`. Send `error_code` only with `status: "failed"`. Requires the `history` scope. operationId: recordEnforcement parameters: - $ref: '#/components/parameters/AccountId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EnforcementRequest' examples: failed: value: risk_version: 3 flow: account_creation action: restrict state_before: provisional status: failed provider: clerk error_code: clerk.rate_limited applied: value: risk_version: 3 flow: account_creation action: restrict state_before: provisional status: applied provider: clerk responses: '200': $ref: '#/components/responses/EnforcementFound' '201': $ref: '#/components/responses/EnforcementRecorded' '400': $ref: '#/components/responses/InvalidEnforcement' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/AccountNotFound' '409': $ref: '#/components/responses/RiskVersionAhead' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c/enforcements' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "risk_version": 3, "flow": "account_creation", "action": "restrict", "state_before": "provisional", "status": "failed", "provider": "clerk", "error_code": "clerk.rate_limited" }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.accounts.recordEnforcement({ accountId: "acct_7f3a9c", body: { riskVersion: 3, flow: "account_creation", action: "restrict", stateBefore: "provisional", status: "failed", provider: "clerk", errorCode: "clerk.rate_limited", }, }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.accounts.record_enforcement(account_id="acct_7f3a9c", risk_version=3, flow="account_creation", action="restrict", state_before="provisional", status="failed", provider="clerk", error_code="clerk.rate_limited") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v7\"\n\t\"github.com/noresponsehq/go/v7/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Accounts.RecordEnforcement(ctx, \"acct_7f3a9c\", components.EnforcementRequest{\n RiskVersion: 3,\n Flow: components.FlowAccountCreation,\n Action: components.EnforcementActionRestrict,\n StateBefore: components.EnforcementStateProvisional,\n Status: components.EnforcementStatusFailed,\n Provider: components.EnforcementProviderClerk,\n ErrorCode: noresponse.Pointer(\"clerk.rate_limited\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.RecordEnforcementResponse; import org.noresponse.models.shared.EnforcementAction; import org.noresponse.models.shared.EnforcementProvider; import org.noresponse.models.shared.EnforcementRequest; import org.noresponse.models.shared.EnforcementState; import org.noresponse.models.shared.EnforcementStatus; import org.noresponse.models.shared.Flow; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); RecordEnforcementResponse res = sdk.accounts().recordEnforcement() .accountId("acct_7f3a9c") .body(EnforcementRequest.builder() .riskVersion(3L) .flow(Flow.ACCOUNT_CREATION) .action(EnforcementAction.RESTRICT) .stateBefore(EnforcementState.PROVISIONAL) .status(EnforcementStatus.FAILED) .provider(EnforcementProvider.CLERK) .errorCode("clerk.rate_limited") .build()) .call(); if (res.enforcement().isPresent()) { System.out.println(res.enforcement().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Accounts.RecordEnforcementAsync( accountId: "acct_7f3a9c", body: new EnforcementRequest() { RiskVersion = 3, Flow = Flow.AccountCreation, Action = EnforcementAction.Restrict, StateBefore = EnforcementState.Provisional, Status = EnforcementStatus.Failed, Provider = EnforcementProvider.Clerk, ErrorCode = "clerk.rate_limited", } ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $body = new Shared\EnforcementRequest( riskVersion: 3, flow: Shared\Flow::AccountCreation, action: Shared\EnforcementAction::Restrict, stateBefore: Shared\EnforcementState::Provisional, status: Shared\EnforcementStatus::Failed, provider: Shared\EnforcementProvider::Clerk, errorCode: 'clerk.rate_limited', ); $response = $sdk->accounts->recordEnforcement( accountId: 'acct_7f3a9c', body: $body ); if ($response->enforcement !== null) { // handle response } - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.accounts.record_enforcement(account_id: 'acct_7f3a9c', body: Models::Shared::EnforcementRequest.new( risk_version: 3, flow: Models::Shared::Flow::ACCOUNT_CREATION, action: Models::Shared::EnforcementAction::RESTRICT, state_before: Models::Shared::EnforcementState::PROVISIONAL, status: Models::Shared::EnforcementStatus::FAILED, provider: Models::Shared::EnforcementProvider::CLERK, error_code: 'clerk.rate_limited' )) unless res.nil? # handle response end components: parameters: AccountId: name: account_id in: path required: true schema: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ description: >- The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request. schemas: EnforcementRequest: title: Enforcement description: >- POST /v1/accounts/{account_id}/enforcements body: what the workspace did to the account in its identity provider after reading the account's risk at risk_version. The account is named by the path and the workspace by the API key, so neither is a body member. An enforcement is the workspace's own action, not an outcome: what the workspace later learned about an assessment goes to POST /v1/assessments/{assessment_id}/outcomes. The record's key is (account, risk_version, flow, action), so a retry of the same report is safe and needs no Idempotency-Key. type: object additionalProperties: false required: - risk_version - flow - action - state_before - status - provider properties: risk_version: type: integer minimum: 1 description: >- The account's risk_version the workspace acted on, as read from GET /v1/accounts/{account_id}, GET /v1/accounts, an assessment answer or account.risk_changed. A version older than the account's current one is accepted and stored; a version newer than the current one answers 409 risk_version_ahead. flow: enum: - account_creation - login - purchase description: The flow whose decision (decisions_by_flow) the workspace acted on. action: enum: - revoke_sessions - restrict - unrestrict - fail_onboarding - reject_activation - none description: >- What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action). state_before: enum: - onboarding - provisional - active - restricted - rejected description: >- The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected. status: enum: - applied - failed description: >- applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced. provider: enum: - clerk - workos - auth0 - custom description: >- The identity provider the action ran in; custom for the workspace's own user store. error_code: type: string minLength: 1 maxLength: 128 pattern: ^[a-z0-9_.-]+$ description: >- Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' if: required: - status properties: status: const: applied then: not: required: - error_code Enforcement: title: Recorded enforcement description: >- The answer of POST /v1/accounts/{account_id}/enforcements: one enforcement of one of the calling workspace's accounts, kept once per (account, risk_version, flow, action). The first report answers 201 with the new record. A repeat answers 200 with the record as first stored, whatever the repeat's state_before, status, provider or error_code. The one exception is a stored failed record followed by an applied report: the record becomes applied, keeps its id and created_at, takes the applied report's state_before and provider, drops error_code and answers 201, so a successful retry after a failure is recorded. Only an applied record at the account's current risk_version takes the account out of GET /v1/accounts?unenforced=true. type: object additionalProperties: false required: - id - account_id - risk_version - flow - action - state_before - status - provider - created_at properties: id: type: string pattern: ^enf_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded enforcement: 'enf_' and 26 Crockford base32 characters. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id of the request path. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk_version: type: integer minimum: 1 description: >- The account's risk_version the workspace acted on. It can be older than the account's current risk_version: such a record is kept and does not count for unenforced. flow: enum: - account_creation - login - purchase description: The flow whose decision the workspace acted on. action: enum: - revoke_sessions - restrict - unrestrict - fail_onboarding - reject_activation - none description: >- What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action). state_before: enum: - onboarding - provisional - active - restricted - rejected description: >- The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected. status: enum: - applied - failed description: >- applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced. provider: enum: - clerk - workos - auth0 - custom description: >- The identity provider the action ran in; custom for the workspace's own user store. error_code: type: string minLength: 1 maxLength: 128 pattern: ^[a-z0-9_.-]+$ description: >- Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' created_at: type: string format: date-time description: >- When NoResponse first recorded this enforcement, in UTC. A failed record that becomes applied keeps it. if: required: - status properties: status: const: applied then: not: required: - error_code $defs: enforcement_id: type: string pattern: ^enf_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded enforcement: 'enf_' and 26 Crockford base32 characters. Unique within the workspace. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' enforcement_action: enum: - revoke_sessions - restrict - unrestrict - fail_onboarding - reject_activation - none description: >- What the workspace did in its identity provider: revoke_sessions (signed the account out everywhere), restrict (limited what the account can do), unrestrict (lifted an earlier restriction), fail_onboarding (stopped an account that was still onboarding), reject_activation (refused to activate a provisional account) or none (decided to take no action). enforcement_state: enum: - onboarding - provisional - active - restricted - rejected description: >- The account's state in the workspace's identity provider just before the action: onboarding, provisional (created, not yet activated), active, restricted or rejected. enforcement_status: enum: - applied - failed description: >- applied when the identity provider accepted the action, failed when it refused it or could not be reached. Only applied counts as enforced. enforcement_provider: enum: - clerk - workos - auth0 - custom description: >- The identity provider the action ran in; custom for the workspace's own user store. enforcement_error_code: type: string minLength: 1 maxLength: 128 pattern: ^[a-z0-9_.-]+$ description: >- Why a failed action failed, as a short code of the workspace's choosing (lower-case letters, digits, '_', '.' and '-'), such as the identity provider's error code. Allowed only with status failed: with status applied it answers 400 invalid_request. Keep personal data out of it. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: EnforcementFound: description: >- The enforcement was already recorded: the record as first stored. The report did not change it. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/Enforcement' examples: failed: value: id: enf_01JA2ZF5N6P7Q8R9S0T1V2W3X4 account_id: acct_7f3a9c risk_version: 3 flow: account_creation action: restrict state_before: provisional status: failed provider: clerk error_code: clerk.rate_limited created_at: '2026-10-14T09:00:02.000Z' EnforcementRecorded: description: >- The enforcement was recorded: the first report of its account, risk_version, flow and action, or an applied report that replaced a failed record. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/Enforcement' examples: applied: value: id: enf_01JA2ZF5N6P7Q8R9S0T1V2W3X4 account_id: acct_7f3a9c risk_version: 3 flow: account_creation action: restrict state_before: provisional status: applied provider: clerk created_at: '2026-10-14T09:00:02.000Z' InvalidEnforcement: description: >- account_id does not match its shape, a query parameter was sent, or the body is not JSON or does not match the enforcement request schema (an unknown member, a value outside its set, a risk_version below 1, or error_code with status applied). invalid_params names the offending fields without their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef AccountNotFound: description: >- The calling workspace has no unexpired assessment with a decision for this account_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found RiskVersionAhead: description: >- risk_version is newer than the account's current risk_version, so it names a risk NoResponse has not served. Read the account again and report the version you acted on. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - risk_version_ahead examples: ahead: value: type: https://docs.noresponse.org/problems/risk-version-ahead title: Risk version ahead status: 409 detail: risk_version is newer than the account's current risk_version. code: risk_version_ahead request_id: 0123456789abcdef0123456789abcdef PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk, the accounts whose risk changed and an account's history, records enforcements and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.