curl --request GET \
--url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c' \
--header "Authorization: Bearer $NORESPONSE_API_KEY"import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.accounts.get({
accountId: "acct_7f3a9c",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.accounts.get(account_id="acct_7f3a9c")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Accounts.Get(ctx, "acct_7f3a9c")
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.GetAccountResponse;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
GetAccountResponse res = sdk.accounts().get()
.accountId("acct_7f3a9c")
.call();
if (res.account().isPresent()) {
System.out.println(res.account().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Accounts.GetAsync(accountId: "acct_7f3a9c");
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$response = $sdk->accounts->get(
accountId: 'acct_7f3a9c'
);
if ($response->account !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.accounts.get(account_id: 'acct_7f3a9c')
unless res.nil?
# handle response
end
{
"schema_version": "1",
"id": "acct_7f3a9c",
"risk": {
"score": 35,
"decision": "step_up",
"reasons": [
{
"code": "new_email",
"weight": 20,
"identifier": "email"
},
{
"code": "proxy_ip",
"weight": 15,
"identifier": "ip"
}
]
},
"decisions_by_flow": {
"account_creation": "step_up",
"login": "step_up",
"purchase": "step_up"
},
"assessment_id": "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"updated_at": "2026-10-14T09:00:00.412Z"
}Retrieve an account
Returns the one current risk of one of your accounts. An account is the account_id you send with your assessments, and every assessment updates it.
The current risk is the risk of the account’s latest assessment with a decision (complete or partial), scored as GET /v1/assessments/{assessment_id} scores it. risk.decision is block when the score reached your block threshold, and that assessment’s recommendation otherwise. Every assessment answer carries this same object as its account. decisions_by_flow gives the decision for signup, login and purchase; all three use your signup thresholds today, so they equal risk.decision. assessment_id names the assessment the risk comes from.
An account with no unexpired assessment that has a decision answers 404 not_found, so a signup that is still pending has no account yet. A malformed account_id answers 400 invalid_request. Read-only and safe to retry. Requires the history scope.
curl --request GET \
--url 'https://api.noresponse.org/v1/accounts/acct_7f3a9c' \
--header "Authorization: Bearer $NORESPONSE_API_KEY"import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.accounts.get({
accountId: "acct_7f3a9c",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.accounts.get(account_id="acct_7f3a9c")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Accounts.Get(ctx, "acct_7f3a9c")
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.GetAccountResponse;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
GetAccountResponse res = sdk.accounts().get()
.accountId("acct_7f3a9c")
.call();
if (res.account().isPresent()) {
System.out.println(res.account().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Accounts.GetAsync(accountId: "acct_7f3a9c");
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$response = $sdk->accounts->get(
accountId: 'acct_7f3a9c'
);
if ($response->account !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.accounts.get(account_id: 'acct_7f3a9c')
unless res.nil?
# handle response
end
{
"schema_version": "1",
"id": "acct_7f3a9c",
"risk": {
"score": 35,
"decision": "step_up",
"reasons": [
{
"code": "new_email",
"weight": 20,
"identifier": "email"
},
{
"code": "proxy_ip",
"weight": 15,
"identifier": "ip"
}
]
},
"decisions_by_flow": {
"account_creation": "step_up",
"login": "step_up",
"purchase": "step_up"
},
"assessment_id": "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"updated_at": "2026-10-14T09:00:00.412Z"
}Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Path Parameters
The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request. The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
1 - 128^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$Response
The account's one current risk.
Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).
Version of the body shape.
The account_id the workspace sends with its assessments.
1 - 128^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$Show child attributes
Show child attributes
The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
Show child attributes
Show child attributes
The assessment the current risk comes from.
^asm_[0-9A-HJKMNP-TV-Z]{26}$updated_at of that assessment's latest revision.