> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Search distinct observed accounts by email or account ID > Search accounts observed in retained assessments in the authenticated workspace and environment. Each account appears once, with its latest retained assessment, current decision when available, and the number of retained assessments. This is not a complete directory of your application's users. Send an exact account ID or email, or neither to list all observed accounts. Email matching follows the same canonical mailbox rules as assessment search and matches any retained assessment belonging to the account. Email filtering requires permission to read submitted identifiers. The server counts distinct accounts before paginating. Send next_cursor back with unchanged filters to continue. Totals are exact below 10000 and capped at 10000 otherwise. Pages are live and may change between requests, not a single snapshot spanning all pages. Read-only and safe to retry. Requires history access. Cross-environment, expired or modified cursors are refused. No Idempotency-Key. ## OpenAPI ````yaml /openapi.json post /v1/accounts/search openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/accounts/search: post: tags: - accounts summary: Search distinct observed accounts by email or account ID description: >- Search accounts observed in retained assessments in the authenticated workspace and environment. Each account appears once, with its latest retained assessment, current decision when available, and the number of retained assessments. This is not a complete directory of your application's users. Send an exact account ID or email, or neither to list all observed accounts. Email matching follows the same canonical mailbox rules as assessment search and matches any retained assessment belonging to the account. Email filtering requires permission to read submitted identifiers. The server counts distinct accounts before paginating. Send next_cursor back with unchanged filters to continue. Totals are exact below 10000 and capped at 10000 otherwise. Pages are live and may change between requests, not a single snapshot spanning all pages. Read-only and safe to retry. Requires history access. Cross-environment, expired or modified cursors are refused. No Idempotency-Key. operationId: searchAccounts requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AccountDirectorySearchRequest' responses: '200': $ref: '#/components/responses/SearchAccounts200' '400': $ref: '#/components/responses/InvalidHistoryQuery' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/accounts/search' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "needs_action": false, "limit": 25, "identifier_expression": { "scope": "account", "expression": { "and": [ { "term": { "kind": "phone", "value": "+14155552671", "match": "canonical" } }, { "or": [ { "term": { "kind": "email", "value": "case@example.com", "match": "exact" } }, { "term": { "kind": "email", "value": "other@example.com", "match": "exact" } } ] } ] } } }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.accounts.search({ identifierExpression: { scope: "account", expression: { and: [ { term: { kind: "phone", value: "+14155552671", match: "canonical", }, }, { or: [ { term: { kind: "email", value: "case@example.com", match: "exact", }, }, { term: { kind: "email", value: "other@example.com", match: "exact", }, }, ], }, ], }, }, }); console.log(result.total); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.accounts.search(identifier_expression={ "scope": "account", "expression": { "and_": [ { "term": { "kind": "phone", "value": "+14155552671", "match": "canonical", }, }, { "or_": [ { "term": { "kind": "email", "value": "case@example.com", "match": "exact", }, }, { "term": { "kind": "email", "value": "other@example.com", "match": "exact", }, }, ], }, ], }, }, limit=25) # Handle response if res.result is not None: print(res.result.total) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Accounts.Search(ctx, components.AccountDirectorySearchRequest{\n IdentifierExpression: &components.IdentifierExpression{\n Scope: components.ScopeEnumAccount,\n Expression: components.IdentifierExpressionNode{\n And: []components.IdentifierExpressionNodeLevelTwo{\n components.IdentifierExpressionNodeLevelTwo{\n Term: &components.IdentifierSearch{\n Kind: components.IdentifierSearchKindPhone,\n Value: \"+14155552671\",\n Match: components.MatchCanonical.ToPointer(),\n },\n },\n components.IdentifierExpressionNodeLevelTwo{\n Or: []components.IdentifierExpressionNodeLevelOne{\n components.IdentifierExpressionNodeLevelOne{\n Term: &components.IdentifierSearch{\n Kind: components.IdentifierSearchKindEmail,\n Value: \"case@example.com\",\n Match: components.MatchExact.ToPointer(),\n },\n },\n components.IdentifierExpressionNodeLevelOne{\n Term: &components.IdentifierSearch{\n Kind: components.IdentifierSearchKindEmail,\n Value: \"other@example.com\",\n Match: components.MatchExact.ToPointer(),\n },\n },\n },\n },\n },\n },\n },\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: > package hello.world; import java.lang.Exception; import java.util.List; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.SearchAccountsResponse; import org.noresponse.models.shared.AccountDirectorySearchRequest; import org.noresponse.models.shared.IdentifierExpression; import org.noresponse.models.shared.IdentifierExpressionNode; import org.noresponse.models.shared.IdentifierExpressionNodeLevelOne; import org.noresponse.models.shared.IdentifierExpressionNodeLevelTwo; import org.noresponse.models.shared.IdentifierSearch; import org.noresponse.models.shared.IdentifierSearchKind; import org.noresponse.models.shared.Match; import org.noresponse.models.shared.ScopeEnum; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); AccountDirectorySearchRequest req = AccountDirectorySearchRequest.builder() .identifierExpression(IdentifierExpression.builder() .scope(ScopeEnum.ACCOUNT) .expression(IdentifierExpressionNode.builder() .and(List.of( IdentifierExpressionNodeLevelTwo.builder() .term(IdentifierSearch.builder() .kind(IdentifierSearchKind.PHONE) .value("+14155552671") .match(Match.CANONICAL) .build()) .build(), IdentifierExpressionNodeLevelTwo.builder() .or(List.of( IdentifierExpressionNodeLevelOne.builder() .term(IdentifierSearch.builder() .kind(IdentifierSearchKind.EMAIL) .value("case@example.com") .match(Match.EXACT) .build()) .build(), IdentifierExpressionNodeLevelOne.builder() .term(IdentifierSearch.builder() .kind(IdentifierSearchKind.EMAIL) .value("other@example.com") .match(Match.EXACT) .build()) .build())) .build())) .build()) .build()) .build(); SearchAccountsResponse res = sdk.accounts().search() .request(req) .call(); if (res.accountDirectoryPage().isPresent()) { System.out.println(res.accountDirectoryPage().get().total()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; using System.Collections.Generic; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); AccountDirectorySearchRequest req = new AccountDirectorySearchRequest() { IdentifierExpression = new IdentifierExpression() { Scope = ScopeEnum.Account, Expression = new IdentifierExpressionNode() { And = new List() { new IdentifierExpressionNodeLevelTwo() { Term = new IdentifierSearch() { Kind = IdentifierSearchKind.Phone, Value = "+14155552671", Match = Match.Canonical, }, }, new IdentifierExpressionNodeLevelTwo() { Or = new List() { new IdentifierExpressionNodeLevelOne() { Term = new IdentifierSearch() { Kind = IdentifierSearchKind.Email, Value = "case@example.com", Match = Match.Exact, }, }, new IdentifierExpressionNodeLevelOne() { Term = new IdentifierSearch() { Kind = IdentifierSearchKind.Email, Value = "other@example.com", Match = Match.Exact, }, }, }, }, }, }, }, }; var res = await sdk.Accounts.SearchAsync(req); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $request = new Shared\AccountDirectorySearchRequest( identifierExpression: new Shared\IdentifierExpression( scope: Shared\ScopeEnum::Account, expression: new Shared\IdentifierExpressionNode( and: [ new Shared\IdentifierExpressionNodeLevelTwo( term: new Shared\IdentifierSearch( kind: Shared\IdentifierSearchKind::Phone, value: '+14155552671', match: Shared\MatchT::Canonical, ), ), new Shared\IdentifierExpressionNodeLevelTwo( or: [ new Shared\IdentifierExpressionNodeLevelOne( term: new Shared\IdentifierSearch( kind: Shared\IdentifierSearchKind::Email, value: 'case@example.com', match: Shared\MatchT::Exact, ), ), new Shared\IdentifierExpressionNodeLevelOne( term: new Shared\IdentifierSearch( kind: Shared\IdentifierSearchKind::Email, value: 'other@example.com', match: Shared\MatchT::Exact, ), ), ], ), ], ), ), ); $response = $sdk->accounts->search( request: $request ); $result = $response->result; // handle response - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) req = Models::Shared::AccountDirectorySearchRequest.new( identifier_expression: Models::Shared::IdentifierExpression.new( scope: Models::Shared::ScopeEnum::ACCOUNT, expression: Models::Shared::IdentifierExpressionNode.new( and_: [ Models::Shared::IdentifierExpressionNodeLevelTwo.new( term: Models::Shared::IdentifierSearch.new( kind: Models::Shared::IdentifierSearchKind::PHONE, value: '+14155552671', match: Models::Shared::Match::CANONICAL ) ), Models::Shared::IdentifierExpressionNodeLevelTwo.new( or_: [ Models::Shared::IdentifierExpressionNodeLevelOne.new( term: Models::Shared::IdentifierSearch.new( kind: Models::Shared::IdentifierSearchKind::EMAIL, value: 'case@example.com', match: Models::Shared::Match::EXACT ) ), Models::Shared::IdentifierExpressionNodeLevelOne.new( term: Models::Shared::IdentifierSearch.new( kind: Models::Shared::IdentifierSearchKind::EMAIL, value: 'other@example.com', match: Models::Shared::Match::EXACT ) ), ] ), ] ) ) ) res = s.accounts.search(request: req) unless res.nil? # handle response end components: schemas: AccountDirectorySearchRequest: title: Observed account directory search description: >- Bounded distinct-account search for one authenticated workspace/environment. identifier matches any retained admitted assessment of an account, including historical submitted values. email preserves the legacy canonical-mailbox filter. identifier and email cannot be combined. All other filters combine using AND. Typed identifier search uses stable opaque account order; ordinary and legacy email searches retain newest-seen ordering. Pages are live, not a cross-page snapshot. Requires history or investigate authority and identifier-read permission for identifier, identifier_expression or email filtering. identifier_expression explicitly chooses scope assessment (one whole matching submission) or account (terms may match different retained submissions of one account). At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email. Expression search uses the same stable opaque account order as typed identifier search. type: object additionalProperties: false properties: needs_action: type: boolean default: false description: >- Select accounts with a retained open or in-progress review, or a current review/block account decision with no retained effective account outcome. The server applies this filter before counting and pagination. Requires reviews.read as well as history.read for console members; API keys additionally require management. account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ email: type: string minLength: 3 maxLength: 254 pattern: ^[^\s\x00-\x1f\x7f]+$ not: pattern: \n description: >- Assessments of every account that one of its retained admitted assessments sent this mailbox as identifiers.email, matched as lists match an email entry: case-insensitive, a +tag removed and, at gmail.com and googlemail.com, the dots of the local part ignored. Only assessments stored since email list matching began carry the mailbox. An address that is not a valid mailbox is refused with 400. email_domain: type: string minLength: 3 maxLength: 253 pattern: ^[^\s\x00-\x1f\x7f@]+$ not: pattern: \n description: >- Every account that one of its retained admitted assessments sent an email of this domain or its subdomains, matched as lists match an email_domain entry and with the same identifier-read permission as email. A value that is not a registrable domain is refused with 400. Mutually exclusive with email, identifier and identifier_expression. limit: type: integer minimum: 1 maximum: 50 default: 25 cursor: type: string minLength: 1 maxLength: 1024 pattern: ^[A-Za-z0-9_-]+$ not: pattern: \n description: >- Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change. identifier: title: Identifier search description: >- Match a retained assessment's submitted identifier directly. Mutually exclusive with identifier_expression and legacy email. All other supported filters combine using AND. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical identifier_expression: title: Submitted identifier expression description: >- Explicit bounded AND/OR combinations. Mutually exclusive with identifier and legacy email. Other supported filters combine using AND. type: object additionalProperties: false required: - scope - expression properties: scope: type: string enum: - assessment - account description: >- assessment requires one submission to satisfy the complete expression. account permits witnesses across retained submissions of one account and is supported only by POST /v1/accounts/search. No default: select scope explicitly. expression: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact $defs: identifier_expression_node: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact identifier_expression_node_level_two: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact identifier_expression_node_level_one: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical and: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact or: type: array minItems: 2 maxItems: 8 items: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact anyOf: - required: - term - required: - and - required: - or allOf: - not: required: - term - and - not: required: - term - or - not: required: - and - or examples: - term: kind: email value: case@example.com match: exact identifier_expression_leaf: type: object additionalProperties: false properties: term: title: Identifier search description: >- One customer-submitted identifier. Defaults to exact comparison of the original submitted value. canonical uses the supported identifier normalisation without an ownership claim: email preserves local-part case, NFC-normalises it and lowercases the domain without removing dots or tags; phone uses international E.164 without extensions or an inferred region; username uses NFC and Unicode case folding within the customer namespace. mailbox is email-only and explicitly selects existing list rules: case-insensitive, remove +tag, and ignore local-part dots at gmail.com and googlemail.com; googlemail.com maps to gmail.com. Username requires namespace customer. Email and phone forbid namespace. Source-discovered identifiers and platform handles are not searched. Unsupported kinds, namespaces, modes and invalid values return 400. Search equality does not establish verified ownership or merge accounts. type: object additionalProperties: false required: - kind - value properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 description: >- The comparison value. Stored original identifiers remain unchanged. An invalid identifier is refused instead of returning an empty result. pattern: ^[^\x00-\x1f\x7f]+$ not: pattern: \n match: type: string enum: - exact - canonical - mailbox default: exact description: >- exact compares the original submitted value; canonical uses identifier-specific normalisation; mailbox explicitly selects the email alias rules used by lists. namespace: type: string enum: - customer description: >- Required for username: the username submitted by this customer in this workspace/environment. It does not name or join a source platform. Omit for email and phone. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace properties: value: maxLength: 64 else: not: required: - namespace - if: properties: match: const: mailbox required: - match then: properties: kind: const: email - if: properties: kind: const: phone required: - kind then: properties: value: maxLength: 64 examples: - kind: username value: janedoe match: canonical namespace: customer - kind: email value: Jane.Doe+case@example.com match: canonical - kind: phone value: +1 (415) 555-2671 match: canonical required: - term examples: - term: kind: email value: case@example.com match: exact examples: - scope: assessment expression: and: - term: kind: phone value: '+14155552671' match: canonical - or: - term: kind: email value: case@example.com match: exact - term: kind: email value: other@example.com match: exact allOf: - not: required: - email_domain - email - not: required: - email_domain - identifier - not: required: - email_domain - identifier_expression - not: required: - email - identifier - not: required: - email - identifier_expression - not: required: - identifier - identifier_expression examples: - identifier: kind: username value: janedoe match: canonical namespace: customer limit: 25 - identifier_expression: scope: account expression: and: - term: kind: phone value: '+14155552671' match: canonical - or: - term: kind: email value: case@example.com match: exact - term: kind: email value: other@example.com match: exact limit: 25 AccountDirectoryPage: title: Observed account directory page description: >- Distinct observed accounts with retained assessments. Typed identifier searches use stable opaque account order, independent of newly submitted assessments; ordinary and legacy email searches use newest-seen order. One repeatable-read database snapshot supplies each page's rows and totals. Pages do not share a snapshot: new matching accounts may appear on a later page or before the cursor and be missed until a fresh search; retention, erasure and changed membership can remove results. Current account decisions are read separately and may advance during a page. Cursors bind the workspace/environment, operation and filters, expire, and cannot cross scopes. Erasure and retention always take precedence over pagination. type: object additionalProperties: false required: - schema_version - items - total - total_capped properties: schema_version: const: '1' description: Version of the body shape. items: type: array maxItems: 50 items: type: object additionalProperties: false required: - account_id - latest - assessments properties: waiting_for: type: array minItems: 1 maxItems: 2 uniqueItems: true items: enum: - outcome - review description: >- Present for needs_action searches. outcome means a current review/block decision lacks a retained effective outcome; review means a retained open or in-progress review. Both can apply. account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ latest: title: Historical assessment revision description: >- One stored assessment revision with its original decision, policy, flow and depth. Never re-scored and never paired with current account risk. Current retention and detailed-scope restrictions still apply. type: object additionalProperties: false required: - schema_version - id - status - flow - depth - detail properties: schema_version: const: '1' description: Version of the body shape. id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: This assessment's id, equal to detail.assessment_id. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' status: enum: - complete - partial - pending description: The status of this exact stored revision. flow: enum: - account_creation - login - purchase description: The flow that created the assessment. depth: enum: - quick - full description: >- The depth the assessment was served at: the request's, or its flow's default. An assessment made before depths existed reports full. detail: title: Assessment detail description: >- This assessment's own facts: its score, recommendation, signals, coverage and timing. type: object additionalProperties: false required: - schema_version - assessment_id - account_id - status - confidence - incomplete_sources - policy_version - policy_basis - assessment_version - created_at - updated_at - expires_at - timing properties: schema_version: const: '1' description: Version of the body shape. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' account_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: >- The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ identifiers: type: object additionalProperties: false minProperties: 1 description: >- The identifiers this assessment was sent, exactly as received. Served only to a key holding the history scope, on GET /v1/assessments/{assessment_id} and every history read: an exact version, search, the account's assessments and its export. Absent from the POST /v1/assessments answer (the caller holds what it sent), from every webhook, for a key without the history scope, and for an assessment made before NoResponse kept them. properties: email: type: string minLength: 3 maxLength: 254 description: identifiers.email as the request sent it. username: type: string minLength: 1 maxLength: 64 description: identifiers.username as the request sent it. phone: type: string minLength: 9 maxLength: 16 description: identifiers.phone as the request sent it. name: type: string minLength: 1 maxLength: 128 description: >- identifiers.name as the request sent it, before NFC normalisation. ip: type: string minLength: 2 maxLength: 39 description: identifiers.ip as the request sent it. request_id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ description: >- An optional provider correlation id, echoed back. It is not an idempotency key. Refuses an exact-shape JWT or a bare 40, 64 or 128 character hex digest; a UUID is accepted. not: description: >- refused_text plus secret_hex_digest and secret_encoded, for request_id and username. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exactly 40, 64 or 128 hex characters (SHA-1, SHA-256, SHA-512) and nothing else. Refused in username and request_id, where such a value is almost certainly a credential hash; a 39 or 41 character hex string, a short hex word such as 'deadbeef' or a UUID is accepted. Not refused in account_id: a hex digest of an internal id is a common pseudonymous account id and not a secret under. pattern: >- ^(?:[0-9A-Fa-f]{40}|[0-9A-Fa-f]{64}|[0-9A-Fa-f]{128})$ - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ status: enum: - complete - partial - pending description: >- Processing state, separate from evidence coverage. complete: final; nothing is still running, but unsupported, failed or unanswered lanes remain in incomplete_sources. partial: a recommendation exists and evidence is incomplete; assessment_url identifies continuing work when present. pending: no recommendation yet; poll or wait for the webhook. Finished processing does not mean all sources answered. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. confidence: enum: - low - medium - high - unavailable description: >- Evidence coverage: how much of the planned source evidence gave a definite answer. This is not confidence that an identity is genuine, agreement between identifiers, a risk score or a probability. unavailable means no usable evidence answered; a terminal uncovered assessment can have this value and recommend review. risk: type: object additionalProperties: false required: - score - band - recommendation - confidence - policy_version - policy_basis - reasons - coverage description: >- the one risk decision for this assessment. score is 0 (safe) to 100 (risky), set by the reasons that fired under a hand-set, versioned policy. The policy's weights are not published: each reason carries its direction and a coarse impact band instead. Every served answer with a recommendation carries it, and there the top-level recommendation equals risk.recommendation. block is true from the workspace's block threshold (block_threshold), off by default. It names no source or provider. properties: score: type: integer minimum: 0 maximum: 100 band: enum: - low - medium - high - critical description: >- low 0-29, medium 30-59, high 60-84, critical 85-100. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. block: type: boolean description: >- true when the workspace's block threshold is set and score reached it. A provider hook can deny the account creation on it; the provider decides and enforces. It does not change recommendation. It is false while blocking is off, the default, and a body from before the flag existed omits it: read absent as false. block_threshold: type: integer minimum: 1 maximum: 100 description: >- The block threshold this answer used: block is true exactly when score is at least this value. Absent while blocking is off. NoResponse sets it per workspace on request, at or above the review threshold. step_up_threshold: type: integer minimum: 1 maximum: 100 description: >- The score at which this answer's flow starts to recommend step_up. Absent from an answer stored before it was recorded. review_threshold: type: integer minimum: 1 maximum: 100 description: >- The score at which this answer's flow starts to recommend review. An answer nothing answered recommends review below it, with confidence unavailable. Absent from an answer stored before it was recorded. confidence: enum: - low - medium - high description: >- How much of the planned evidence answered; it says nothing about risk. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' policy_basis: const: heuristic_unvalidated reasons: type: array maxItems: 32 description: >- Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band. items: type: object additionalProperties: false description: >- One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high. required: - code - direction - impact properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. direction: enum: - raises - lowers - neutral impact: enum: - none - low - medium - high identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The list entry a list_match reason applied. No other reason carries it. summary: type: object additionalProperties: false properties: phone: type: object additionalProperties: false properties: line_type: enum: - mobile - voip - landline - toll_free - other country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n report_count: type: integer minimum: 0 description: >- Highest report count any source gave for the number. carrier: type: string minLength: 1 maxLength: 128 description: >- Carrier-network metadata from privately weighted sources; not upstream provider attribution. email: type: object additionalProperties: false properties: disposable: type: boolean accounts_found: type: integer minimum: 0 description: Accounts found for the email. breach: type: object additionalProperties: false required: - found description: >- Breach facts for the email. Replaces the boolean breached. properties: found: type: boolean breach_count: type: integer minimum: 0 description: >- Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed username: type: object additionalProperties: false properties: accounts_found: type: integer minimum: 0 description: Accounts found for the username. breach: type: object additionalProperties: false required: - found description: Breach facts for the username. properties: found: type: boolean breach_count: type: integer minimum: 0 description: >- Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed ip: type: object additionalProperties: false description: >- Facts about the submitted IP from the offline database and this workspace's own recent assessments. Every member is optional; absent makes no claim. properties: country: type: string pattern: ^[A-Z]{2}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: ISO 3166-1 alpha-2 country of the address. type: enum: - residential - hosting - vpn - proxy - tor - mobile - unknown description: The address's network type. asn: type: integer minimum: 1 maximum: 4294967295 description: >- Autonomous system number of the network that announces the address, from the offline database. Absent when unknown. seen_in_workspace: type: integer minimum: 0 description: >- Assessments in this workspace with the same IP in the last 24 hours, this one included. A count only. consistency: type: object additionalProperties: false description: >- Cross-identifier agreement, computed from facts only. Every member is optional; absent makes no claim. properties: name: enum: - match - partial - mismatch - unknown description: >- The submitted name against breach names and caller-ID names. phone: enum: - match - partial - mismatch - unknown description: >- The submitted phone against numbers found next to the email in breach records. ip: enum: - match - partial - mismatch - unknown description: >- The submitted IP against IPs found next to the email or username in breach records. country: enum: - consistent - mismatch - unknown description: >- IP country, phone country, breach countries and policy_context.region together. When the breach records give a country, the timezone and locale countries count too. The IP country of a proxy or hosting network does not count. footprint: type: object additionalProperties: false description: >- How long and how widely the signup's email and username have existed, and how far independent sources agree on the person behind them, in years and counts only. families are the kinds of evidence that found either identifier. Omitted when nothing found them: a footprint lookup that failed makes no claim, and absence is no_digital_footprint's to state. required: - families properties: email: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). username: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). coherence: type: object additionalProperties: false minProperties: 1 properties: birth_date: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 gender: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 nationality: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 country: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 city: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 zip: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 name: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 company: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 website: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 social: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 description: >- A few typed facts per identifier. Every fact is optional: absent means the evidence did not answer and makes no claim, while false or 0 is a definite answer. Lanes that do not exist yet leave their members absent. coverage: type: object additionalProperties: false required: - answered - failed - pending description: >- Counts of planned source-identifier pairs by evidence outcome, deduplicated across signals and incomplete entries. These counts do not measure identity agreement or prove that processing is still running. A lane that was not searched is not an answered source. properties: answered: type: integer minimum: 0 description: >- Source-identifier pairs that gave a definite found or not_found answer. failed: type: integer minimum: 0 description: >- Source-identifier pairs that could not answer, including unsupported coverage markers and source failures. Read detailed signals to distinguish Not covered from Failed. pending: type: integer minimum: 0 description: >- Source-identifier pairs with deferred or timed_out evidence. A terminal timeout can remain here after processing finishes; use assessment status and continuation metadata to determine whether work is still running. details: type: object additionalProperties: false description: >- Detailed view only (response_mode=detailed, which needs the detailed scope); a standard answer never carries it. Merged observations: no provider, source, origin, raw breach record, value or score. properties: phone_names: type: array maxItems: 32 items: type: object additionalProperties: false required: - value - seen_by properties: value: type: string minLength: 1 maxLength: 128 seen_by: type: integer minimum: 1 breaches: type: array maxItems: 100 items: type: object additionalProperties: false required: - name - kind - matched_on description: >- One breach table that matched, detailed view only. No member carries a record, value, password or hash. properties: name: type: string minLength: 1 maxLength: 128 not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The breached site's domain, lower case. Absent when the table has none (a credential list, for example). category: type: string pattern: ^[a-z0-9_]{1,64}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The table's category from its name, lower case (social, gaming, combolist...). kind: enum: - site_breach - credential_list - stealer_log - scrape - hacking_forum - abuse_service - darkweb_site description: >- Who is in the table: site_breach, a site's own users; credential_list, a combolist or compilation; stealer_log, malware or botnet victims; scrape; hacking_forum, a criminal hacking, cracking or carding community; abuse_service, the customers of DDoS-for-hire, account generators, dump or card shops, darknet markets, stalkerware or breach-lookup services; darkweb_site, an onion site of unknown purpose. year: type: integer minimum: 1970 maximum: 2100 description: A breach table's date year. month: type: integer minimum: 1 maximum: 12 description: Absent when only the year is known. matched_on: enum: - email - username - ip description: >- The submitted email or username whose own search matched the table. The phone is never searched. A submitted full name is searched as well, and what that search finds feeds the identity's facts and reasons rather than this list. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. conduct: type: array minItems: 1 maxItems: 3 uniqueItems: true items: enum: - chargeback - declined_payment - forum_sanction description: >- What a breach table's rows record against the identifier: chargeback, one or more chargebacks; declined_payment, one or more declined payments; forum_sanction, a forum ban, warning or infraction. A category and not a value: the schema has no member for one. description: >- What this table's rows record against the matched email or username: the tables behind the forum_sanctioned and prior_payment_abuse reasons. Absent when the rows record none, for a table matched on an IP address, and from an answer stored before it was recorded. description: >- The matching breach tables, newest first, at most 100. breach_names: type: array maxItems: 32 description: >- Names found next to the identifiers in breach records, merged, with the number of distinct tables each was seen in and the sites of those tables. items: type: object additionalProperties: false required: - value - seen_in properties: value: type: string minLength: 1 maxLength: 128 seen_in: type: integer minimum: 1 sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables hold the name, lower case, each once, newest breach first, at most 32: the domain values of breaches[]. Covers the email's and the username's tables together. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables that hold the name have no site, such as a credential list or a stealer log. Absent when none. events: type: array maxItems: 300 description: >- The identity's dated footprint events, newest first, at most 300: the year and month, what happened (created, last_active, breached), the site, its category, the kind of evidence and the identifier it belongs to. No breach value: dates are coarsened to the month. items: type: object additionalProperties: false required: - year - kind - site - category - family - identifier properties: year: type: integer minimum: 1970 maximum: 2100 month: type: integer minimum: 1 maximum: 12 kind: enum: - created - last_active - breached site: type: string minLength: 1 maxLength: 128 not: pattern: '[\x00-\x1f\x7f]' category: type: string pattern: ^[a-z0-9_]{1,64}$ family: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). identifier: enum: - email - username accounts: type: array maxItems: 64 description: >- Every online-account search of the email or username: the platform, what the search came to and, for an account found, what the platform returned beside it. Found first, then not found, then searches that failed or are still running, each by platform name; at most 64. A failed or running search keeps its own outcome and is not reported as not_found. items: type: object additionalProperties: false required: - name - domain - identifier - outcome description: >- One online-account search of the signup's email or username, detailed view only. name and domain name the platform searched, not a provider. outcome is the search's signal outcome: found, not_found, or a failure (blocked, unavailable, inconclusive) with its reason; a failure is not reported as not_found. The members after reason are what the platform returned beside an account it found, each absent when it did not say. properties: name: type: string minLength: 1 maxLength: 64 description: >- The platform's name, such as Adobe or GitHub. domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ description: >- The platform's domain, lower case: the host its logo is fetched for. identifier: enum: - email - username description: The identifier searched. outcome: enum: - found - not_found - inconclusive - blocked - unavailable description: >- Per-signal outcome. A failure is never not_found: a source that timed out, was blocked or errored reports blocked, unavailable or inconclusive with a reason, and is listed in incomplete_sources. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a signal or source did not produce a definite found/not_found. timed_out means the source missed the request deadline; a continuation may still settle it. deferred means the (source, identifier) pair is async-only and was not attempted on the synchronous path; a continuation settles it. sign_in: type: array minItems: 1 maxItems: 7 uniqueItems: true items: enum: - password - google - facebook - apple - microsoft - sso - other description: >- How the account signs in, as the platform reports it, sorted: a password, a Google, Facebook, Apple or Microsoft account, the organisation's single sign-on, or another method. email_verified: type: boolean description: >- Whether the platform says the account's email is verified. blocked: type: boolean description: >- Whether the platform says the account is blocked or suspended. account_type: enum: - personal - business description: >- personal, or business: an account a company or school manages. has_avatar: type: boolean description: >- Whether the account has its own profile picture rather than the platform's default. The picture is not returned. first_name_prefix: type: string minLength: 1 maxLength: 32 description: >- The first letters of the account holder's first name, as the platform shows them (Life360 shows two and hides the rest). It is evidence only: it does not change the score or the consistency results. attribute_conflicts: type: array maxItems: 4 description: >- What an identity_attribute_conflict reason weighed: each attribute the records disagree on and the sites reporting it. Absent when the reason did not fire, and on an answer stored before conflicts were recorded. No value is served. items: type: object additionalProperties: false required: - attribute properties: attribute: enum: - birth_date - gender - nationality - name_gender description: >- name_gender is the records' gender against the submitted first name's usual one. sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables report the attribute, newest breach first, at most 32. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables reporting the attribute have no site, such as a credential list or a stealer log. Absent when none. allOf: - if: properties: block: const: true required: - block then: required: - block_threshold signals: type: array maxItems: 256 items: type: object additionalProperties: false required: - type - identifier - outcome - source_id - freshness properties: type: type: string minLength: 1 maxLength: 64 pattern: ^[a-z][a-z0-9_]{0,63}$ description: >- The producer emits only registered, active types with a registered identifier kind and outcome. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' identifier: enum: - email - username - phone - ip description: >- Which submitted identifier a signal concerns. ip is a selector of breach_exposure only. outcome: enum: - found - not_found - inconclusive - blocked - unavailable description: >- Per-signal outcome. A failure is never not_found: a source that timed out, was blocked or errored reports blocked, unavailable or inconclusive with a reason, and is listed in incomplete_sources. source_id: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9_.-]{0,63}$ description: >- Opaque, workspace-scoped projection of the source that produced a signal. It remains stable for this workspace while the projection key is unchanged, but never identifies an upstream provider, feed, breach table or source record. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a signal or source did not produce a definite found/not_found. timed_out means the source missed the request deadline; a continuation may still settle it. deferred means the (source, identifier) pair is async-only and was not attempted on the synchronous path; a continuation settles it. evidence_ref: type: string pattern: ^evr_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque pointer to evidence NoResponse holds for this signal. It never encodes the evidence itself (no breach value, credential or page body). not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' observed_at: type: string format: date-time description: When the evidence was first observed. last_checked_at: type: string format: date-time description: >- When the source was last queried for this identifier. freshness: enum: - fresh - stale - unknown description: >- Freshness class of the evidence behind a signal. unknown whenever no evidence was obtained. enrichment: type: object additionalProperties: false required: - fields properties: fields: type: object minProperties: 1 additionalProperties: false properties: phone: type: string maxLength: 8192 name: type: string maxLength: 8192 carrier: type: string maxLength: 8192 line_type: type: string maxLength: 8192 entity_type: type: string maxLength: 8192 country_code: type: string maxLength: 8192 country: type: string maxLength: 8192 state: type: string maxLength: 8192 city: type: string maxLength: 8192 location: type: string maxLength: 8192 national_format: type: string maxLength: 8192 job_title: type: string maxLength: 8192 company_name: type: string maxLength: 8192 email: type: string maxLength: 8192 website: type: string maxLength: 8192 first_call_at: type: string maxLength: 8192 last_call_at: type: string maxLength: 8192 matched_name: type: string maxLength: 8192 alternate_names: type: array maxItems: 1024 items: type: - string - number - boolean - object - array name_candidates: type: array maxItems: 1024 items: type: - string - number - boolean - object - array timezones: type: array maxItems: 1024 items: type: - string - number - boolean - object - array emails: type: array maxItems: 1024 items: type: - string - number - boolean - object - array websites: type: array maxItems: 1024 items: type: - string - number - boolean - object - array locations: type: array maxItems: 1024 items: type: - string - number - boolean - object - array social_profiles: type: array maxItems: 1024 items: type: - string - number - boolean - object - array report_count: type: integer minimum: 0 tag_count: type: integer minimum: 0 total_calls: type: integer minimum: 0 calls_60_days: type: integer minimum: 0 reports_60_days: type: integer minimum: 0 searches_60_days: type: integer minimum: 0 comment_count: type: integer minimum: 0 names_count: type: integer minimum: 0 spam_report_count: type: integer minimum: 0 description: >- Only present for a found phone signal. Curated facts about the number, not raw upstream documents and never the provider's identity, scores or verdicts; follows normal record retention/deletion. allOf: - if: properties: outcome: const: found required: - outcome then: required: - evidence_ref - observed_at - last_checked_at properties: freshness: enum: - fresh - stale not: required: - reason description: >- A definite presence: evidence exists, so its freshness is known. - if: properties: outcome: const: not_found required: - outcome then: required: - last_checked_at not: anyOf: - required: - reason - required: - evidence_ref description: >- A definite absence. Carries no failure reason: a timeout, block or error is never encoded as not_found. - if: properties: outcome: enum: - inconclusive - blocked - unavailable required: - outcome then: required: - reason - if: properties: outcome: enum: - blocked - unavailable required: - outcome then: properties: freshness: const: unknown not: anyOf: - required: - evidence_ref - required: - observed_at description: >- No evidence was obtained, so there is nothing observed and nothing to reference. - if: required: - enrichment then: properties: identifier: const: phone outcome: const: found description: >- Detailed view only (response_mode=detailed, which needs the detailed scope): a standard answer omits signals[], and a detailed one always carries it, possibly empty. At most one signal per (type, source_id, identifier). incomplete_sources: type: array maxItems: 256 items: type: object additionalProperties: false required: - lane - reason description: >- One lane with missing evidence and why. It can mean unsupported input, source failure or unfinished work. It names a lane, never a source: detailed signals distinguish the source-identifier pairs behind it. A lane is listed once. A complete assessment can retain missing lanes; completion never establishes a successful search. A lane that missed its deadline is timed_out, never not_found. properties: lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred description: >- Why a lane did not settle. insufficient_evidence is a settled verdict (an inconclusive signal), never a reason to list a lane as incomplete. deferred means the lane is async-only and still running; a continuation settles it. timed_out means the lane missed its deadline. description: >- The lanes that did not settle, each listed once with a reason; never a source. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match. policy_version: type: string minLength: 1 maxLength: 64 pattern: ^[a-z0-9][a-z0-9._-]{0,63}(\+t[1-9][0-9]{0,8})?$ description: >- Version of the hand-authored heuristic policy that produced the recommendation, for example 'risk-2026-10.7'. A workspace threshold override adds a +t suffix, e.g. 'risk-2026-10.7+t3'. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' policy_basis: const: heuristic_unvalidated assessment_version: type: integer minimum: 1 maximum: 1000 description: >- Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version. created_at: type: string format: date-time description: >- When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at. updated_at: type: string format: date-time expires_at: type: string format: date-time description: >- After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus the workspace's retention period at creation (default 365 days, at most 365). Fixed per record: a later async revision never extends it, and a new assessment for the same account never renews an older one. If the workspace later shortens retention, the effective expiry becomes created_at + min(retention at creation, current retention). assessment_url: type: string maxLength: 64 pattern: ^/v1/assessments/asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Server-relative path of the authoritative assessment, GET /v1/assessments/{assessment_id}. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' timing: type: object additionalProperties: false required: - deadline_ms - elapsed_ms properties: deadline_ms: type: integer minimum: 50 maximum: 3000 description: >- The budget the server applied to the synchronous answer. elapsed_ms: type: integer minimum: 0 maximum: 600000 description: >- Server time from HTTP ingress to this revision of the assessment. auth_context: type: object additionalProperties: false required: - provider - issuer - verified - transport description: >- The identity fields of the auth context the assessment was made with, echoed for the workspace's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score. properties: provider: type: string pattern: ^[a-z0-9][a-z0-9._-]{1,31}$ description: The provider slug the context named. issuer: type: string maxLength: 256 pattern: ^https://[^\s]+$ description: The issuer the context named. subject: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The subject the context named; absent when it named none (a pre_registration hook). session_id: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The session identifier the context named, when it named one. organization_id: type: string maxLength: 256 pattern: ^[A-Za-z0-9._:@/|+=~-]{1,256}$ description: >- The organization identifier the context named, when it named one. verified: type: boolean description: >- The verified flag the context carried. A provider_hook context is always false. transport: type: string enum: - backend - browser - provider_hook description: >- Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook. hook_point: type: string enum: - pre_registration - post_registration - pre_login - post_login - token_issuance description: >- The provider event a provider_hook context was sent for; absent for any other transport. if: properties: transport: const: provider_hook then: required: - hook_point properties: verified: const: false else: not: required: - hook_point allOf: - if: properties: status: const: complete required: - status then: required: - recommendation properties: incomplete_sources: items: properties: reason: not: const: deferred description: >- A complete assessment may list lanes that failed or timed out, never one still running. not: required: - assessment_url - if: properties: status: const: partial required: - status then: required: - recommendation properties: incomplete_sources: minItems: 1 - if: properties: status: const: pending required: - status then: required: - assessment_url not: anyOf: - required: - recommendation - required: - risk properties: confidence: const: unavailable incomplete_sources: minItems: 1 - if: properties: confidence: const: unavailable required: - confidence then: properties: recommendation: const: review - if: properties: risk: required: - details required: - risk then: required: - signals current: title: Account description: >- The account's actual current decision and score, when a current decision exists. It is separate from latest, which is an assessment revision. When omitted, show no current account decision instead of substituting the assessment decision. type: object additionalProperties: false required: - schema_version - id - risk - decisions_by_flow - assessment_id - updated_at - risk_version properties: schema_version: const: '1' description: Version of the body shape. id: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$ description: The account_id the workspace sends with its assessments. not: description: refused_text plus secret_encoded, for account_id. anyOf: - description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' - description: >- Exact shapes only: a complete modular-crypt password hash (bcrypt $2a$/$2b$/$2x$/$2y$ with a two-digit cost and 53 characters; $argon2i/d/id with its m, t, p parameters, salt and hash; md5-crypt $1$, sha256-crypt $5$ or sha512-crypt $6$ with a 22, 43 or 86 character hash; passlib $scrypt$ with ln, r, p, salt and hash) or a three-segment JWT whose header is base64url JSON opening with an "alg", "typ", "kid" or "cty" member (eyJhbGciOi, eyJ0eXAiOi, eyJraWQiOi or eyJjdHkiOi). A value that merely starts with '$2' or 'eyJ', such as eyJohnathan.doe.x, is not refused. Best effort, not a guarantee; see the provider obligation in the README. anyOf: - pattern: ^\$2[abxy]?\$[0-9]{2}\$[./A-Za-z0-9]{53}$ - pattern: >- ^\$argon2(?:id|i|d)\$(?:v=[0-9]{1,4}\$)?m=[0-9]{1,10},t=[0-9]{1,10},p=[0-9]{1,3}\$[A-Za-z0-9+/]{8,}\$[A-Za-z0-9+/]{16,}$ - pattern: >- ^\$[156]\$(?:rounds=[0-9]{1,9}\$)?[./A-Za-z0-9]{1,16}\$(?:[./A-Za-z0-9]{22}|[./A-Za-z0-9]{43}|[./A-Za-z0-9]{86})$ - pattern: >- ^\$scrypt\$ln=[0-9]{1,2},r=[0-9]{1,3},p=[0-9]{1,3}\$[A-Za-z0-9+/.]{8,}\$[A-Za-z0-9+/.]{16,}$ - pattern: >- ^eyJ(?:hbGciOi|0eXAiOi|raWQiOi|jdHkiOi)[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*$ risk: type: object additionalProperties: false required: - score - decision - reasons properties: score: type: integer minimum: 0 maximum: 100 description: >- 0 (safe) to 100 (risky), as risk.score of the assessment. decision: enum: - allow - step_up - review - block - held description: >- The decision for the flow of the assessment this account is served with: on GET /v1/accounts/{account_id}, the flow of the current assessment; inside an assessment, that assessment's flow. reasons: type: array maxItems: 32 description: >- Every reason that fired: risk-raising reasons first, then neutral, then risk-lowering, each strongest impact band first and then by code. The policy's numeric weights are kept private, so a reason carries only its direction and impact band. items: type: object additionalProperties: false description: >- One reason that fired. direction is whether it raises or lowers the score, or is neutral (informational, it moves nothing). impact is a coarse band of how much it moves the score: none for a neutral reason, otherwise low, medium or high. required: - code - direction - impact properties: code: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. direction: enum: - raises - lowers - neutral impact: enum: - none - low - medium - high identifier: enum: - email - username - phone - name - ip - context description: >- The submitted identifier or bounded client context a reason concerns; absent when it concerns the whole assessment. Context is a claimed, untrusted hint and never a device fingerprint. list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The list entry a list_match reason applied. No other reason carries it. decisions_by_flow: type: object additionalProperties: false required: - account_creation - login - purchase description: >- The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed. properties: account_creation: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. login: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. purchase: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: The assessment the current risk comes from. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' updated_at: type: string format: date-time description: updated_at of that assessment's latest revision. risk_version: type: integer minimum: 1 description: >- The version of the account's current risk. It increases every time the account's current risk or decisions_by_flow changes, and does not decrease. Of two copies of an account, the one with the higher risk_version is newer. account.risk_changed carries the risk_version that its change made. $defs: account_decision: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. assessments: type: integer minimum: 1 description: >- Count of admitted retained assessments belonging to this account, not just the returned page. matched_identifier: title: Identifier match description: >- Why this result matched a typed identifier search. value is the original value submitted in assessment_id. Provenance records a customer submission, not a source discovery or verified ownership. Equality is deterministic and has no inferred confidence score. An account result names its newest retained matching assessment, which can differ from latest. type: object additionalProperties: false required: - kind - value - match_basis - provenance - assessment_id properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 match_basis: type: string enum: - exact - canonical - mailbox provenance: type: string enum: - submitted description: >- Customer-submitted input. It does not mean the customer or NoResponse verified ownership. namespace: type: string enum: - customer description: >- Present only for username. A source platform handle is not a customer-namespace username. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' allOf: - if: properties: kind: const: username required: - kind then: required: - namespace else: not: required: - namespace - if: properties: match_basis: const: mailbox required: - match_basis then: properties: kind: const: email examples: - kind: username value: JaneDoe match_basis: canonical namespace: customer provenance: submitted assessment_id: asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM matched_identifiers: type: array minItems: 1 maxItems: 8 items: title: Submitted identifier term match description: >- One satisfied unique term in an identifier expression. term_index is the zero-based depth-first raw leaf position of its first occurrence. Duplicate normalized terms produce one witness. All satisfied unique terms are returned, ordered by term_index, including satisfied terms in an OR branch that was not needed. value preserves the original submitted value in assessment_id. In assessment scope all witnesses belong to the same matching assessment; account search chooses the newest such assessment. In account scope each term uses its newest retained matching assessment, so witnesses may have different assessment IDs. This evidence does not assert ownership or equality between accounts. type: object additionalProperties: false required: - kind - value - match_basis - provenance - assessment_id - term_index properties: kind: type: string enum: - email - phone - username value: type: string minLength: 1 maxLength: 254 match_basis: type: string enum: - exact - canonical - mailbox provenance: type: string enum: - submitted description: >- Customer-submitted input. It does not mean the customer or NoResponse verified ownership. namespace: type: string enum: - customer description: >- Present only for username. A source platform handle is not a customer-namespace username. assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' term_index: type: integer minimum: 0 maximum: 7 description: >- Zero-based depth-first position of the first occurrence of this normalized term in the submitted expression. allOf: - if: properties: kind: const: username required: - kind then: required: - namespace else: not: required: - namespace - if: properties: match_basis: const: mailbox required: - match_basis then: properties: kind: const: email examples: - kind: username value: JaneDoe match_basis: canonical namespace: customer provenance: submitted assessment_id: asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM term_index: 0 description: >- Present only for identifier_expression. All satisfied unique terms, ordered by term_index, with original submitted values and retained assessment witnesses. A duplicate normalized term appears once at its first raw leaf index. The legacy single identifier filter instead returns matched_identifier. total: type: integer minimum: 0 maximum: 10000 description: >- Distinct accounts matching the filters, exact below 10000 and capped at 10000. total_capped: type: boolean description: True when at least 10000 accounts match. next_cursor: type: string minLength: 1 maxLength: 1024 pattern: ^[A-Za-z0-9_-]+$ not: pattern: \n description: >- Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: SearchAccounts200: description: Account-level paginated search results content: application/json: schema: $ref: '#/components/schemas/AccountDirectoryPage' headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true InvalidHistoryQuery: description: >- The request body, filters or bounds are invalid (invalid_request), or the opaque cursor is invalid, expired, modified, or belongs to another operation, filter or authenticated scope (invalid_cursor). content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef NotFound: description: >- No unexpired assessment with this id for the calling workspace, or a malformed assessment_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.