> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Count assessments by time, decision and reason > Count the assessments of this environment created in [from,to), by hour, day or week. Each assessment counts one time, by its first answer. Group by up to two of decision, flow, recommendation, band, reason, lane, country, ASN and list match, and add a score histogram for each flow and the account decisions that changed after the first answer. Reasons show their code and impact band only. The filters are the same as search: send them to search with revision first to find the assessments behind a count. This read does not require an idempotency key. ## OpenAPI ````yaml /openapi.json post /v1/assessments/aggregate openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/assessments/aggregate: post: tags: - assess summary: Count assessments by time, decision and reason description: >- Count the assessments of this environment created in [from,to), by hour, day or week. Each assessment counts one time, by its first answer. Group by up to two of decision, flow, recommendation, band, reason, lane, country, ASN and list match, and add a score histogram for each flow and the account decisions that changed after the first answer. Reasons show their code and impact band only. The filters are the same as search: send them to search with revision first to find the assessments behind a count. This read does not require an idempotency key. operationId: aggregateAssessments requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssessmentAggregateRequest' responses: '200': $ref: '#/components/responses/AggregateAssessments200' '400': $ref: '#/components/responses/InvalidAggregate' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/AggregateErasedData' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/assessments/aggregate' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "from": "2026-10-19T00:00:00Z", "to": "2026-10-26T00:00:00Z", "bucket": "week", "time_zone": "UTC", "limit": 20, "country": "GB" }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.assessments.aggregate({ from: "2026-10-19T00:00:00Z", to: "2026-10-26T00:00:00Z", bucket: "week", country: "GB", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.assessments.aggregate(from_="2026-10-19T00:00:00Z", to="2026-10-26T00:00:00Z", bucket="week", time_zone="UTC", limit=20, country="GB") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Assessments.Aggregate(ctx, components.AssessmentAggregateRequest{\n From: \"2026-10-19T00:00:00Z\",\n To: \"2026-10-26T00:00:00Z\",\n Bucket: components.BucketWeek,\n Country: noresponse.Pointer(\"GB\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: > package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.AggregateAssessmentsResponse; import org.noresponse.models.shared.AssessmentAggregateRequest; import org.noresponse.models.shared.Bucket; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); AssessmentAggregateRequest req = AssessmentAggregateRequest.builder() .from("2026-10-19T00:00:00Z") .to("2026-10-26T00:00:00Z") .bucket(Bucket.WEEK) .country("GB") .build(); AggregateAssessmentsResponse res = sdk.assessments().aggregate() .request(req) .call(); if (res.assessmentAggregate().isPresent()) { System.out.println(res.assessmentAggregate().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); AssessmentAggregateRequest req = new AssessmentAggregateRequest() { From = "2026-10-19T00:00:00Z", To = "2026-10-26T00:00:00Z", Bucket = Bucket.Week, Country = "GB", }; var res = await sdk.Assessments.AggregateAsync(req); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $request = new Shared\AssessmentAggregateRequest( from: '2026-10-19T00:00:00Z', to: '2026-10-26T00:00:00Z', bucket: Shared\Bucket::Week, country: 'GB', ); $response = $sdk->assessments->aggregate( request: $request ); $result = $response->result; // handle response - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) req = Models::Shared::AssessmentAggregateRequest.new( from: '2026-10-19T00:00:00Z', to: '2026-10-26T00:00:00Z', bucket: Models::Shared::Bucket::WEEK, country: 'GB' ) res = s.assessments.aggregate(request: req) unless res.nil? # handle response end components: schemas: AssessmentAggregateRequest: title: Workspace assessment aggregate description: >- Count this environment's assessments created in [from,to) by bucket, from counts kept as each assessment is first answered, not by scanning assessments. Each assessment counts once, by its first answer (the answer served when it was first answered); later revisions and late results do not count it again, and late_flips counts its later account decision changes. from and to start a bucket (an hour, or a day or a week from Monday that starts at midnight in time_zone, UTC by default), cover at most 366 days (31 for hour buckets, 92 for day and week buckets in a time_zone other than UTC) and from is inside the retention period. The filters are POST /v1/assessments/search's and describe the first answer, so a cell drills down to search with the same filters, revision first and the cell's bucket as from and to. Counts hold no identifier and stay when an assessment or account is deleted or erased; they expire with retention and go with the workspace. Reasons are counted by code and impact band, not by weight. No Idempotency-Key. Select retained_first_answers for exact facet filters and pairs over retained detail. This mode supports count, score_histogram and score_outcomes, and refuses late_flips. It has a 31-day and 100000-record work budget. type: object additionalProperties: false required: - from - to - bucket properties: from: type: string format: date-time description: The first bucket's start. to: type: string format: date-time description: 'The end, excluded: the start of the bucket after the last.' bucket: enum: - hour - day - week description: >- The period each count covers: an hour, or a day or a week (from Monday) in time_zone. Hour buckets are whole UTC hours in any time zone. time_zone: type: string maxLength: 64 pattern: ^(?:UTC|[A-Za-z_]+(?:/[A-Za-z0-9_+.-]+)+)$ not: pattern: \n default: UTC description: >- The IANA time zone whose local midnight starts each day and week bucket, such as Europe/London or Asia/Kolkata; daylight saving changes make those days 23 or 25 hours long. A name the zone database does not know is refused (400 invalid_request naming time_zone). Day and week buckets in a zone other than UTC cover at most 92 days (400 invalid_request naming to); a year of them reads too many hourly counts to answer in time. Hour buckets stay whole UTC hours. Bucket starts, from and to stay instants. With the default population, a zone whose local midnight falls inside a UTC hour (a half-hour offset such as Asia/Kolkata) is refused for day and week buckets, as those counts are kept by the hour; retained_first_answers counts it. group_by: type: array maxItems: 2 uniqueItems: true items: enum: - decision - flow - recommendation - band - reason - lane - country - asn - list_match description: >- decision, recommendation and band: the first answer's. flow: the assessment's. list_match: the action of the list entry that decided the account when it was first answered. reason: a reason the first answer fired, with its impact band. lane: an evidence lane the first answer listed in incomplete_sources. country and asn: the submitted IP's, from the IP data. description: >- At most two dimensions to count by, of which at most one is reason, lane, country or asn. An assessment counts once in each of its reasons and incomplete lanes, so those groups can add up to more than the bucket's count. With population retained_first_answers, both dimensions can be facets; counts cover retained first answers only. metrics: type: array minItems: 1 maxItems: 4 uniqueItems: true items: enum: - count - score_histogram - score_outcomes - late_flips default: - count description: >- count: each bucket's count and groups. score_histogram: first answers by flow and 5-point score bucket. score_outcomes: the histogram's first answers that have a reported outcome, by flow, 5-point score bucket and the latest outcome reported for the assessment (POST /v1/assessments/{assessment_id}/outcomes); the rest of a bin has none reported. late_flips: changes of an assessment's account decision for its flow after its first answer, by from, to and delay. limit: type: integer minimum: 1 maximum: 100 default: 20 description: >- The most groups answered: the largest over the whole range, then by value. groups_truncated says when there were more. flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. status: enum: - complete - partial - pending description: The first answer's status. recommendation: enum: - allow - step_up - review description: The first answer's recommendation. decision: type: string enum: - allow - step_up - review - block description: >- The first answer's decision: block when its risk.block was true, otherwise its recommendation. Combined with recommendation using AND. revision: enum: - latest - first description: >- Always first: the aggregate counts first answers. Accepted so a filter can be sent to search unchanged; latest is refused. population: enum: - first_answers - retained_first_answers default: first_answers description: >- first_answers uses anonymous counters that can include erased detail. retained_first_answers computes exact intersections over retained first answers within 31 days. Requests exceeding the 100000-record work budget are refused. band: enum: - low - medium - high - critical reason: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: A reason fired by the selected stored revision. impact: enum: - none - low - medium - high description: The selected reason's served impact band. Requires reason. lane: enum: - accounts - phone - breach - domain - ip description: An incomplete lane in the selected stored revision. country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n asn: type: integer minimum: 1 maximum: 4294967295 score_min: type: integer minimum: 0 maximum: 100 description: >- Inclusive lower score bound. Pending answers without a score do not match. score_max: type: integer minimum: 0 maximum: 100 description: >- Inclusive upper score bound, at least score_min when both are supplied. list_match: enum: - allow - block - none description: >- The list action captured at the first answer. Requires revision first. Older answers without captured list state do not match, including none. allOf: - if: required: - impact then: required: - reason AssessmentAggregate: title: Workspace assessment aggregate description: >- Body of the 200 answer to POST /v1/assessments/aggregate: one entry per bucket of [from,to), empty buckets included. Counts are of first answers and stay when an assessment or account is deleted or erased; search returns only assessments still retained. type: object additionalProperties: false required: - schema_version - from - to - bucket - group_by - metrics - time_zone - retention_days - groups_truncated - buckets properties: schema_version: const: '1' description: Version of the body shape. from: type: string format: date-time to: type: string format: date-time bucket: enum: - hour - day - week group_by: type: array maxItems: 2 items: enum: - decision - flow - recommendation - band - reason - lane - country - asn - list_match description: >- decision, recommendation and band: the first answer's. flow: the assessment's. list_match: the action of the list entry that decided the account when it was first answered. reason: a reason the first answer fired, with its impact band. lane: an evidence lane the first answer listed in incomplete_sources. country and asn: the submitted IP's, from the IP data. metrics: type: array minItems: 1 maxItems: 4 items: enum: - count - score_histogram - score_outcomes - late_flips time_zone: type: string maxLength: 64 description: >- The time zone whose local midnight started each day and week bucket, as requested; UTC when the request named none. retention_days: type: integer minimum: 1 maximum: 365 default: 365 description: >- The calling workspace's configured retention period in days. Default 365 (12 months), which is also the maximum: a workspace may only shorten it, to at least 1 day. Each record expires from its own created_at; see assessment expires_at. groups_truncated: type: boolean description: true when more groups had counts than limit allowed. coverage: type: object additionalProperties: false required: - as_of - first_answers_started_at - score_outcomes_started_at - retained_from - population - erased_records_included - overlapping_groups - late_flip_unit - historical_backfill description: >- Captured in the same database snapshot as the counts. Capture start times describe when counting began, not the earliest creation time counted: an older assessment may first answer later. Older outcomes are not inferred to be absent. Erased detail cannot be returned by drill-down even while its anonymous count remains. properties: as_of: type: string format: date-time first_answers_started_at: type: string format: date-time score_outcomes_started_at: type: string format: date-time retained_from: type: string format: date-time population: enum: - first_answers - retained_first_answers erased_records_included: type: boolean overlapping_groups: type: boolean late_flip_unit: const: decision_transitions historical_backfill: const: false buckets: type: array maxItems: 744 items: type: object additionalProperties: false required: - start properties: start: type: string format: date-time description: >- The bucket's first instant, in UTC. A day or week bucket in a time zone starts at local midnight there, so in Asia/Tokyo a day starts at 15:00Z the day before. count: type: integer minimum: 0 description: >- Assessments first answered whose creation falls in the bucket. With metric count. groups: type: array maxItems: 100 items: type: object additionalProperties: false required: - count description: >- One group's count in one bucket. It holds each grouped dimension the counted assessments had a value for: a pending first answer has no decision, recommendation or band; an answer that fired no reason, listed no incomplete lane, matched no list entry or whose IP has no known country or ASN leaves that dimension out. properties: decision: type: string enum: - allow - step_up - review - block description: The first answer's decision. flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. band: enum: - low - medium - high - critical list_match: enum: - block - allow - none description: >- The list action captured when the assessment was first answered; none means capture found no matching entry. With population retained_first_answers, absent means the answer predates list-state capture and must not be treated as none. reason: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. impact: enum: - none - low - medium - high description: >- The reason's impact band in the first answer. Present with reason. lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n asn: type: integer minimum: 1 maximum: 4294967295 count: type: integer minimum: 1 description: >- With metric count and group_by: the bucket's counts of the groups answered, largest group first. score_histogram: type: array maxItems: 60 items: type: object additionalProperties: false required: - flow - score_min - score_max - count description: >- First answers of one flow whose risk.score is in [score_min, score_max]: 0-4, 5-9 up to 95-100. A pending answer has no score. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 count: type: integer minimum: 1 score_outcomes: type: array maxItems: 360 items: type: object additionalProperties: false required: - flow - score_min - score_max - outcome - count description: >- First answers of one flow whose risk.score is in [score_min, score_max] and whose assessment's latest reported outcome (the latest received) is outcome. Counted when the first answer is counted and moved when a later outcome wins; outcomes reported before the first answer was counted are counted with it. An outcome reported before this count existed is counted only once another outcome is reported for the assessment. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. count: type: integer minimum: 1 description: >- With metric score_outcomes: the score_histogram's first answers whose assessment has a reported outcome, by its latest. A bin's count less its score_outcomes is the first answers with none reported. late_flips: type: array maxItems: 180 items: type: object additionalProperties: false required: - from - to - delay - count description: >- Changes of the account decision for an assessment's flow after its first answer, as account.risk_changed announces them, counted in the bucket of the assessment's creation. from is the decision announced before (allow before the first announcement); an assessment that changes twice counts twice. properties: from: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. to: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. delay: enum: - under_10s - under_1m - under_10m - under_1h - under_1d - over_1d description: >- How long after the assessment's creation the change was made. count: type: integer minimum: 1 $defs: aggregate_bucket: type: object additionalProperties: false required: - start properties: start: type: string format: date-time description: >- The bucket's first instant, in UTC. A day or week bucket in a time zone starts at local midnight there, so in Asia/Tokyo a day starts at 15:00Z the day before. count: type: integer minimum: 0 description: >- Assessments first answered whose creation falls in the bucket. With metric count. groups: type: array maxItems: 100 items: type: object additionalProperties: false required: - count description: >- One group's count in one bucket. It holds each grouped dimension the counted assessments had a value for: a pending first answer has no decision, recommendation or band; an answer that fired no reason, listed no incomplete lane, matched no list entry or whose IP has no known country or ASN leaves that dimension out. properties: decision: type: string enum: - allow - step_up - review - block description: The first answer's decision. flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. band: enum: - low - medium - high - critical list_match: enum: - block - allow - none description: >- The list action captured when the assessment was first answered; none means capture found no matching entry. With population retained_first_answers, absent means the answer predates list-state capture and must not be treated as none. reason: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. impact: enum: - none - low - medium - high description: >- The reason's impact band in the first answer. Present with reason. lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n asn: type: integer minimum: 1 maximum: 4294967295 count: type: integer minimum: 1 description: >- With metric count and group_by: the bucket's counts of the groups answered, largest group first. score_histogram: type: array maxItems: 60 items: type: object additionalProperties: false required: - flow - score_min - score_max - count description: >- First answers of one flow whose risk.score is in [score_min, score_max]: 0-4, 5-9 up to 95-100. A pending answer has no score. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 count: type: integer minimum: 1 score_outcomes: type: array maxItems: 360 items: type: object additionalProperties: false required: - flow - score_min - score_max - outcome - count description: >- First answers of one flow whose risk.score is in [score_min, score_max] and whose assessment's latest reported outcome (the latest received) is outcome. Counted when the first answer is counted and moved when a later outcome wins; outcomes reported before the first answer was counted are counted with it. An outcome reported before this count existed is counted only once another outcome is reported for the assessment. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. count: type: integer minimum: 1 description: >- With metric score_outcomes: the score_histogram's first answers whose assessment has a reported outcome, by its latest. A bin's count less its score_outcomes is the first answers with none reported. late_flips: type: array maxItems: 180 items: type: object additionalProperties: false required: - from - to - delay - count description: >- Changes of the account decision for an assessment's flow after its first answer, as account.risk_changed announces them, counted in the bucket of the assessment's creation. from is the decision announced before (allow before the first announcement); an assessment that changes twice counts twice. properties: from: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. to: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. delay: enum: - under_10s - under_1m - under_10m - under_1h - under_1d - over_1d description: >- How long after the assessment's creation the change was made. count: type: integer minimum: 1 aggregate_group: type: object additionalProperties: false required: - count description: >- One group's count in one bucket. It holds each grouped dimension the counted assessments had a value for: a pending first answer has no decision, recommendation or band; an answer that fired no reason, listed no incomplete lane, matched no list entry or whose IP has no known country or ASN leaves that dimension out. properties: decision: type: string enum: - allow - step_up - review - block description: The first answer's decision. flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. recommendation: enum: - allow - step_up - review description: Advisory only. The provider decides and enforces. band: enum: - low - medium - high - critical list_match: enum: - block - allow - none description: >- The list action captured when the assessment was first answered; none means capture found no matching entry. With population retained_first_answers, absent means the answer predates list-state capture and must not be treated as none. reason: enum: - no_digital_footprint - voip_number - disposable_email - new_email - no_email_matches - spam_reports - fraud_flag - identity_mismatch - country_mismatch - proxy_ip - seen_before - shared_ip - many_recent_accounts - established_accounts - aged_identity - breach_name_match - breach_cooccurrence - breach_name_mismatch - breach_phone_mismatch - recent_password_exposure - credential_list_exposure - abuse_ecosystem_member - no_breach_history - automation_fast_submit - client_clock_skew - bot_or_automation - auth_email_verified - auth_phone_verified - auth_mfa_recent - auth_new_session - auth_new_account - auth_impersonated - context_timezone_mismatch - context_locale_mismatch - context_line_country_mismatch - prior_abuse_link - test_scenario - shared_api_key - list_match - young_email_domain - email_domain_no_mx - email_domain_nonexistent - google_account_missing - google_empty_account - google_active_profile - google_aged_account - google_name_match - google_name_mismatch - google_country_match - google_country_mismatch - forum_sanctioned - prior_payment_abuse - ip_history_match - identity_attribute_conflict - impossible_identity_age - breach_shared_ip - nationality_mismatch - minor_identity - reported_account_abuse - breach_city_match - breach_city_mismatch description: >- A risk reason from the reviewed list. new_email is retained only for historical decisions: it never measured email age and is no longer emitted. no_email_matches is neutral and requires explicit, complete no-match answers from supported account and breach searches for the email; unsupported, failed, partial or running searches cannot establish it. no_breach_history is neutral and records only a complete email breach search with no matches, independently of account coverage. no_digital_footprint keeps its existing weight for confirmed absence across the searched account and breach families; no extra age proxy is added. old_breach_history and consistent_identity were replaced by the breach codes (aged_identity, breach_name_match, breach_cooccurrence and the mismatches) and are refused. young_email_domain, email_domain_no_mx and email_domain_nonexistent describe the email's domain (the deferred RDAP registration age and the request-time mail answer: email_domain_no_mx means a null MX, or neither an MX nor an address record); a lookup that failed writes nothing and fires none of them. forum_sanctioned and prior_payment_abuse describe the conduct the email's or username's breach rows record: a forum ban, warning or infraction, and recorded chargebacks or many declined payments. ip_history_match means the signup IP is one the email's or username's own breach rows used, from a typed address that is no proxy or hosting network, once the address's own breach search found fewer than twenty people. identity_attribute_conflict means independent breach records and profiles disagree on the birth date, gender or nationality, or the breach gender differs from the submitted first name's usual one; impossible_identity_age means the email address appears in breach records from before, or soon after, the birth date they report, or that birth date is 110 or more years ago; nationality_mismatch means the breach nationality's country differs from three or more of the IP, phone, timezone and locale countries; minor_identity flags a breach birth date under 18 years ago. breach_city_match means two or more breach tables give the city of the IP, from a typed address that is no proxy, hosting or mobile network. breach_city_mismatch is neutral: the breach records give one city and the IP country, and the IP is in a different city, under the same conditions; a missing IP city or a name that cannot be compared makes no claim. breach_shared_ip means the signup IP's own breach records hold five or more different people besides the signup, from a typed address that is no proxy or hosting network; one record's emails and usernames are one person. Mobile carrier addresses are not yet detected. test_scenario appears only on an assessment made with a test key (nrk_test_), which the deterministic simulator answers: its impact is the scenario the magic email or phone chose, and none for any other identifier. A live assessment never carries it. shared_api_key is an account reason, never an assessment one: it appears only in the risk of GET /v1/accounts/{account_id} and the account an assessment carries, when a key your account creation gate issued to the account (issued_credential.sha256) was used from many IP addresses or countries within 24 hours (POST /v1/keys/usage). list_match is an account reason too: one of the account's admitted assessments sent an email, or an email of a domain, on the environment's list (GET /v1/workspaces/{workspace_id}/lists/{environment}). It names the entry in list_entry_id; it raises for a block entry and lowers for an allow entry, and it decides the account whatever the score, which it leaves unchanged. reported_account_abuse is an account-only, tenant-local assertion from a known abuse outcome; it is not independently corroborated evidence and is withdrawn by a correction of that report. impact: enum: - none - low - medium - high description: >- The reason's impact band in the first answer. Present with reason. lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n asn: type: integer minimum: 1 maximum: 4294967295 count: type: integer minimum: 1 aggregate_score_count: type: object additionalProperties: false required: - flow - score_min - score_max - count description: >- First answers of one flow whose risk.score is in [score_min, score_max]: 0-4, 5-9 up to 95-100. A pending answer has no score. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 count: type: integer minimum: 1 aggregate_score_outcome: type: object additionalProperties: false required: - flow - score_min - score_max - outcome - count description: >- First answers of one flow whose risk.score is in [score_min, score_max] and whose assessment's latest reported outcome (the latest received) is outcome. Counted when the first answer is counted and moved when a later outcome wins; outcomes reported before the first answer was counted are counted with it. An outcome reported before this count existed is counted only once another outcome is reported for the assessment. properties: flow: enum: - account_creation - login - purchase description: >- The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow. score_min: type: integer minimum: 0 maximum: 95 description: A multiple of 5. score_max: type: integer minimum: 4 maximum: 100 outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. count: type: integer minimum: 1 aggregate_late_flip: type: object additionalProperties: false required: - from - to - delay - count description: >- Changes of the account decision for an assessment's flow after its first answer, as account.risk_changed announces them, counted in the bucket of the assessment's creation. from is the decision announced before (allow before the first announcement); an assessment that changes twice counts twice. properties: from: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. to: enum: - allow - step_up - review - block - held description: >- block when the score reached the workspace's block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows..admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Advisory: the workspace decides and enforces. delay: enum: - under_10s - under_1m - under_10m - under_1h - under_1d - over_1d description: How long after the assessment's creation the change was made. count: type: integer minimum: 1 Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: AggregateAssessments200: description: Counts of first answers per bucket. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AssessmentAggregate' InvalidAggregate: description: >- The body does not match the aggregate request schema, or its time_zone is unknown, or its range is not bucket aligned in that zone, too long (over 92 days for day or week buckets in a time_zone other than UTC) or before the retention period, or it groups by two of reason, lane, country and asn, or it asks the default population for day or week buckets in a zone whose midnight falls inside an hour. content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef NotFound: description: >- No unexpired assessment with this id for the calling workspace, or a malformed assessment_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found AggregateErasedData: description: >- The first-answer window includes erased contributions. Use retained_first_answers for an eligible retained window. headers: Cache-Control: schema: type: string const: no-store X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - aggregate_erased_data PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.