Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.

Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.

Headers

Idempotency-Key
string
required

Opaque client key, 16 to 128 characters of [A-Za-z0-9._:-] (a UUID or ULID fits). Scoped to the workspace principal and bound to the canonical body for 24 hours.

Required string length: 16 - 128
Pattern: ^[A-Za-z0-9._:-]{16,128}$

Path Parameters

assessment_id
string
required

Path segment, matched case-sensitively. A value that does not match the assessment_id shape answers 404, not 400. Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.

Pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$

Body

application/json

POST /v1/assessments/{assessment_id}/outcomes body: what the provider later learned about the account it assessed. The assessment is named by the path and the workspace by the API key, so neither is a body member. Idempotency-Key is required and binds the body as it does on POST /v1/assessments.

outcome
enum<string>
required

What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.

Available options:
confirmed_abuse,
account_takeover,
chargeback,
false_positive,
legitimate,
unknown
observed_at
string<date-time>

When the provider observed the outcome. Defaults to when NoResponse received it.

external_ref
string

The provider's own opaque reference for the outcome, such as a case or ticket id. Stored and never interpreted. It must not contain a direct identifier.

Required string length: 1 - 128
Pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$
notes
string

Free text for the provider's own records, at most 500 characters. Stored only, never scored or served back. It must not hold personal data; control characters other than tab and line breaks are refused.

Required string length: 1 - 500

Response

The outcome was recorded. A replay of the same Idempotency-Key and body answers the record the first request created, with Idempotent-Replayed: true. Nothing is polled afterwards.

The 202 answer of POST /v1/assessments/{assessment_id}/outcomes. A replay with the same Idempotency-Key and body answers the same record.

id
string
required

Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace.

Pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$
assessment_id
string
required

Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.

Pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$
outcome
enum<string>
required

What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.

Available options:
confirmed_abuse,
account_takeover,
chargeback,
false_positive,
legitimate,
unknown
received_at
string<date-time>
required

When NoResponse first recorded the outcome.