curl --request POST \
--url 'https://api.noresponse.org/v1/assessments/asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM/outcomes' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: account-acct_7f3a9c' \
--data '{
"outcome": "confirmed_abuse",
"observed_at": "2026-10-20T05:00:00Z",
"external_ref": "case-123",
"notes": "Card testing from this account; closed by trust and safety."
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.assessments.recordOutcome({
assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
idempotencyKey: "account-acct_7f3a9c",
body: {
outcome: "confirmed_abuse",
observedAt: "2026-10-20T05:00:00Z",
externalRef: "case-123",
notes: "Card testing from this account; closed by trust and safety.",
},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.assessments.record_outcome(assessment_id="asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", idempotency_key="account-acct_7f3a9c", outcome="confirmed_abuse", observed_at="2026-10-20T05:00:00Z", external_ref="case-123", notes="Card testing from this account; closed by trust and safety.")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Assessments.RecordOutcome(ctx, "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", "account-acct_7f3a9c", components.AssessmentOutcomeRequest{
Outcome: components.OutcomeConfirmedAbuse,
ObservedAt: noresponse.Pointer("2026-10-20T05:00:00Z"),
ExternalRef: noresponse.Pointer("case-123"),
Notes: noresponse.Pointer("Card testing from this account; closed by trust and safety."),
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.RecordAssessmentOutcomeResponse;
import org.noresponse.models.shared.AssessmentOutcomeRequest;
import org.noresponse.models.shared.Outcome;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
RecordAssessmentOutcomeResponse res = sdk.assessments().recordOutcome()
.assessmentId("asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
.idempotencyKey("account-acct_7f3a9c")
.body(AssessmentOutcomeRequest.builder()
.outcome(Outcome.CONFIRMED_ABUSE)
.observedAt("2026-10-20T05:00:00Z")
.externalRef("case-123")
.notes("Card testing from this account; closed by trust and safety.")
.build())
.call();
if (res.assessmentOutcome().isPresent()) {
System.out.println(res.assessmentOutcome().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Assessments.RecordOutcomeAsync(
assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: new AssessmentOutcomeRequest() {
Outcome = Outcome.ConfirmedAbuse,
ObservedAt = "2026-10-20T05:00:00Z",
ExternalRef = "case-123",
Notes = "Card testing from this account; closed by trust and safety.",
},
idempotencyKey: "account-acct_7f3a9c"
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\AssessmentOutcomeRequest(
outcome: Shared\Outcome::ConfirmedAbuse,
observedAt: '2026-10-20T05:00:00Z',
externalRef: 'case-123',
notes: 'Card testing from this account; closed by trust and safety.',
);
$response = $sdk->assessments->recordOutcome(
assessmentId: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM',
body: $body,
idempotencyKey: 'account-acct_7f3a9c'
);
if ($response->assessmentOutcome !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.assessments.record_outcome(assessment_id: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::AssessmentOutcomeRequest.new(
outcome: Models::Shared::Outcome::CONFIRMED_ABUSE,
observed_at: '2026-10-20T05:00:00Z',
external_ref: 'case-123',
notes: 'Card testing from this account; closed by trust and safety.'
), idempotency_key: 'account-acct_7f3a9c')
unless res.nil?
# handle response
end
{
"id": "out_01JA2ZC0Q1R2S3T4V5W6X7Y8Z9",
"assessment_id": "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"outcome": "confirmed_abuse",
"received_at": "2026-10-20T05:00:02.000Z"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/workspace-forbidden",
"title": "Forbidden",
"status": 403,
"detail": "The API key does not carry a scope this operation accepts.",
"code": "workspace_forbidden",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/idempotency-key-reused",
"title": "Idempotency key reused",
"status": 409,
"detail": "This Idempotency-Key was used with a different request body.",
"code": "idempotency_key_reused",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/rate-limited",
"title": "Rate limited",
"status": 429,
"detail": "The tenant's assessment rate is exhausted; retry after the Retry-After interval.",
"code": "rate_limited",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Report an outcome
Tells NoResponse what you later learned about an assessed account.
confirmed_abuse,account_takeoverandchargebackreport abuse.false_positiveandlegitimatewithdraw your earlier abuse report for the assessment.unknownis recorded only.
Outcomes are append-only, and the latest one for an assessment wins. Idempotency-Key is required: a retry with the same key and body answers the same record with Idempotent-Replayed: true, and the same key with a different body answers 409. Requires the assess scope.
curl --request POST \
--url 'https://api.noresponse.org/v1/assessments/asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM/outcomes' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: account-acct_7f3a9c' \
--data '{
"outcome": "confirmed_abuse",
"observed_at": "2026-10-20T05:00:00Z",
"external_ref": "case-123",
"notes": "Card testing from this account; closed by trust and safety."
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.assessments.recordOutcome({
assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
idempotencyKey: "account-acct_7f3a9c",
body: {
outcome: "confirmed_abuse",
observedAt: "2026-10-20T05:00:00Z",
externalRef: "case-123",
notes: "Card testing from this account; closed by trust and safety.",
},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.assessments.record_outcome(assessment_id="asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", idempotency_key="account-acct_7f3a9c", outcome="confirmed_abuse", observed_at="2026-10-20T05:00:00Z", external_ref="case-123", notes="Card testing from this account; closed by trust and safety.")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Assessments.RecordOutcome(ctx, "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", "account-acct_7f3a9c", components.AssessmentOutcomeRequest{
Outcome: components.OutcomeConfirmedAbuse,
ObservedAt: noresponse.Pointer("2026-10-20T05:00:00Z"),
ExternalRef: noresponse.Pointer("case-123"),
Notes: noresponse.Pointer("Card testing from this account; closed by trust and safety."),
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.RecordAssessmentOutcomeResponse;
import org.noresponse.models.shared.AssessmentOutcomeRequest;
import org.noresponse.models.shared.Outcome;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
RecordAssessmentOutcomeResponse res = sdk.assessments().recordOutcome()
.assessmentId("asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
.idempotencyKey("account-acct_7f3a9c")
.body(AssessmentOutcomeRequest.builder()
.outcome(Outcome.CONFIRMED_ABUSE)
.observedAt("2026-10-20T05:00:00Z")
.externalRef("case-123")
.notes("Card testing from this account; closed by trust and safety.")
.build())
.call();
if (res.assessmentOutcome().isPresent()) {
System.out.println(res.assessmentOutcome().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Assessments.RecordOutcomeAsync(
assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: new AssessmentOutcomeRequest() {
Outcome = Outcome.ConfirmedAbuse,
ObservedAt = "2026-10-20T05:00:00Z",
ExternalRef = "case-123",
Notes = "Card testing from this account; closed by trust and safety.",
},
idempotencyKey: "account-acct_7f3a9c"
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\AssessmentOutcomeRequest(
outcome: Shared\Outcome::ConfirmedAbuse,
observedAt: '2026-10-20T05:00:00Z',
externalRef: 'case-123',
notes: 'Card testing from this account; closed by trust and safety.',
);
$response = $sdk->assessments->recordOutcome(
assessmentId: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM',
body: $body,
idempotencyKey: 'account-acct_7f3a9c'
);
if ($response->assessmentOutcome !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.assessments.record_outcome(assessment_id: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::AssessmentOutcomeRequest.new(
outcome: Models::Shared::Outcome::CONFIRMED_ABUSE,
observed_at: '2026-10-20T05:00:00Z',
external_ref: 'case-123',
notes: 'Card testing from this account; closed by trust and safety.'
), idempotency_key: 'account-acct_7f3a9c')
unless res.nil?
# handle response
end
{
"id": "out_01JA2ZC0Q1R2S3T4V5W6X7Y8Z9",
"assessment_id": "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"outcome": "confirmed_abuse",
"received_at": "2026-10-20T05:00:02.000Z"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/workspace-forbidden",
"title": "Forbidden",
"status": 403,
"detail": "The API key does not carry a scope this operation accepts.",
"code": "workspace_forbidden",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/idempotency-key-reused",
"title": "Idempotency key reused",
"status": 409,
"detail": "This Idempotency-Key was used with a different request body.",
"code": "idempotency_key_reused",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "https://docs.noresponse.org/problems/rate-limited",
"title": "Rate limited",
"status": 429,
"detail": "The tenant's assessment rate is exhausted; retry after the Retry-After interval.",
"code": "rate_limited",
"request_id": "0123456789abcdef0123456789abcdef"
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Headers
Opaque client key, 16 to 128 characters of [A-Za-z0-9._:-] (a UUID or ULID fits). Scoped to the workspace principal and bound to the canonical body for 24 hours.
16 - 128^[A-Za-z0-9._:-]{16,128}$Path Parameters
Path segment, matched case-sensitively. A value that does not match the assessment_id shape answers 404, not 400. Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.
^asm_[0-9A-HJKMNP-TV-Z]{26}$Body
POST /v1/assessments/{assessment_id}/outcomes body: what the provider later learned about the account it assessed. The assessment is named by the path and the workspace by the API key, so neither is a body member. Idempotency-Key is required and binds the body as it does on POST /v1/assessments.
What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.
confirmed_abuse, account_takeover, chargeback, false_positive, legitimate, unknown When the provider observed the outcome. Defaults to when NoResponse received it.
The provider's own opaque reference for the outcome, such as a case or ticket id. Stored and never interpreted. It must not contain a direct identifier.
1 - 128^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$Free text for the provider's own records, at most 500 characters. Stored only, never scored or served back. It must not hold personal data; control characters other than tab and line breaks are refused.
1 - 500Response
The outcome was recorded. A replay of the same Idempotency-Key and body answers the record the first request created, with Idempotent-Replayed: true. Nothing is polled afterwards.
The 202 answer of POST /v1/assessments/{assessment_id}/outcomes. A replay with the same Idempotency-Key and body answers the same record.
Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace.
^out_[0-9A-HJKMNP-TV-Z]{26}$Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.
^asm_[0-9A-HJKMNP-TV-Z]{26}$What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.
confirmed_abuse, account_takeover, chargeback, false_positive, legitimate, unknown When NoResponse first recorded the outcome.