> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Report an outcome > Tells NoResponse what you later learned about an assessed account. - `confirmed_abuse`, `account_takeover` and `chargeback` report abuse. - `false_positive` and `legitimate` withdraw your earlier abuse report for the assessment. - `unknown` is recorded only. Outcomes are append-only, and the latest one for an assessment wins. `Idempotency-Key` is required: a retry with the same key and body answers the same record with `Idempotent-Replayed: true`, and the same key with a different body answers 409. Requires the `assess` scope. ## OpenAPI ````yaml /openapi.json post /v1/assessments/{assessment_id}/outcomes openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses a signup, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys your signup gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/assessments/{assessment_id}/outcomes: post: tags: - assess summary: Report an outcome description: >- Tells NoResponse what you later learned about an assessed account. - `confirmed_abuse`, `account_takeover` and `chargeback` report abuse. - `false_positive` and `legitimate` withdraw your earlier abuse report for the assessment. - `unknown` is recorded only. Outcomes are append-only, and the latest one for an assessment wins. `Idempotency-Key` is required: a retry with the same key and body answers the same record with `Idempotent-Replayed: true`, and the same key with a different body answers 409. Requires the `assess` scope. operationId: recordAssessmentOutcome parameters: - $ref: '#/components/parameters/AssessmentId' - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AssessmentOutcomeRequest' examples: abuse: value: outcome: confirmed_abuse observed_at: '2026-10-20T05:00:00Z' external_ref: case-123 notes: Card testing from this account; closed by trust and safety. withdrawn: value: outcome: false_positive responses: '202': $ref: '#/components/responses/OutcomeRecorded' '400': $ref: '#/components/responses/InvalidOutcome' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/IdempotencyConflict' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/assessments/asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM/outcomes' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --header 'Idempotency-Key: account-acct_7f3a9c' \ --data '{ "outcome": "confirmed_abuse", "observed_at": "2026-10-20T05:00:00Z", "external_ref": "case-123", "notes": "Card testing from this account; closed by trust and safety." }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.assessments.recordOutcome({ assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", idempotencyKey: "account-acct_7f3a9c", body: { outcome: "confirmed_abuse", observedAt: "2026-10-20T05:00:00Z", externalRef: "case-123", notes: "Card testing from this account; closed by trust and safety.", }, }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.assessments.record_outcome(assessment_id="asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", idempotency_key="account-acct_7f3a9c", outcome="confirmed_abuse", observed_at="2026-10-20T05:00:00Z", external_ref="case-123", notes="Card testing from this account; closed by trust and safety.") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v5\"\n\t\"github.com/noresponsehq/go/v5/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Assessments.RecordOutcome(ctx, \"asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", \"account-acct_7f3a9c\", components.AssessmentOutcomeRequest{\n Outcome: components.OutcomeConfirmedAbuse,\n ObservedAt: noresponse.Pointer(\"2026-10-20T05:00:00Z\"),\n ExternalRef: noresponse.Pointer(\"case-123\"),\n Notes: noresponse.Pointer(\"Card testing from this account; closed by trust and safety.\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: > package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.RecordAssessmentOutcomeResponse; import org.noresponse.models.shared.AssessmentOutcomeRequest; import org.noresponse.models.shared.Outcome; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); RecordAssessmentOutcomeResponse res = sdk.assessments().recordOutcome() .assessmentId("asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .idempotencyKey("account-acct_7f3a9c") .body(AssessmentOutcomeRequest.builder() .outcome(Outcome.CONFIRMED_ABUSE) .observedAt("2026-10-20T05:00:00Z") .externalRef("case-123") .notes("Card testing from this account; closed by trust and safety.") .build()) .call(); if (res.assessmentOutcome().isPresent()) { System.out.println(res.assessmentOutcome().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Assessments.RecordOutcomeAsync( assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", body: new AssessmentOutcomeRequest() { Outcome = Outcome.ConfirmedAbuse, ObservedAt = "2026-10-20T05:00:00Z", ExternalRef = "case-123", Notes = "Card testing from this account; closed by trust and safety.", }, idempotencyKey: "account-acct_7f3a9c" ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $body = new Shared\AssessmentOutcomeRequest( outcome: Shared\Outcome::ConfirmedAbuse, observedAt: '2026-10-20T05:00:00Z', externalRef: 'case-123', notes: 'Card testing from this account; closed by trust and safety.', ); $response = $sdk->assessments->recordOutcome( assessmentId: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: $body, idempotencyKey: 'account-acct_7f3a9c' ); if ($response->assessmentOutcome !== null) { // handle response } - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.assessments.record_outcome(assessment_id: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::AssessmentOutcomeRequest.new( outcome: Models::Shared::Outcome::CONFIRMED_ABUSE, observed_at: '2026-10-20T05:00:00Z', external_ref: 'case-123', notes: 'Card testing from this account; closed by trust and safety.' ), idempotency_key: 'account-acct_7f3a9c') unless res.nil? # handle response end components: parameters: AssessmentId: name: assessment_id in: path required: true schema: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n description: >- Path segment, matched case-sensitively. A value that does not match the assessment_id shape answers 404, not 400. IdempotencyKey: name: Idempotency-Key in: header required: true description: >- Opaque client key, 16 to 128 characters of [A-Za-z0-9._:-] (a UUID or ULID fits). Scoped to the workspace principal and bound to the canonical body for 24 hours. schema: type: string minLength: 16 maxLength: 128 pattern: ^[A-Za-z0-9._:-]{16,128}$ not: pattern: \n schemas: AssessmentOutcomeRequest: title: Assessment outcome description: >- POST /v1/assessments/{assessment_id}/outcomes body: what the provider later learned about the account it assessed. The assessment is named by the path and the workspace by the API key, so neither is a body member. Idempotency-Key is required and binds the body as it does on POST /v1/assessments. type: object additionalProperties: false required: - outcome properties: outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. observed_at: type: string format: date-time description: >- When the provider observed the outcome. Defaults to when NoResponse received it. external_ref: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$ description: >- The provider's own opaque reference for the outcome, such as a case or ticket id. Stored and never interpreted. It must not contain a direct identifier. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n notes: type: string minLength: 1 maxLength: 500 description: >- Free text for the provider's own records, at most 500 characters. Stored only, never scored or served back. It must not hold personal data; control characters other than tab and line breaks are refused. not: pattern: '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' AssessmentOutcome: title: Recorded assessment outcome description: >- The 202 answer of POST /v1/assessments/{assessment_id}/outcomes. A replay with the same Idempotency-Key and body answers the same record. type: object additionalProperties: false required: - id - assessment_id - outcome - received_at properties: id: type: string pattern: ^out_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the workspace. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n assessment_id: type: string pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$ description: >- Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404. not: description: >- A line feed anywhere, refused with `not` beside every anchored pattern. pattern: \n outcome: enum: - confirmed_abuse - account_takeover - chargeback - false_positive - legitimate - unknown description: >- What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this workspace for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins. received_at: type: string format: date-time description: When NoResponse first recorded the outcome. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: OutcomeRecorded: description: >- The outcome was recorded. A replay of the same Idempotency-Key and body answers the record the first request created, with Idempotent-Replayed: true. Nothing is polled afterwards. headers: Cache-Control: schema: type: string const: no-store required: true Idempotent-Replayed: description: >- Present and true when this answer replays an earlier request with the same Idempotency-Key and body: the body is the record that request created. schema: type: string const: 'true' required: false X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AssessmentOutcome' examples: recorded: value: id: out_01JA2ZC0Q1R2S3T4V5W6X7Y8Z9 assessment_id: asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM outcome: confirmed_abuse received_at: '2026-10-20T05:00:02.000Z' InvalidOutcome: description: >- The body is not JSON or does not match the assessment outcome request schema (an unknown outcome, an unknown member such as tenant_id, an over-long notes, an observed_at that is not an RFC 3339 time), or Idempotency-Key is missing or malformed. invalid_params names the offending fields, never their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_idempotency_key Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef NotFound: description: >- No unexpired assessment with this id for the calling workspace, or a malformed assessment_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found IdempotencyConflict: description: >- The Idempotency-Key was already used by this workspace, within 24 hours, with a different body. A reuse with the same body is never a conflict, even while the first request is in flight: it replays the latest assessment. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - idempotency_key_reused examples: reused: value: type: https://docs.noresponse.org/problems/idempotency-key-reused title: Idempotency key reused status: 409 detail: This Idempotency-Key was used with a different request body. code: idempotency_key_reused request_id: 0123456789abcdef0123456789abcdef PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk and an account's history, and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.