cURL

curl --request GET \
  --url 'https://api.noresponse.org/v1/assessments/asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM' \
  --header "Authorization: Bearer $NORESPONSE_API_KEY"

import { NoResponse } from "@noresponse/node";

const noResponse = new NoResponse({
  apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});

async function run() {
  const result = await noResponse.assessments.get({
    assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
  });

  console.log(result);
}

run();

from noresponse import NoResponse
import os


with NoResponse(
    api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:

    res = no_response.assessments.get(assessment_id="asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")

    # Handle response
    print(res)

package main

import(
	"context"
	"os"
	noresponse "github.com/noresponsehq/go/v5"
	"log"
)

func main() {
    ctx := context.Background()

    s := noresponse.New(
        noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
    )

    res, err := s.Assessments.Get(ctx, "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", nil)
    if err != nil {
        log.Fatal(err)
    }
    if res != nil {
        // handle response
    }
}

package hello.world;

import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.GetAssessmentResponse;

public class Application {

    public static void main(String[] args) throws Exception {

        NoResponse sdk = NoResponse.builder()
                .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
            .build();

        GetAssessmentResponse res = sdk.assessments().get()
                .assessmentId("asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
                .call();

        if (res.assessment().isPresent()) {
            System.out.println(res.assessment().get());
        }
    }
}

using NoResponse;
using NoResponse.Models.Shared;
using System;

var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));

var res = await sdk.Assessments.GetAsync(assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM");

// handle response

<?php

declare(strict_types=1);

require 'vendor/autoload.php';

use NoResponse;

$sdk = NoResponse\NoResponseClient::builder()
    ->setSecurity(
        getenv('NORESPONSE_API_KEY') ?: ''
    )
    ->build();



$response = $sdk->assessments->get(
    assessmentId: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM'
);

if ($response->assessment !== null) {
    // handle response
}

require 'noresponse'

Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
  api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.assessments.get(assessment_id: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM')

unless res.nil?
  # handle response
end

{
  "schema_version": "1",
  "id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
  "status": "complete",
  "flow": "account_creation",
  "depth": "full",
  "account": {
    "schema_version": "1",
    "id": "acct_8412",
    "risk": {
      "score": 0,
      "decision": "allow",
      "reasons": [
        {
          "code": "voip_number",
          "weight": 25,
          "identifier": "phone"
        },
        {
          "code": "breach_cooccurrence",
          "weight": -10,
          "identifier": "phone"
        },
        {
          "code": "breach_name_match",
          "weight": -15,
          "identifier": "name"
        },
        {
          "code": "established_accounts",
          "weight": -15,
          "identifier": "email"
        },
        {
          "code": "aged_identity",
          "weight": -25,
          "identifier": "email"
        }
      ]
    },
    "decisions_by_flow": {
      "account_creation": "allow",
      "login": "allow",
      "purchase": "allow"
    },
    "assessment_id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
    "updated_at": "2026-10-18T11:00:04.000Z"
  },
  "detail": {
    "schema_version": "1",
    "assessment_id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
    "account_id": "acct_8412",
    "request_id": "req_01",
    "status": "complete",
    "recommendation": "allow",
    "confidence": "high",
    "risk": {
      "score": 0,
      "band": "low",
      "recommendation": "allow",
      "block": false,
      "confidence": "high",
      "policy_version": "risk-2026-10.3",
      "policy_basis": "heuristic_unvalidated",
      "reasons": [
        {
          "code": "voip_number",
          "weight": 25,
          "identifier": "phone"
        },
        {
          "code": "breach_cooccurrence",
          "weight": -10,
          "identifier": "phone"
        },
        {
          "code": "breach_name_match",
          "weight": -15,
          "identifier": "name"
        },
        {
          "code": "established_accounts",
          "weight": -15,
          "identifier": "email"
        },
        {
          "code": "aged_identity",
          "weight": -25,
          "identifier": "email"
        }
      ],
      "summary": {
        "email": {
          "disposable": false,
          "accounts_found": 6,
          "breach": {
            "found": true,
            "breach_count": 7,
            "first_year": 2013,
            "last_year": 2021,
            "exposed": [
              "email",
              "name",
              "password",
              "phone",
              "ip"
            ],
            "in_credential_lists": false,
            "recent_password_exposure": false,
            "truncated": false
          }
        },
        "username": {
          "accounts_found": 3,
          "breach": {
            "found": false,
            "truncated": false
          }
        },
        "phone": {
          "line_type": "voip",
          "country": "US",
          "report_count": 0
        },
        "ip": {
          "country": "US",
          "type": "residential",
          "seen_in_workspace": 1
        },
        "consistency": {
          "name": "match",
          "phone": "match",
          "ip": "unknown",
          "country": "consistent"
        }
      },
      "coverage": {
        "answered": 14,
        "failed": 1,
        "pending": 0
      }
    },
    "incomplete_sources": [],
    "policy_version": "risk-2026-10.3",
    "policy_basis": "heuristic_unvalidated",
    "assessment_version": 3,
    "created_at": "2026-10-18T11:00:00.000Z",
    "updated_at": "2026-10-18T11:00:04.000Z",
    "expires_at": "2027-10-18T11:00:00.000Z",
    "timing": {
      "deadline_ms": 500,
      "elapsed_ms": 4000
    }
  }
}

Assessments

Retrieve an assessment

Returns the latest version of one assessment. This is the authoritative read: use it to poll a pending answer or to refresh one a webhook told you about.

While the assessment is pending, or partial with work still running, the response carries Retry-After. Do not poll faster than it says.

An unknown, expired, malformed or another account’s id all answer 404 not_found.

Requires the assess or history scope. response_mode=detailed also needs the detailed scope.

GET

assessments

{assessment_id}

cURL

curl --request GET \
  --url 'https://api.noresponse.org/v1/assessments/asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM' \
  --header "Authorization: Bearer $NORESPONSE_API_KEY"

import { NoResponse } from "@noresponse/node";

const noResponse = new NoResponse({
  apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});

async function run() {
  const result = await noResponse.assessments.get({
    assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
  });

  console.log(result);
}

run();

from noresponse import NoResponse
import os


with NoResponse(
    api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:

    res = no_response.assessments.get(assessment_id="asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")

    # Handle response
    print(res)

package main

import(
	"context"
	"os"
	noresponse "github.com/noresponsehq/go/v5"
	"log"
)

func main() {
    ctx := context.Background()

    s := noresponse.New(
        noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
    )

    res, err := s.Assessments.Get(ctx, "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM", nil)
    if err != nil {
        log.Fatal(err)
    }
    if res != nil {
        // handle response
    }
}

package hello.world;

import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.GetAssessmentResponse;

public class Application {

    public static void main(String[] args) throws Exception {

        NoResponse sdk = NoResponse.builder()
                .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
            .build();

        GetAssessmentResponse res = sdk.assessments().get()
                .assessmentId("asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
                .call();

        if (res.assessment().isPresent()) {
            System.out.println(res.assessment().get());
        }
    }
}

using NoResponse;
using NoResponse.Models.Shared;
using System;

var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));

var res = await sdk.Assessments.GetAsync(assessmentId: "asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM");

// handle response

<?php

declare(strict_types=1);

require 'vendor/autoload.php';

use NoResponse;

$sdk = NoResponse\NoResponseClient::builder()
    ->setSecurity(
        getenv('NORESPONSE_API_KEY') ?: ''
    )
    ->build();



$response = $sdk->assessments->get(
    assessmentId: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM'
);

if ($response->assessment !== null) {
    // handle response
}

require 'noresponse'

Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
  api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.assessments.get(assessment_id: 'asm_01JA2Z8K6Q4V7W9XBCDEFGHJKM')

unless res.nil?
  # handle response
end

{
  "schema_version": "1",
  "id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
  "status": "complete",
  "flow": "account_creation",
  "depth": "full",
  "account": {
    "schema_version": "1",
    "id": "acct_8412",
    "risk": {
      "score": 0,
      "decision": "allow",
      "reasons": [
        {
          "code": "voip_number",
          "weight": 25,
          "identifier": "phone"
        },
        {
          "code": "breach_cooccurrence",
          "weight": -10,
          "identifier": "phone"
        },
        {
          "code": "breach_name_match",
          "weight": -15,
          "identifier": "name"
        },
        {
          "code": "established_accounts",
          "weight": -15,
          "identifier": "email"
        },
        {
          "code": "aged_identity",
          "weight": -25,
          "identifier": "email"
        }
      ]
    },
    "decisions_by_flow": {
      "account_creation": "allow",
      "login": "allow",
      "purchase": "allow"
    },
    "assessment_id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
    "updated_at": "2026-10-18T11:00:04.000Z"
  },
  "detail": {
    "schema_version": "1",
    "assessment_id": "asm_01JB3C4D5E6F7G8H9JKMNPQRST",
    "account_id": "acct_8412",
    "request_id": "req_01",
    "status": "complete",
    "recommendation": "allow",
    "confidence": "high",
    "risk": {
      "score": 0,
      "band": "low",
      "recommendation": "allow",
      "block": false,
      "confidence": "high",
      "policy_version": "risk-2026-10.3",
      "policy_basis": "heuristic_unvalidated",
      "reasons": [
        {
          "code": "voip_number",
          "weight": 25,
          "identifier": "phone"
        },
        {
          "code": "breach_cooccurrence",
          "weight": -10,
          "identifier": "phone"
        },
        {
          "code": "breach_name_match",
          "weight": -15,
          "identifier": "name"
        },
        {
          "code": "established_accounts",
          "weight": -15,
          "identifier": "email"
        },
        {
          "code": "aged_identity",
          "weight": -25,
          "identifier": "email"
        }
      ],
      "summary": {
        "email": {
          "disposable": false,
          "accounts_found": 6,
          "breach": {
            "found": true,
            "breach_count": 7,
            "first_year": 2013,
            "last_year": 2021,
            "exposed": [
              "email",
              "name",
              "password",
              "phone",
              "ip"
            ],
            "in_credential_lists": false,
            "recent_password_exposure": false,
            "truncated": false
          }
        },
        "username": {
          "accounts_found": 3,
          "breach": {
            "found": false,
            "truncated": false
          }
        },
        "phone": {
          "line_type": "voip",
          "country": "US",
          "report_count": 0
        },
        "ip": {
          "country": "US",
          "type": "residential",
          "seen_in_workspace": 1
        },
        "consistency": {
          "name": "match",
          "phone": "match",
          "ip": "unknown",
          "country": "consistent"
        }
      },
      "coverage": {
        "answered": 14,
        "failed": 1,
        "pending": 0
      }
    },
    "incomplete_sources": [],
    "policy_version": "risk-2026-10.3",
    "policy_basis": "heuristic_unvalidated",
    "assessment_version": 3,
    "created_at": "2026-10-18T11:00:00.000Z",
    "updated_at": "2026-10-18T11:00:04.000Z",
    "expires_at": "2027-10-18T11:00:00.000Z",
    "timing": {
      "deadline_ms": 500,
      "elapsed_ms": 4000
    }
  }
}

Authorizations

Authorization

string

header

required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.

Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.

Path Parameters

assessment_id

string

required

Path segment, matched case-sensitively. A value that does not match the assessment_id shape answers 404, not 400. Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.

Pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$

Query Parameters

response_mode

enum<string>

default:standard

Optional standard or separately authorised detailed customer view; raw is rejected.

Available options:

standard,

detailed

Response

The latest assessment_version. Retry-After is present while a source is still continuing.

The assessment resource: the body of POST /v1/assessments (200 complete or partial, 202 pending), GET /v1/assessments/{assessment_id} and the assessment.updated webhook. Its main object is account: the account's one current risk, as GET /v1/accounts/{account_id} serves it, with risk.decision the decision for this assessment's flow. detail holds this assessment's own facts and score. The account's current risk comes from its latest assessment that has a decision, which is this one once it has a decision and no newer one does, and an earlier one while this one is pending. Concurrent assessments of one account each answer the account's risk as committed when they are served.

schema_version

any

required

Version of the body shape.

string

required

This assessment's id, equal to detail.assessment_id.

Pattern: ^asm_[0-9A-HJKMNP-TV-Z]{26}$

status

enum<string>

required

This assessment's status, equal to detail.status. While it is pending, account carries the risk of the account's previous decided assessment, or is absent.

Available options:

complete,

partial,

pending

flow

enum<string>

required

The flow the request named. account.risk.decision is the decision for it. An assessment made before flows existed reports account_creation.

Available options:

account_creation,

login,

purchase

depth

enum<string>

required

The depth the assessment was served at: the request's, or its flow's default. An assessment made before depths existed reports full.

Available options:

quick,

full

detail

Assessment detail · object

required

This assessment's own facts: its score, recommendation, signals, coverage and timing.

Show child attributes

account

Account · object

The account's one current risk when this assessment was served, decided for this assessment's flow: the body GET /v1/accounts/{account_id} would answer, with risk.decision equal to decisions_by_flow for flow. Absent only while the account has no assessment with a decision (its first assessment is still pending); a webhook or GET of the decided assessment then carries it.

Show child attributes

Overview

Using the API

Endpoints

Errors

Retrieve an assessment

Authorizations

Path Parameters

Query Parameters

Response