Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace.

assess creates and reads assessments, records outcomes and reports key usage. investigate reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy history scope also permits account exports, submitted identifiers and enforcement reports. delete permits account and assessment deletion.

evidence or detailed adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. exports permits exports with the underlying account or audit scope. audit reads audit events and usage reads usage. audit_manage manages audit streams and retention, and includes audit-read and export authority.

webhooks manages webhook endpoints. integrations manages hosted auth-provider integrations. management manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions.

settings reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires settings and policy_publish together, or the legacy management scope.

groups creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment.

members reads the workspace directory. members_manage also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. management does not grant team access. API keys cannot change owners or accept invitations.

A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403.

Body

application/json

Search retained assessments created in [from,to), at most 366 days. identifier matches the submitted value of each returned assessment directly. The legacy email filter keeps its account-wide mailbox semantics and cannot be combined with identifier. Other filters combine using AND and describe assessment decisions, separate from current account decisions. Results use newest-created order with an assessment-ID tie break and are live, not a snapshot across pages. Requires history or investigate authority; identifier, identifier_expression and email filtering also require identifier-read permission. Detailed response mode additionally requires detailed permission. No Idempotency-Key. identifier_expression requires scope assessment and matches the complete expression within each returned submission; account scope returns 400 invalid_request. At most 8 raw terms and 3 group levels. Mutually exclusive with identifier and email.

from
string<date-time>
required
to
string<date-time>
required
account_id
string

The provider's own opaque identifier for the account being checked, scoped to the calling workspace. It must be provider-opaque and must not contain a direct identifier (email, phone, name, national id): that is a provider obligation the schema can only partly check. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id}, its /assessments and its /links. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.

Required string length: 1 - 128
Pattern: ^[A-Za-z0-9][A-Za-z0-9._:|-]{0,127}$
email
string

Assessments of every account that one of its retained admitted assessments sent this mailbox as identifiers.email, matched as lists match an email entry: case-insensitive, a +tag removed and, at gmail.com and googlemail.com, the dots of the local part ignored. Only assessments stored since email list matching began carry the mailbox. An address that is not a valid mailbox is refused with 400.

Required string length: 3 - 254
Pattern: ^[^\s\x00-\x1f\x7f]+$
flow
enum<string>

The event an assessment is made for: account_creation (a user creates an account), login (a user returns to an existing account) or purchase (a payment or a credit grant). The account's risk is reported with the decision for this flow.

Available options:
account_creation,
login,
purchase
status
enum<string>

Processing state, separate from evidence coverage. complete: final; nothing is still running, but unsupported, failed or unanswered lanes remain in incomplete_sources. partial: a recommendation exists and evidence is incomplete; assessment_url identifies continuing work when present. pending: no recommendation yet; poll or wait for the webhook. Finished processing does not mean all sources answered.

Available options:
complete,
partial,
pending
origin
enum<string>
default:api

api (the default) searches the assessments your integration sent. lookup searches the assessments your team ran by hand on the console's Lookup page. The API sets an assessment's origin from the credential that sent it. A lookup is not in any other list, count, webhook event or account.

Available options:
api,
lookup
recommendation
enum<string>

Advisory only. The provider decides and enforces.

Available options:
allow,
step_up,
review
limit
integer
default:20
Required range: 1 <= x <= 50
cursor
string

Opaque, expiring cursor bound to workspace, environment, operation and all filters, including expression scope, ordered structure and original term values. Keep grouping, operand order, matching modes and values unchanged; an omitted match is equivalent to exact. The page limit may change.

Required string length: 1 - 1024
Pattern: ^[A-Za-z0-9_-]+$
response_mode
enum<string>
default:standard
Available options:
standard,
detailed
decision
enum<string>

The decision of the assessment's latest stored revision, or with revision first its first answer: block when its stored risk.block is true, otherwise its recommendation. This is not the account's current decision or held-admission state. Combined with recommendation using AND.

Available options:
allow,
step_up,
review,
block
revision
enum<string>
required if list_match is set

latest (the default) searches and returns each assessment's latest stored revision; first searches and returns its first answer, the revision POST /v1/assessments/aggregate counts. The filters describe that revision.

Available options:
latest,
first
band
enum<string>
Available options:
low,
medium,
high,
critical
reason
enum<string>
required if impact is set

A reason fired by the selected stored revision.

Available options:
no_digital_footprint,
voip_number,
disposable_email,
new_email,
no_email_matches,
spam_reports,
fraud_flag,
identity_mismatch,
country_mismatch,
proxy_ip,
seen_before,
shared_ip,
many_recent_accounts,
established_accounts,
aged_identity,
breach_name_match,
breach_cooccurrence,
breach_name_mismatch,
breach_phone_mismatch,
recent_password_exposure,
credential_list_exposure,
abuse_ecosystem_member,
no_breach_history,
automation_fast_submit,
client_clock_skew,
bot_or_automation,
auth_email_verified,
auth_phone_verified,
auth_mfa_recent,
auth_new_session,
auth_new_account,
auth_impersonated,
context_timezone_mismatch,
context_locale_mismatch,
context_line_country_mismatch,
prior_abuse_link,
test_scenario,
shared_api_key,
list_match,
young_email_domain,
email_domain_no_mx,
email_domain_nonexistent,
google_account_missing,
google_empty_account,
google_active_profile,
google_aged_account,
google_name_match,
google_name_mismatch,
google_country_match,
google_country_mismatch,
forum_sanctioned,
prior_payment_abuse,
ip_history_match,
identity_attribute_conflict,
impossible_identity_age,
breach_shared_ip,
nationality_mismatch,
minor_identity,
reported_account_abuse,
breach_city_match,
breach_city_mismatch
impact
enum<string>

The selected reason's served impact band. Requires reason.

Available options:
none,
low,
medium,
high
lane
enum<string>

An incomplete lane in the selected stored revision.

Available options:
accounts,
phone,
breach,
domain,
ip
country
string
Pattern: ^[A-Z]{2}$
asn
integer
Required range: 1 <= x <= 4294967295
score_min
integer

Inclusive lower score bound. Pending answers without a score do not match.

Required range: 0 <= x <= 100
score_max
integer

Inclusive upper score bound, at least score_min when both are supplied.

Required range: 0 <= x <= 100
list_match
enum<string>

The list action captured at the first answer. Requires revision first. Older answers without captured list state do not match, including none.

Available options:
allow,
block,
none
changed
boolean

true returns only assessments whose latest stored revision's decision differs from their first answer's decision (see decision); false only the others. An assessment whose first answer or latest revision has no decision yet is not changed. Cannot be combined with revision first.

identifier
Identifier search · object

Match a retained assessment's submitted identifier directly. Mutually exclusive with identifier_expression and legacy email. All other supported filters combine using AND.

Example:
identifier_expression
Submitted identifier expression · object

Explicit bounded AND/OR combinations. Mutually exclusive with identifier and legacy email. Other supported filters combine using AND.

Example:

Response

Search assessments across this environment. A repeat returns the original receipt.

A bounded page of latest assessment revisions, newest creation first, with how many assessments match the filters. Each item is the revision found and its first answer's decision; no current account risk is attached.

schema_version
any
required

Version of the body shape.

items
Assessment search item · object[]
required
Maximum array length: 50
total
integer
required

How many assessments match the filters over every page, counted when this page was read: exact up to 10000. At 10000 or more it is 10000 and total_capped is true. The cursor does not change it; a later page can count differently, as results are live.

Required range: 0 <= x <= 10000
total_capped
boolean
required

True when at least 10000 assessments match, so total is 10000 and not the exact count.

retention_days
integer
default:365
required

The calling workspace's configured retention period in days. Default 365 (12 months), which is also the maximum: a workspace may only shorten it, to at least 1 day. Each record expires from its own created_at; see assessment expires_at.

Required range: 1 <= x <= 365
next_cursor
string

Opaque, expiring cursor bound to this environment, operation and every filter. Keep the filters unchanged.

Required string length: 1 - 1024
Pattern: ^[A-Za-z0-9_-]+$