> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Summarise retained request attempts > Count all retained matching request attempts and latency samples within seven days. Capture is best effort. ## OpenAPI ````yaml /openapi.json post /v1/requests/aggregate openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/requests/aggregate: post: tags: - assess summary: Summarise retained request attempts description: >- Count all retained matching request attempts and latency samples within seven days. Capture is best effort. operationId: aggregateRequests requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RequestAggregateRequest' responses: '200': $ref: '#/components/responses/OperationalAggregate200' '400': $ref: '#/components/responses/InvalidAggregate' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '404': $ref: '#/components/responses/NotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/requests/aggregate' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "from": "2026-01-01T00:00:00Z", "to": "2026-01-01T00:00:00Z", "route": "POST /v1/assessments", "api_key_id": "01JA2Z8K6Q4V7W9XBCDEFGHJKM" }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.requests.aggregate({ from: "2026-01-01T00:00:00Z", to: "2026-01-01T00:00:00Z", route: "POST /v1/assessments", apiKeyId: "01JA2Z8K6Q4V7W9XBCDEFGHJKM", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.requests.aggregate(from_="2026-01-01T00:00:00Z", to="2026-01-01T00:00:00Z", route="POST /v1/assessments", api_key_id="01JA2Z8K6Q4V7W9XBCDEFGHJKM") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Requests.Aggregate(ctx, components.RequestAggregateRequest{\n From: \"2026-01-01T00:00:00Z\",\n To: \"2026-01-01T00:00:00Z\",\n Route: noresponse.Pointer(\"POST /v1/assessments\"),\n APIKeyID: noresponse.Pointer(\"01JA2Z8K6Q4V7W9XBCDEFGHJKM\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.AggregateRequestsResponse; import org.noresponse.models.shared.RequestAggregateRequest; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); RequestAggregateRequest req = RequestAggregateRequest.builder() .from("2026-01-01T00:00:00Z") .to("2026-01-01T00:00:00Z") .route("POST /v1/assessments") .apiKeyId("01JA2Z8K6Q4V7W9XBCDEFGHJKM") .build(); AggregateRequestsResponse res = sdk.requests().aggregate() .request(req) .call(); if (res.operationalAggregate().isPresent()) { System.out.println(res.operationalAggregate().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); RequestAggregateRequest req = new RequestAggregateRequest() { From = "2026-01-01T00:00:00Z", To = "2026-01-01T00:00:00Z", Route = "POST /v1/assessments", ApiKeyId = "01JA2Z8K6Q4V7W9XBCDEFGHJKM", }; var res = await sdk.Requests.AggregateAsync(req); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $request = new Shared\RequestAggregateRequest( from: '2026-01-01T00:00:00Z', to: '2026-01-01T00:00:00Z', route: 'POST /v1/assessments', apiKeyId: '01JA2Z8K6Q4V7W9XBCDEFGHJKM', ); $response = $sdk->requests->aggregate( request: $request ); $result = $response->result; // handle response - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) req = Models::Shared::RequestAggregateRequest.new( from: '2026-01-01T00:00:00Z', to: '2026-01-01T00:00:00Z', route: 'POST /v1/assessments', api_key_id: '01JA2Z8K6Q4V7W9XBCDEFGHJKM' ) res = s.requests.aggregate(request: req) unless res.nil? # handle response end components: schemas: RequestAggregateRequest: title: Operational aggregate request description: >- Count every retained matching attempt in [from,to). Capture is best effort; missing attempts cannot be inferred. UTC buckets may be partial at the edges. The window is at most 7 days. type: object additionalProperties: false required: - from - to properties: from: type: string format: date-time to: type: string format: date-time bucket: enum: - hour - day default: hour status: type: integer minimum: 100 maximum: 599 route: type: string minLength: 1 maxLength: 160 not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' api_key_id: type: string pattern: ^[0-7][0-9A-HJKMNP-TV-Z]{25}$ OperationalAggregate: title: Operational aggregate description: >- One repeatable-read snapshot of retained request diagnostics or webhook attempts. Capture can have gaps and these counts are not a billing ledger. Unattributed keys include older requests and member requests. Queue state is current retained work, not a delivery success denominator. type: object additionalProperties: false required: - schema_version - source - from - to - as_of - retained_from - retention_days - bucket - capture - population - totals - buckets properties: schema_version: const: '1' source: enum: - requests - webhook_attempts from: type: string format: date-time to: type: string format: date-time as_of: type: string format: date-time retained_from: type: string format: date-time retention_days: type: integer minimum: 1 maximum: 30 bucket: enum: - hour - day capture: const: best_effort population: const: retained_attempts totals: type: object additionalProperties: false required: - attempts - succeeded - failed - client_errors - server_errors - replays - incomplete_writes - unattributed_keys properties: attempts: type: integer minimum: 0 succeeded: type: integer minimum: 0 failed: type: integer minimum: 0 client_errors: type: integer minimum: 0 server_errors: type: integer minimum: 0 replays: type: integer minimum: 0 incomplete_writes: type: integer minimum: 0 unattributed_keys: type: integer minimum: 0 p50_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. p95_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. p99_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. buckets: type: array maxItems: 721 items: type: object additionalProperties: false required: - start - attempts - succeeded - failed - client_errors - server_errors - replays - incomplete_writes - unattributed_keys properties: start: type: string format: date-time attempts: type: integer minimum: 0 succeeded: type: integer minimum: 0 failed: type: integer minimum: 0 client_errors: type: integer minimum: 0 server_errors: type: integer minimum: 0 replays: type: integer minimum: 0 incomplete_writes: type: integer minimum: 0 unattributed_keys: type: integer minimum: 0 p50_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. p95_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. p99_ms: type: number minimum: 0 description: >- Continuous percentile over retained attempts. Omitted when there are no captured samples. description: >- Nonempty UTC buckets in ascending order. Counts include all retained matching attempts, without the log page limit. queue: type: object additionalProperties: false required: - pending - leased - dead_retained properties: pending: type: integer minimum: 0 leased: type: integer minimum: 0 dead_retained: type: integer minimum: 0 oldest_pending_at: type: string format: date-time description: >- Current retained delivery queue, independent of the requested attempt window and status filter. Endpoint filter applies. Does not prove customer enforcement execution. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: OperationalAggregate200: description: >- Retained attempt counts and latency; best-effort capture and explicit queue semantics. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/OperationalAggregate' InvalidAggregate: description: >- The body does not match the aggregate request schema, or its time_zone is unknown, or its range is not bucket aligned in that zone, too long (over 92 days for day or week buckets in a time_zone other than UTC) or before the retention period, or it groups by two of reason, lane, country and asn, or it asks the default population for day or week buckets in a zone whose midnight falls inside an hour. content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef NotFound: description: >- No unexpired assessment with this id for the calling workspace, or a malformed assessment_id. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.