> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Read a person > Gets the person's report: the profiles that screening matched and how, the findings with their evidence, and every recorded decision, oldest first. Requires the `groups` scope, within the key's own workspace and environment. ## OpenAPI ````yaml /openapi.json get /v1/workspaces/{workspace_id}/groups/{environment}/{group_id}/people/{person_id} openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/workspaces/{workspace_id}/groups/{environment}/{group_id}/people/{person_id}: get: tags: - groups summary: Read a person description: >- Gets the person's report: the profiles that screening matched and how, the findings with their evidence, and every recorded decision, oldest first. Requires the `groups` scope, within the key's own workspace and environment. operationId: getPerson parameters: - $ref: '#/components/parameters/WorkspaceId' - $ref: '#/components/parameters/Environment' - $ref: '#/components/parameters/GroupId' - $ref: '#/components/parameters/PersonId' responses: '200': $ref: '#/components/responses/PersonReportFound' '400': $ref: '#/components/responses/InvalidControlRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ControlForbidden' '404': $ref: '#/components/responses/WorkspaceNotFound' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request GET \ --url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/groups/test/grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM/people/per_01JA2Z8K6Q4V7W9XBCDEFGHJKM' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.groups.getPerson({ workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: "test", groupId: "grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", personId: "per_01JA2Z8K6Q4V7W9XBCDEFGHJKM", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.groups.get_person(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="test", group_id="grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", person_id="per_01JA2Z8K6Q4V7W9XBCDEFGHJKM") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Groups.GetPerson(ctx, \"tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", components.KeyEnvironmentTest, \"grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", \"per_01JA2Z8K6Q4V7W9XBCDEFGHJKM\")\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.GetPersonResponse; import org.noresponse.models.shared.KeyEnvironment; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); GetPersonResponse res = sdk.groups().getPerson() .workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .environment(KeyEnvironment.TEST) .groupId("grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .personId("per_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .call(); if (res.personReport().isPresent()) { System.out.println(res.personReport().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Groups.GetPersonAsync( workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: KeyEnvironment.Test, groupId: "grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", personId: "per_01JA2Z8K6Q4V7W9XBCDEFGHJKM" ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $response = $sdk->groups->getPerson( workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Shared\KeyEnvironment::Test, groupId: 'grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM', personId: 'per_01JA2Z8K6Q4V7W9XBCDEFGHJKM' ); $result = $response->result; // handle response - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.groups.get_person(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Models::Shared::KeyEnvironment::TEST, group_id: 'grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM', person_id: 'per_01JA2Z8K6Q4V7W9XBCDEFGHJKM') unless res.nil? # handle response end components: parameters: WorkspaceId: name: workspace_id in: path required: true schema: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. description: >- The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. Environment: name: environment in: path required: true schema: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. description: >- The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404. GroupId: name: group_id in: path required: true schema: type: string pattern: ^grp_[0-7][0-9A-HJKMNP-TV-Z]{25}$ PersonId: name: person_id in: path required: true schema: type: string pattern: ^per_[0-7][0-9A-HJKMNP-TV-Z]{25}$ responses: PersonReportFound: description: >- The person, their matched profiles, findings and every recorded decision. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/PersonReport' examples: records: value: person: id: per_01JC8Y2M4N6P8Q0R2S4T6V8W01 group_id: grp_01JC8Y1K3M5N7P9Q1R3S5T7V9W external_id: reg-2048 name: Jordan Ellis email: jordan.ellis@example.com city: Leeds handles: - platform: x handle: jordan_ellis match_state: none_found highest_band: null decision: null coverage: accounts_found: 0 accounts_accessible: 0 items_read: 0 platforms: - platform: x status: none_found accounts_found: 0 items_read: 0 spend: total_minor: 2 by_implementation: - implementation: lookups role: resolver spend_minor: 2 last_screening_id: scn_01JC8Y3A5B7C9D1E3F5G7H9J1K screened_at: '2026-11-14T10:02:11Z' created_at: '2026-11-14T10:00:00Z' updated_at: '2026-11-14T10:02:11Z' profiles: [] findings: [] posts: [] media: [] reviews: [] other_groups: total: 0 items: [] lookup: checks: - identifier: email lane: accounts status: found sources: 4 answered: 4 found: 2 - identifier: email lane: breach status: found sources: 1 answered: 1 found: 1 - identifier: username lane: accounts status: found sources: 6 answered: 6 found: 1 - identifier: username lane: breach status: found sources: 1 answered: 1 found: 1 records: - id: rec_5c1e0d7a9b3f4e2d8a6c0b1f9e7d3a52 source: connector: github kind: platform site: github.com matched: - by: username field: login fields: - field: login original: jordan-ellis kind: username role: handle value: jordan-ellis distinctive: rating: distinctive reason: 34 bits, about one in 17 billion usernames - field: id original: '48151623' kind: account_id role: account_id value: '48151623' - field: name original: Jordan Ellis kind: person_name role: display_name value: Jordan Ellis distinctive: rating: distinctive reason: in 3 breach rows - field: html_url original: https://GitHub.com/jordan-ellis kind: url role: profile_link value: https://github.com/jordan-ellis - field: avatar_url original: https://avatars.githubusercontent.com/u/48151623 kind: image role: picture value: https://avatars.githubusercontent.com/u/48151623 - field: bio original: Security engineer. Climbing on weekends. kind: long_text role: bio value: Security engineer. Climbing on weekends. - field: location original: Leeds, UK kind: text role: location value: Leeds, UK - field: company original: Northwind Example kind: organisation role: organisation value: Northwind Example - field: twitter_username original: jordan_ellis kind: username role: linked_account value: jordan_ellis distinctive: rating: distinctive reason: 33 bits, about one in 8.6 billion usernames - field: followers original: '212' kind: count role: followers value: '212' - field: created_at original: '2014-03-07T09:30:00Z' kind: date_time role: joined value: '2014-03-07T09:30:00Z' - field: hireable original: 'true' kind: flag value: 'true' observed_at: '2026-11-14T10:01:40Z' likelihood: 0.74 agreed: - name - twitter_username clashed: [] joined: true verdict: joined - id: rec_8e2b4f6a1c3d5e7f9a0b2c4d6e8f1a3b source: connector: breach kind: site_breach site: forum.example.net table: FORUM_EXAMPLE_NET_2019 date: 2019-03 matched: - by: email field: email - by: username field: username search: srh_01JC8Y5B7C9D1E3F5G7H9J1K3M fields: - field: birthday original: 07/03/1990 kind: date role: born - field: email original: Jordan.Ellis@Example.com kind: email value: jordan.ellis@example.com distinctive: rating: unique reason: an email address belongs to one person - field: lastip original: '3405803781' kind: ip role: last_ip value: 203.0.113.5 distinctive: rating: common reason: many people share one IP address - field: password original: Leeds1990! kind: password value: Leeds1990! distinctive: rating: distinctive reason: >- seen twice in breach data; needs about 10^9 guesses - field: password_hash original: >- $2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy kind: hash value: >- $2y$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy detail: bcrypt distinctive: rating: distinctive reason: in 1 breach row - field: regdate original: '1394184600' kind: date_time role: joined value: '2014-03-07T09:30:00Z' - field: salt original: x9Q kind: salt value: x9Q - field: usergroupid original: '2' kind: label role: site_role value: '2' - field: username original: jellis kind: username role: handle value: jellis distinctive: rating: common reason: 19 bits, about one in 520 thousand usernames observed_at: '2026-11-14T10:01:42Z' likelihood: 0.99 agreed: - regdate clashed: [] joined: true remaining: - source: connector: breach kind: credential_list table: COMBOLIST_EXAMPLE_2021 date: '2021' by: username search: srh_01JC8Y5B7C9D1E3F5G7H9J1K3M rows: 37 looked_at: '2026-11-14T10:01:42Z' searches: - search_id: srh_01JC8Y5B7C9D1E3F5G7H9J1K3M record_id: rec_8e2b4f6a1c3d5e7f9a0b2c4d6e8f1a3b field: username kind: username value: jellis status: completed sources: 3 answered: 3 found: 1 estimated_spend: 2 spent: 2 requested_by: usr_security_lead created_at: '2026-11-14T10:05:00Z' finished_at: '2026-11-14T10:05:04Z' InvalidControlRequest: description: >- The body breaks its schema, or a console credential named no valid NR-Acting-User. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized ControlForbidden: description: >- workspace_forbidden: an API key without the management scope, or any API key on a route other than the key, settings and list routes. role_forbidden: a console credential's acting user is an active member whose role does not grant the operation. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden - role_forbidden WorkspaceNotFound: description: >- No such workspace, member, invite, key or environment for the caller. A workspace the acting user is not an active member of answers this too, as do another workspace and the other environment to an API key, so no answer shows which workspaces exist. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: PersonReport: type: object additionalProperties: false required: - person - profiles - findings - posts - media - reviews - other_groups properties: person: type: object additionalProperties: false required: - id - group_id - name - match_state - highest_band - decision - coverage - created_at - updated_at - spend properties: id: type: string pattern: ^per_[0-7][0-9A-HJKMNP-TV-Z]{25}$ group_id: type: string pattern: ^grp_[0-7][0-9A-HJKMNP-TV-Z]{25}$ external_id: type: string minLength: 1 maxLength: 128 description: >- Your own id for the person, unique within the group. A later row with the same external id updates this person. name: type: string minLength: 1 maxLength: 200 description: The person's full name. email: type: string minLength: 3 maxLength: 254 pattern: ^[^@\s]+@[^@\s]+$ description: The person's email. phone: type: string pattern: ^\+[1-9][0-9]{6,14}$ description: The person's phone in E.164 form. company: type: string minLength: 1 maxLength: 200 description: Where the person works. city: type: string minLength: 1 maxLength: 100 description: Where the person lives. handles: type: array maxItems: 20 items: type: object additionalProperties: false required: - platform - handle properties: platform: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. handle: type: string minLength: 1 maxLength: 100 description: The account's handle, without a leading @. description: An account the person is known to hold. description: Accounts the person is known to hold, at most 20. role: enum: - guest - crew - vendor - press description: >- The person's role in the group: guest (a ticket holder), crew, vendor or press. Leave it out when you do not know it: a person without one has no role, not guest. A later row naming the same person replaces it, and a change of role alone keeps the person's screening results. match_state: enum: - unscreened - confirmed - probable - possible - none_found - inaccessible description: >- How sure the latest screening is that it found the person's accounts. unscreened until a screening reaches the person, and after one that had no profile to check (no_profile_to_check). no_profile_to_check: type: boolean description: >- true when the latest screening reached the person but the list gave nothing to look up on any requested platform, such as no handle for a platform that reads supplied handles only: nobody looked for a profile. match_state stays unscreened, every platform is in coverage.not_searched, and the person is neither none_found nor failed and does not make the screening partial. Its lookups are on its report. Left out otherwise. highest_band: anyOf: - enum: - critical - high - moderate - low - info - type: 'null' description: >- The most severe finding's band, or null when nothing was flagged. decision: anyOf: - enum: - cleared - watch - escalated - type: 'null' description: The latest reviewer decision, or null before any. decision_note: type: string minLength: 1 maxLength: 2000 decided_by: type: string minLength: 1 maxLength: 256 decided_at: type: string format: date-time coverage: type: object additionalProperties: false required: - accounts_found - accounts_accessible - items_read - platforms properties: accounts_found: type: integer minimum: 0 maximum: 100 accounts_accessible: type: integer minimum: 0 maximum: 100 items_read: type: integer minimum: 0 maximum: 1000000 items_not_analysed: type: integer minimum: 0 maximum: 1000000 description: >- Items read that the analyser could not analyse. Above zero, the person is partial: a finding may be missing from them. not_analysed_by_reason: type: array maxItems: 8 items: type: object additionalProperties: false required: - reason - items properties: reason: enum: - video - image_unavailable - image_unsupported - image_limit - refused - unfinished - unverified - unspecified description: >- Why an item read was not analysed. video: a video, whose caption alone is read. image_unavailable: the image could not be fetched from the platform. image_unsupported: not a JPEG, PNG, GIF or WebP image, or too large to send. image_limit: past the most images one person's analysis reads. refused: the model declined to read it. unfinished: the model cut its batch short or answered outside the schema, or the request was rejected. unverified: a finding cited it with words it does not contain or an image it did not describe. unspecified: the analyser gave no reason. items: type: integer minimum: 1 maximum: 1000000 description: How many items read were not analysed for one reason. description: >- items_not_analysed split by reason, each reason once with at least one item. period_from: type: string format: date-time description: The oldest item read on any platform. period_to: type: string format: date-time description: The newest item read on any platform. platforms: type: array maxItems: 11 items: type: object additionalProperties: false required: - platform - status - accounts_found - items_read properties: platform: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. status: enum: - covered - none_found - inaccessible - failed - unavailable description: >- covered read at least one profile; none_found looked and found no account; inaccessible found accounts that are private or locked; failed could not finish looking; unavailable has no resolver or collector enabled. accounts_found: type: integer minimum: 0 maximum: 100 items_read: type: integer minimum: 0 maximum: 100000 description: What a screening read on one platform. not_searched: type: array maxItems: 11 uniqueItems: true items: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. description: >- Requested platforms where the person gave the screening nothing to look up, such as no handle for a platform that reads supplied handles only. Nothing looked and nothing failed: such a platform is not in platforms, is not none_found and does not make the person partial. description: >- What the latest screening read: accounts found, accessible, items read, the period covered and each platform's status. Zero, with no platforms, until a screening reaches the person. last_screening_id: type: string pattern: ^scn_[0-7][0-9A-HJKMNP-TV-Z]{25}$ screened_at: type: string format: date-time created_at: type: string format: date-time updated_at: type: string format: date-time spend: type: object additionalProperties: false required: - total_minor - by_implementation properties: total_minor: type: integer minimum: 0 maximum: 100000000000 description: The total, in US cents. by_implementation: type: array maxItems: 100 items: type: object additionalProperties: false required: - implementation - role - spend_minor properties: implementation: type: string pattern: ^[a-z][a-z0-9_]{0,31}$ description: >- The resolver, collector or analyser that produced a record, by its catalogue name. role: enum: - resolver - collector - analyser spend_minor: type: integer minimum: 0 maximum: 100000000000 description: What one implementation cost. description: What the latest screening of the person cost. description: A person and where their screening and review stand. profiles: type: array maxItems: 100 items: type: object additionalProperties: false required: - id - platform - handle - url - access - match - collector - items_read - collected_at properties: id: type: string pattern: ^prf_[0-7][0-9A-HJKMNP-TV-Z]{25}$ platform: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. handle: type: string minLength: 1 maxLength: 100 url: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ display_name: type: string minLength: 1 maxLength: 200 bio: type: string minLength: 1 maxLength: 4000 avatar_url: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ followers: type: integer minimum: 0 maximum: 10000000000 account_created_at: type: string format: date-time access: enum: - public - private - locked description: >- public profiles were read; a private or locked one exists but could not be read. match: type: object additionalProperties: false required: - state - evidence properties: state: enum: - confirmed - probable - possible description: >- How sure the screening is that a profile is the person's, from its evidence: confirmed is a handle on the person row, or two or more hard identifiers (email, phone, a supplied handle, or a fact an existing source returned); probable is one identifier beyond the name; possible is the name alone. evidence: type: array minItems: 1 maxItems: 20 items: type: object additionalProperties: false required: - kind - resolver properties: kind: enum: - email - phone - supplied_handle - source_fact - name - company - city - school description: >- What matched. email, phone, supplied_handle and source_fact are hard identifiers; company, city and school are soft. supplied_handle is a handle on the person row; source_fact is an account a profile found by the person's lookups lists. detail: type: string minLength: 1 maxLength: 200 description: >- Where the match was seen, such as the profile field that carried it. resolver: type: string pattern: ^[a-z][a-z0-9_]{0,31}$ description: >- The resolver, collector or analyser that produced a record, by its catalogue name. description: One identifier that ties a profile to the person. description: >- How a profile was matched to the person: the state its evidence earns, and the evidence. collector: type: string pattern: ^[a-z][a-z0-9_]{0,31}$ description: >- The resolver, collector or analyser that produced a record, by its catalogue name. items_read: type: integer minimum: 0 maximum: 100000 posts_stopped: enum: - platform_limit - page_limit - rate_limited - unavailable description: >- Why fewer posts were read than the screening's depth asks for while the account holds more. platform_limit: the platform shows the screening no more of them. page_limit: the pages a screening reads ran out first. rate_limited or unavailable: a later page was held back or failed; the posts before it are kept and the person is partial. Absent when the account was read to its end or to the depth. period_from: type: string format: date-time description: The oldest item read. period_to: type: string format: date-time description: The newest item read. collected_at: type: string format: date-time record: type: object additionalProperties: false required: - id - source - matched - fields - observed_at properties: id: type: string pattern: ^rec_[0-9a-f]{32}$ description: >- Made from the source and the fields' names and original values, so the same answer found twice is one record with the same id. source: type: object additionalProperties: false required: - connector - kind properties: connector: type: string minLength: 1 maxLength: 100 description: >- The id of the connector that read the record: breach for a breach row. kind: type: string minLength: 1 maxLength: 50 description: >- The kind of source: platform for an account read off a live platform; for a breach row, the kind of leak its table is: site_breach, credential_list, stealer_log, scrape, hacking_forum, abuse_service or darkweb_site. site: type: string minLength: 1 maxLength: 253 description: The host a person knows the source's site by. table: type: string minLength: 1 maxLength: 500 description: The table a leaked row came from. date: type: string minLength: 1 maxLength: 50 description: >- When the source's data dates from, at the precision it is known: YYYY or YYYY-MM for a breach table. description: >- Where the record came from: the connector, the kind of source and the site, and for a leaked row its table and date. matched: type: array maxItems: 50 items: type: object additionalProperties: false required: - by properties: by: type: string minLength: 1 maxLength: 50 description: >- The kind of searched value: email, phone, username, ip, name, password, hash, or handle for a profile read of a handle. field: type: string minLength: 1 maxLength: 500 description: >- The field the searched value hit, when the record holds it. search: type: string pattern: ^srh_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The search a person started on a value of another record that found this one, among the person report's searches, which names the value and the record and field it came from. A record found only by such searches is a lead, whatever kind of value found it. Absent for a match of the lookups. description: One searched value that found the record. description: Each kind of searched value that found the record. fields: type: array maxItems: 100000 items: type: object additionalProperties: false required: - field - original properties: field: type: string minLength: 1 maxLength: 500 description: >- The source's own name for the field. A nested value's name is dotted, and a list element's carries its index. original: type: string description: >- The value as the source wrote it. A count is written in decimal and a time in RFC 3339; a breach column's value is as the leak holds it. kind: type: string enum: - email - phone - username - account_id - url - domain - image - person_name - gender - age - language - organisation - job_title - country - region - city - address - postcode - coordinates - timezone - date - date_time - duration - ip - mac_address - device_id - user_agent - password - hash - salt - token - security_answer - card_number - bank_account - crypto_address - amount - id_number - vehicle - label - long_text - count - score - flag - structured - text description: >- What sort of value the field holds, which decides the form of value. role: type: string enum: - account_id - account_status - account_type - alternate_phone - balance - banned - bio - born - bot - caller_category - chargebacks - cover_picture - declines - deleted - deleted_on - department - display_name - email_verified - expires - first_name - followers - following - friends - full_address - full_name - handle - headline - interests - job_title - joined - last_active - last_ip - last_name - last_post - last_updated - level - likes_given - likes_received - line_type - linked_account - location - marked_spam - middle_name - nationality - organisation - other_ip - paid - password_changed - payment_method - picture - points - posts - private - profile_link - profile_views - rating - referrals - referrer - report_count - reputation - reputation_label - residence - salutation - school - signature - signup_ip - site_role - spam_score - street - trades - verified - warnings - website description: >- Which common field the value is, where many sources share it. Absent for a field only its source returns. value: type: string description: >- The value cleaned to its kind's one form: an email in lower case, a phone number in international form when its country is known, a date in ISO form, a country as its two-letter code, a flag as true or false. Absent when the value cannot be cleaned as its kind; original still holds it. detail: type: string minLength: 1 maxLength: 50 description: >- What the value shows of itself beyond its kind: the likely algorithm of a hash, the likely coin of a crypto address or the currency of an amount. distinctive: type: object additionalProperties: false required: - rating - reason properties: rating: type: string enum: - unique - distinctive - common description: >- unique: an email or phone, which belongs to one person by design. distinctive: rare enough that a new search on it likely finds one person. common: shared by many people, so a search on it finds strangers. A new search is suggested for unique and distinctive values only; any value can still be searched. reason: type: string minLength: 1 maxLength: 200 description: >- Why, in plain words, such as "seen 3,861,493 times in breach data", "in 4 breach rows" or "38 bits, about one in 430 billion usernames". description: >- How distinctive a searchable value is, so whether a new search on it would find one person. description: One value a source returned. description: >- Every field the source returned, in the order the source's connector lists them; a breach row's columns in name order. Nothing is withheld: a breach row's passwords, hashes and salts are fields like any other. observed_at: type: string format: date-time description: When the source last gave this answer. likelihood: type: number minimum: 0 maximum: 1 description: >- How likely the record is the person it was found for, from 0.01 to 0.99, to two places. A record found by the person's own email or phone starts as theirs; any other starts lower the more people its search found on its site. Each value it shares with what is known of the person raises it, a rare value more than a common one, and a different birth date or full name lowers it. What is known is what the person's row gives and the values of their own records: those found by their email or phone, and those a reviewer joined. Present on a person's lookup records, with agreed, clashed and joined. agreed: type: array maxItems: 100000 items: type: string minLength: 1 maxLength: 500 description: >- The fields of this record whose values agreed with what is known of the person, by their field names, in the record's order. The value that found the record is not among them. clashed: type: array maxItems: 100000 items: type: string minLength: 1 maxLength: 500 description: >- The fields of this record that clashed with what is known of the person: a birth date or a full name that differs from the person's. joined: type: boolean description: >- Whether the record joins the person: its likelihood reached 0.9 or a reviewer joined it, and no reviewer rejected it. A record that does not join stays a lead. verdict: enum: - joined - rejected description: >- A reviewer's overrule (POST.../people/{person_id}/records), which decides joined whatever the likelihood and sticks for as long as a lookup finds the same record. Absent when nobody overruled it. description: >- Everything the connector read of the account, whole, under the platform's own names. The fields above are the parts of it the roster shows. Absent from a profile screened before records were kept. description: >- An account the screening matched to the person, how it was matched, and how much of it was read. description: >- The accounts the latest screening matched, with how each was matched. findings: type: array maxItems: 500 items: type: object additionalProperties: false required: - id - category - band - confidence - rationale - evidence - analyser - model - spend_minor - created_at properties: id: type: string pattern: ^fnd_[0-7][0-9A-HJKMNP-TV-Z]{25}$ category: enum: - direct_threat - harm_intent - fixation - grievance - security_research - weapons - disruption - violent_extremism - harassment - movement_exposure description: >- What a finding is about: a direct threat to the principal or the group, intent to harm without a named target, fixation on the principal, a grievance against the host, research into the venue, route or security, weapons tied to any of these, disruption or protest planning toward this group, violent extremist content or identification, prior harassment or stalking of staff or principals, or posting the principal's addresses or movements. band: enum: - critical - high - moderate - low - info description: How severe a finding is, most severe first. capped_from: enum: - critical - high - moderate - low - info description: How severe a finding is, most severe first. confidence: type: number minimum: 0 maximum: 1 rationale: type: string minLength: 1 maxLength: 4000 quote: type: string minLength: 1 maxLength: 1000 description: >- The exact words of the first evidence item that the finding rests on, as the analyser quoted them. evidence: type: array minItems: 1 maxItems: 50 uniqueItems: true items: type: string pattern: ^itm_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: The posts and media that support the finding. media_observations: type: array maxItems: 50 items: type: object additionalProperties: false required: - media_id - description properties: media_id: type: string pattern: ^itm_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: The image, one of the finding's evidence. description: type: string minLength: 1 maxLength: 1000 description: >- What the analyser saw in the image that supports the finding. read_text: type: string minLength: 1 maxLength: 1000 description: >- Words the analyser read in the image, as it read them. They come from the image's pixels, not from a post's text, so they are not a quote and were not checked against the record. description: What an analyser saw in one image that a finding rests on. description: >- What the analyser saw in each image among evidence that the finding rests on. Unlike quote, an observation cannot be checked against the record: judge it against the image at the media item's permalink. analyser: type: string pattern: ^[a-z][a-z0-9_]{0,31}$ description: >- The resolver, collector or analyser that produced a record, by its catalogue name. model: type: string minLength: 1 maxLength: 100 spend_minor: type: integer minimum: 0 maximum: 100000000000 description: What the analysis cost, in US cents. created_at: type: string format: date-time description: >- Something the analyser flagged. band is capped by the strongest match among the profiles of its evidence: possible at most moderate, probable at most high. capped_from is the band the analyser gave when the cap lowered it. description: >- What the latest screening flagged, most severe first, each citing its evidence. posts: type: array maxItems: 5000 items: type: object additionalProperties: false required: - id - kind - profile_id - permalink - posted_at - text properties: id: type: string pattern: ^itm_[0-7][0-9A-HJKMNP-TV-Z]{25}$ kind: const: post text: type: string maxLength: 10000 reply_to: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ repost_of: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ description: >- The permalink of the post this one reposts. text then holds that post's author's words, not the person's. quote_of: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ description: >- The permalink of the post this one quotes. text holds the person's own words alone. place: type: object additionalProperties: false required: - name properties: name: type: string minLength: 1 maxLength: 200 id: type: string minLength: 1 maxLength: 100 description: The platform's own id of the place. address: type: string maxLength: 400 city: type: string maxLength: 200 latitude: type: number minimum: -90 maximum: 90 longitude: type: number minimum: -180 maximum: 180 description: Where the post says it was made. tagged: type: array maxItems: 100 items: type: string minLength: 1 maxLength: 100 description: >- The handles of the accounts the post tags, on its own platform. likes: type: integer minimum: 0 description: How many likes the platform shows for the post. comments: type: integer minimum: 0 description: How many comments the platform shows for the post. views: type: integer minimum: 0 description: How many views or plays the platform shows for the post. shares: type: integer minimum: 0 description: >- How many times the platform shows the post was shared or reposted. language: type: string minLength: 1 maxLength: 35 description: >- The language the platform says the post is in, as the platform codes it, such as en or pt-BR. edited: type: boolean description: >- true when the platform marks the post as edited after it went up. Absent when it does not mark it. sponsored: type: boolean description: >- true when the platform marks the post as a paid partnership or an ad. Absent when it does not mark it. ai_generated: type: boolean description: >- true when the platform labels the post as made or changed with AI. Absent when it does not label it. posted_with: type: string minLength: 1 maxLength: 200 description: The app or device the platform says the post was made with. stated: type: object additionalProperties: true description: >- Everything else the platform sent about the post, under the platform's own names and as it typed them: counts, ids of linked posts and accounts, links, media details, labels and notices. The fields above are not repeated here. Nothing that describes the account the screening read with, such as whether it liked or saved the post, is ever here. profile_id: type: string pattern: ^prf_[0-7][0-9A-HJKMNP-TV-Z]{25}$ permalink: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ posted_at: type: string format: date-time screenshot_sha256: type: string pattern: ^[0-9a-f]{64}$ description: SHA-256 of the screenshot taken of a flagged item. captured_at: type: string format: date-time description: When the screenshot was taken. description: One post a collector read, with its permalink and time. description: The posts the findings cite. media: type: array maxItems: 5000 items: type: object additionalProperties: false required: - id - kind - profile_id - permalink - posted_at - media_type - media_url properties: id: type: string pattern: ^itm_[0-7][0-9A-HJKMNP-TV-Z]{25}$ kind: const: media post_id: type: string pattern: ^itm_[0-7][0-9A-HJKMNP-TV-Z]{25}$ media_type: enum: - image - video media_url: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ description: Where the platform serves the image or video. text: type: string maxLength: 4000 description: The caption or alt text. profile_id: type: string pattern: ^prf_[0-7][0-9A-HJKMNP-TV-Z]{25}$ permalink: type: string minLength: 8 maxLength: 2048 pattern: ^https://[^\s]+$ posted_at: type: string format: date-time screenshot_sha256: type: string pattern: ^[0-9a-f]{64}$ description: SHA-256 of the screenshot taken of a flagged item. captured_at: type: string format: date-time description: When the screenshot was taken. description: >- One image or video a collector read, with the post that carried it. description: The images and videos the findings cite. reviews: type: array maxItems: 1000 items: type: object additionalProperties: false required: - id - decision - created_by - created_at properties: id: type: string pattern: ^arv_[0-7][0-9A-HJKMNP-TV-Z]{25}$ decision: enum: - cleared - watch - escalated note: type: string minLength: 1 maxLength: 2000 created_by: type: string minLength: 1 maxLength: 256 created_at: type: string format: date-time description: One recorded decision. description: Every recorded decision, oldest first. lookup: type: object additionalProperties: false required: - checks - looked_at properties: checks: type: array maxItems: 12 items: type: object additionalProperties: false required: - identifier - lane - status - sources - answered - found properties: identifier: enum: - email - phone - username lane: enum: - accounts - phone - breach - domain - ip description: >- An evidence lane: accounts (account presence for email and username), phone, breach, domain (the email domain's registration) and ip. status: enum: - found - not_found - partial - not_covered description: >- found: a source found the identifier. not_found: every source answered and none found it. partial: the sources that answered found nothing and the others did not answer. not_covered: no source answered. A lookup that failed reads partial or not_covered, not not_found. sources: type: integer minimum: 0 maximum: 256 description: >- Sources asked: none when no source could be, as when the source is stopped or your workspace refuses it. answered: type: integer minimum: 0 maximum: 256 description: Sources that gave a definite answer. found: type: integer minimum: 0 maximum: 256 description: Sources that found the identifier. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a source did not answer, or none could be asked: the lane's most specific failure, or insufficient_evidence when every source that did not answer could not tell (inconclusive). A lane with a reason reads partial or not_covered. description: What came of one lane of the lookups for one identifier. description: >- Each lane each identifier was looked up in, identifiers in the order email, phone, username and lanes in the order accounts, phone, breach, domain. Every lane the person's identifiers are looked up in is listed: one that no source answered, or that no source could be asked in, is not_covered. Empty when the person has no email, phone or handle to look up. summary: type: object additionalProperties: false properties: phone: type: object additionalProperties: false properties: line_type: enum: - mobile - voip - landline - toll_free - other country: type: string pattern: ^[A-Z]{2}$ not: pattern: \n report_count: type: integer minimum: 0 description: Highest report count any source gave for the number. carrier: type: string minLength: 1 maxLength: 128 description: >- Carrier-network metadata from privately weighted sources; not upstream provider attribution. email: type: object additionalProperties: false properties: disposable: type: boolean accounts_found: type: integer minimum: 0 description: Accounts found for the email. breach: type: object additionalProperties: false required: - found description: >- Breach facts for the email. Replaces the boolean breached. properties: found: type: boolean breach_count: type: integer minimum: 0 description: Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed username: type: object additionalProperties: false properties: accounts_found: type: integer minimum: 0 description: Accounts found for the username. breach: type: object additionalProperties: false required: - found description: Breach facts for the username. properties: found: type: boolean breach_count: type: integer minimum: 0 description: Distinct breach tables the value appears in. first_year: type: integer minimum: 1970 maximum: 2100 description: Year of the oldest dated table. last_year: type: integer minimum: 1970 maximum: 2100 description: Year of the newest dated table. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. description: >- The union of data kinds the matching tables held, never the values. in_credential_lists: type: boolean description: >- The value is in a credential_list or stealer_log table. recent_password_exposure: type: boolean description: >- A plaintext password sat next to the value in a table dated two years ago or less, or the value is in a stealer_log table. truncated: type: boolean allOf: - if: properties: truncated: const: true required: - truncated then: properties: found: const: true - if: properties: found: const: false required: - found then: not: anyOf: - required: - first_year - required: - last_year - required: - exposed ip: type: object additionalProperties: false description: >- Facts about the submitted IP from the offline database and this workspace's own recent assessments. Every member is optional; absent makes no claim. properties: country: type: string pattern: ^[A-Z]{2}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: ISO 3166-1 alpha-2 country of the address. type: enum: - residential - hosting - vpn - proxy - tor - mobile - unknown description: The address's network type. asn: type: integer minimum: 1 maximum: 4294967295 description: >- Autonomous system number of the network that announces the address, from the offline database. Absent when unknown. seen_in_workspace: type: integer minimum: 0 description: >- Assessments in this workspace with the same IP in the last 24 hours, this one included. A count only. consistency: type: object additionalProperties: false description: >- Cross-identifier agreement, computed from facts only. Every member is optional; absent makes no claim. properties: name: enum: - match - partial - mismatch - unknown description: >- The submitted name against breach names and caller-ID names. phone: enum: - match - partial - mismatch - unknown description: >- The submitted phone against numbers found next to the email in breach records. ip: enum: - match - partial - mismatch - unknown description: >- The submitted IP against IPs found next to the email or username in breach records. country: enum: - consistent - mismatch - unknown description: >- IP country, phone country, breach countries and policy_context.region together. When the breach records give a country, the timezone and locale countries count too. The IP country of a proxy or hosting network does not count. footprint: type: object additionalProperties: false description: >- How long and how widely the signup's email and username have existed, and how far independent sources agree on the person behind them, in years and counts only. families are the kinds of evidence that found either identifier. Omitted when nothing found them: a footprint lookup that failed makes no claim, and absence is no_digital_footprint's to state. required: - families properties: email: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). username: type: object additionalProperties: false description: >- One identifier's dated footprint across every source: the first and last year any event was seen, the years between them, the latest year a source dated activity (omitted when none did), how many distinct sites and which kinds of evidence saw it. required: - first_seen_year - last_seen_year - span_years - sites - families properties: first_seen_year: type: integer minimum: 1970 maximum: 2100 last_seen_year: type: integer minimum: 1970 maximum: 2100 span_years: type: integer minimum: 0 last_active_year: type: integer minimum: 1970 maximum: 2100 sites: type: integer minimum: 1 families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). families: type: array uniqueItems: true items: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). coherence: type: object additionalProperties: false minProperties: 1 properties: birth_date: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 gender: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 nationality: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 country: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 city: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 zip: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 name: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 company: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 website: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 social: type: object additionalProperties: false description: >- How far independent sources agree on one attribute: values is the number of distinct values reported, support the tables and profiles reporting any, and agreement match (one value), partial (the most reported value holds more than half the support) or mismatch. The values themselves are not served. required: - agreement - values - support properties: agreement: enum: - match - partial - mismatch values: type: integer minimum: 1 support: type: integer minimum: 1 description: >- The typed facts per identifier, as an assessment's risk.summary: accounts found, the breach summary, phone facts and the identity's footprint. Absent when nothing answered with one. details: type: object additionalProperties: false description: >- The merged observations, as an assessment's risk.details: every account search, breach tables and names, phone names and dated events. Served only to a caller who may read evidence: a member with evidence.read, or a key with the detailed or evidence scope. properties: phone_names: type: array maxItems: 32 items: type: object additionalProperties: false required: - value - seen_by properties: value: type: string minLength: 1 maxLength: 128 seen_by: type: integer minimum: 1 breaches: type: array maxItems: 100 items: type: object additionalProperties: false required: - name - kind - matched_on description: >- One breach table that matched, detailed view only. No member carries a record, value, password or hash. properties: name: type: string minLength: 1 maxLength: 128 not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The breached site's domain, lower case. Absent when the table has none (a credential list, for example). category: type: string pattern: ^[a-z0-9_]{1,64}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The table's category from its name, lower case (social, gaming, combolist...). kind: enum: - site_breach - credential_list - stealer_log - scrape - hacking_forum - abuse_service - darkweb_site description: >- Who is in the table: site_breach, a site's own users; credential_list, a combolist or compilation; stealer_log, malware or botnet victims; scrape; hacking_forum, a criminal hacking, cracking or carding community; abuse_service, the customers of DDoS-for-hire, account generators, dump or card shops, darknet markets, stalkerware or breach-lookup services; darkweb_site, an onion site of unknown purpose. year: type: integer minimum: 1970 maximum: 2100 description: A breach table's date year. month: type: integer minimum: 1 maximum: 12 description: Absent when only the year is known. matched_on: enum: - email - username - ip description: >- The submitted email or username whose own search matched the table. The phone is never searched. A submitted full name is searched as well, and what that search finds feeds the identity's facts and reasons rather than this list. exposed: type: array maxItems: 11 items: enum: - email - username - name - password - password_hash - phone - address - dob - ip - payment - security_qa description: >- A kind of data a breach table held next to the identifier. password means a plaintext password was present; NoResponse never stores it and never says what it was. password_hash means a hash, salt or token was present. A value, never: the schema has no member for one. conduct: type: array minItems: 1 maxItems: 3 uniqueItems: true items: enum: - chargeback - declined_payment - forum_sanction description: >- What a breach table's rows record against the identifier: chargeback, one or more chargebacks; declined_payment, one or more declined payments; forum_sanction, a forum ban, warning or infraction. A category and not a value: the schema has no member for one. description: >- What this table's rows record against the matched email or username: the tables behind the forum_sanctioned and prior_payment_abuse reasons. Absent when the rows record none, for a table matched on an IP address, and from an answer stored before it was recorded. description: The matching breach tables, newest first, at most 100. breach_names: type: array maxItems: 32 description: >- Names found next to the identifiers in breach records, merged, with the number of distinct tables each was seen in and the sites of those tables. items: type: object additionalProperties: false required: - value - seen_in properties: value: type: string minLength: 1 maxLength: 128 seen_in: type: integer minimum: 1 sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables hold the name, lower case, each once, newest breach first, at most 32: the domain values of breaches[]. Covers the email's and the username's tables together. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables that hold the name have no site, such as a credential list or a stealer log. Absent when none. events: type: array maxItems: 300 description: >- The identity's dated footprint events, newest first, at most 300: the year and month, what happened (created, last_active, breached), the site, its category, the kind of evidence and the identifier it belongs to. No breach value: dates are coarsened to the month. items: type: object additionalProperties: false required: - year - kind - site - category - family - identifier properties: year: type: integer minimum: 1970 maximum: 2100 month: type: integer minimum: 1 maximum: 12 kind: enum: - created - last_active - breached site: type: string minLength: 1 maxLength: 128 not: pattern: '[\x00-\x1f\x7f]' category: type: string pattern: ^[a-z0-9_]{1,64}$ family: enum: - account_presence - auth_provider - breach - breach_abuse - code_hosting description: >- The source-neutral kind of evidence: account_presence (an account found on a site), auth_provider (the account at your auth provider), breach (breach and credential tables), breach_abuse (abuse and fraud communities' tables) and code_hosting (a code hosting profile). identifier: enum: - email - username accounts: type: array maxItems: 64 description: >- Every online-account search of the email or username: the platform, what the search came to and, for an account found, what the platform returned beside it. Found first, then not found, then searches that failed or are still running, each by platform name; at most 64. A failed or running search keeps its own outcome and is not reported as not_found. items: type: object additionalProperties: false required: - name - domain - identifier - outcome description: >- One online-account search of the signup's email or username, detailed view only. name and domain name the platform searched, not a provider. outcome is the search's signal outcome: found, not_found, or a failure (blocked, unavailable, inconclusive) with its reason; a failure is not reported as not_found. The members after reason are what the platform returned beside an account it found, each absent when it did not say. properties: name: type: string minLength: 1 maxLength: 64 description: The platform's name, such as Adobe or GitHub. domain: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ description: >- The platform's domain, lower case: the host its logo is fetched for. identifier: enum: - email - username description: The identifier searched. outcome: enum: - found - not_found - inconclusive - blocked - unavailable description: >- Per-signal outcome. A failure is never not_found: a source that timed out, was blocked or errored reports blocked, unavailable or inconclusive with a reason, and is listed in incomplete_sources. reason: enum: - timed_out - rate_limited - blocked - source_error - unavailable - deferred - insufficient_evidence description: >- Why a signal or source did not produce a definite found/not_found. timed_out means the source missed the request deadline; a continuation may still settle it. deferred means the (source, identifier) pair is async-only and was not attempted on the synchronous path; a continuation settles it. sign_in: type: array minItems: 1 maxItems: 7 uniqueItems: true items: enum: - password - google - facebook - apple - microsoft - sso - other description: >- How the account signs in, as the platform reports it, sorted: a password, a Google, Facebook, Apple or Microsoft account, the organisation's single sign-on, or another method. email_verified: type: boolean description: >- Whether the platform says the account's email is verified. blocked: type: boolean description: >- Whether the platform says the account is blocked or suspended. account_type: enum: - personal - business description: >- personal, or business: an account a company or school manages. has_avatar: type: boolean description: >- Whether the account has its own profile picture rather than the platform's default. The picture is not returned. first_name_prefix: type: string minLength: 1 maxLength: 32 description: >- The first letters of the account holder's first name, as the platform shows them (Life360 shows two and hides the rest). It is evidence only: it does not change the score or the consistency results. attribute_conflicts: type: array maxItems: 4 description: >- What an identity_attribute_conflict reason weighed: each attribute the records disagree on and the sites reporting it. Absent when the reason did not fire, and on an answer stored before conflicts were recorded. No value is served. items: type: object additionalProperties: false required: - attribute properties: attribute: enum: - birth_date - gender - nationality - name_gender description: >- name_gender is the records' gender against the submitted first name's usual one. sites: type: array minItems: 1 maxItems: 32 uniqueItems: true items: type: string minLength: 3 maxLength: 253 pattern: >- ^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$ not: description: >- A NUL or line feed anywhere, refused with not beside anchored patterns. The parser refuses NUL in every request string. This guard also closes engines where $ accepts a final line feed. pattern: '[\x00\n]' description: >- The domains of the breached sites whose tables report the attribute, newest breach first, at most 32. Absent when none of the tables has a site. unsited: type: integer minimum: 1 description: >- How many of the tables reporting the attribute have no site, such as a credential list or a stealer log. Absent when none. records: type: array maxItems: 100000 items: type: object additionalProperties: false required: - id - source - matched - fields - observed_at properties: id: type: string pattern: ^rec_[0-9a-f]{32}$ description: >- Made from the source and the fields' names and original values, so the same answer found twice is one record with the same id. source: type: object additionalProperties: false required: - connector - kind properties: connector: type: string minLength: 1 maxLength: 100 description: >- The id of the connector that read the record: breach for a breach row. kind: type: string minLength: 1 maxLength: 50 description: >- The kind of source: platform for an account read off a live platform; for a breach row, the kind of leak its table is: site_breach, credential_list, stealer_log, scrape, hacking_forum, abuse_service or darkweb_site. site: type: string minLength: 1 maxLength: 253 description: The host a person knows the source's site by. table: type: string minLength: 1 maxLength: 500 description: The table a leaked row came from. date: type: string minLength: 1 maxLength: 50 description: >- When the source's data dates from, at the precision it is known: YYYY or YYYY-MM for a breach table. description: >- Where the record came from: the connector, the kind of source and the site, and for a leaked row its table and date. matched: type: array maxItems: 50 items: type: object additionalProperties: false required: - by properties: by: type: string minLength: 1 maxLength: 50 description: >- The kind of searched value: email, phone, username, ip, name, password, hash, or handle for a profile read of a handle. field: type: string minLength: 1 maxLength: 500 description: >- The field the searched value hit, when the record holds it. search: type: string pattern: ^srh_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The search a person started on a value of another record that found this one, among the person report's searches, which names the value and the record and field it came from. A record found only by such searches is a lead, whatever kind of value found it. Absent for a match of the lookups. description: One searched value that found the record. description: Each kind of searched value that found the record. fields: type: array maxItems: 100000 items: type: object additionalProperties: false required: - field - original properties: field: type: string minLength: 1 maxLength: 500 description: >- The source's own name for the field. A nested value's name is dotted, and a list element's carries its index. original: type: string description: >- The value as the source wrote it. A count is written in decimal and a time in RFC 3339; a breach column's value is as the leak holds it. kind: type: string enum: - email - phone - username - account_id - url - domain - image - person_name - gender - age - language - organisation - job_title - country - region - city - address - postcode - coordinates - timezone - date - date_time - duration - ip - mac_address - device_id - user_agent - password - hash - salt - token - security_answer - card_number - bank_account - crypto_address - amount - id_number - vehicle - label - long_text - count - score - flag - structured - text description: >- What sort of value the field holds, which decides the form of value. role: type: string enum: - account_id - account_status - account_type - alternate_phone - balance - banned - bio - born - bot - caller_category - chargebacks - cover_picture - declines - deleted - deleted_on - department - display_name - email_verified - expires - first_name - followers - following - friends - full_address - full_name - handle - headline - interests - job_title - joined - last_active - last_ip - last_name - last_post - last_updated - level - likes_given - likes_received - line_type - linked_account - location - marked_spam - middle_name - nationality - organisation - other_ip - paid - password_changed - payment_method - picture - points - posts - private - profile_link - profile_views - rating - referrals - referrer - report_count - reputation - reputation_label - residence - salutation - school - signature - signup_ip - site_role - spam_score - street - trades - verified - warnings - website description: >- Which common field the value is, where many sources share it. Absent for a field only its source returns. value: type: string description: >- The value cleaned to its kind's one form: an email in lower case, a phone number in international form when its country is known, a date in ISO form, a country as its two-letter code, a flag as true or false. Absent when the value cannot be cleaned as its kind; original still holds it. detail: type: string minLength: 1 maxLength: 50 description: >- What the value shows of itself beyond its kind: the likely algorithm of a hash, the likely coin of a crypto address or the currency of an amount. distinctive: type: object additionalProperties: false required: - rating - reason properties: rating: type: string enum: - unique - distinctive - common description: >- unique: an email or phone, which belongs to one person by design. distinctive: rare enough that a new search on it likely finds one person. common: shared by many people, so a search on it finds strangers. A new search is suggested for unique and distinctive values only; any value can still be searched. reason: type: string minLength: 1 maxLength: 200 description: >- Why, in plain words, such as "seen 3,861,493 times in breach data", "in 4 breach rows" or "38 bits, about one in 430 billion usernames". description: >- How distinctive a searchable value is, so whether a new search on it would find one person. description: One value a source returned. description: >- Every field the source returned, in the order the source's connector lists them; a breach row's columns in name order. Nothing is withheld: a breach row's passwords, hashes and salts are fields like any other. observed_at: type: string format: date-time description: When the source last gave this answer. likelihood: type: number minimum: 0 maximum: 1 description: >- How likely the record is the person it was found for, from 0.01 to 0.99, to two places. A record found by the person's own email or phone starts as theirs; any other starts lower the more people its search found on its site. Each value it shares with what is known of the person raises it, a rare value more than a common one, and a different birth date or full name lowers it. What is known is what the person's row gives and the values of their own records: those found by their email or phone, and those a reviewer joined. Present on a person's lookup records, with agreed, clashed and joined. agreed: type: array maxItems: 100000 items: type: string minLength: 1 maxLength: 500 description: >- The fields of this record whose values agreed with what is known of the person, by their field names, in the record's order. The value that found the record is not among them. clashed: type: array maxItems: 100000 items: type: string minLength: 1 maxLength: 500 description: >- The fields of this record that clashed with what is known of the person: a birth date or a full name that differs from the person's. joined: type: boolean description: >- Whether the record joins the person: its likelihood reached 0.9 or a reviewer joined it, and no reviewer rejected it. A record that does not join stays a lead. verdict: enum: - joined - rejected description: >- A reviewer's overrule (POST.../people/{person_id}/records), which decides joined whatever the likelihood and sticks for as long as a lookup finds the same record. Absent when nobody overruled it. description: >- One answer from one source: where it came from, what found it and every field it holds. A person's lookup records also say how likely each is the person. description: >- What each source answered, whole, each answer once: every field of each account a connector found, and every column of each breach row the person's email or usernames matched, under the source's own names, and what each search a person started found, each match naming its search. Anyone who may read the person reads them: no extra permission applies, breach passwords and hashes included. remaining: type: array maxItems: 100000 items: type: object additionalProperties: false required: - source - by - rows properties: source: type: object additionalProperties: false required: - connector - kind properties: connector: type: string minLength: 1 maxLength: 100 description: >- The id of the connector that read the record: breach for a breach row. kind: type: string minLength: 1 maxLength: 50 description: >- The kind of source: platform for an account read off a live platform; for a breach row, the kind of leak its table is: site_breach, credential_list, stealer_log, scrape, hacking_forum, abuse_service or darkweb_site. site: type: string minLength: 1 maxLength: 253 description: The host a person knows the source's site by. table: type: string minLength: 1 maxLength: 500 description: The table a leaked row came from. date: type: string minLength: 1 maxLength: 50 description: >- When the source's data dates from, at the precision it is known: YYYY or YYYY-MM for a breach table. description: >- The source whose rows the search matched: for a leaked row, its table. by: type: string minLength: 1 maxLength: 50 description: >- The kind of searched value whose search matched the rows, as a record's matched names it. search: type: string pattern: ^srh_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The search a person started that matched the rows. Searching the same field again with this source's table fetches them. rows: type: integer minimum: 1 description: >- How many rows of the source that search matched beyond the records the lookup carries. description: >- Rows one search matched in one source that the lookup's records leave out, so no answer is cut short in silence. description: >- For each search and source whose matched rows records leave out, how many: a breach search returns at most 20 rows of a table and 100 in all, from its first 64 tables by name. A search a person starts on one table of its source fetches the rest of that table, up to 100 rows. Absent when records hold every matched row. looked_at: type: string format: date-time description: When the lookups ran. description: >- What the latest screening's lookups found, and the records the searches people started found, each match naming its search. Absent until a screening that ran lookups reaches the person. searches: type: array maxItems: 10000 items: type: object additionalProperties: false required: - search_id - record_id - field - kind - value - status - sources - answered - found - estimated_spend - spent - requested_by - created_at properties: search_id: type: string pattern: ^srh_[0-7][0-9A-HJKMNP-TV-Z]{25}$ record_id: type: string pattern: ^rec_[0-9a-f]{32}$ description: The record whose value led to the search. field: type: string minLength: 1 maxLength: 500 description: The field of that record that holds the value. table: type: string minLength: 1 maxLength: 500 description: >- The one breach table searched, when the search was of one table. kind: enum: - email - phone - username - person_name - password - hash - ip description: The kind of the value searched. value: type: string description: >- The value searched: the field's cleaned value, else as the source wrote it. status: enum: - counting - counted - queued - running - completed - partial - failed description: >- A password or hash search is counting, then counted: rows says how many breach rows hold the value, and nothing runs until a person runs it (POST.../searches/{search_id}/run). Any other search is queued, then running. completed: every source it asked answered. partial: some did not. failed: none answered or none could be asked, which says nothing about whether the value is held anywhere. rows: type: integer minimum: 0 description: >- How many breach rows hold the password or hash, counted before the search runs. sources: type: integer minimum: 0 description: >- How many sources the search asked: the breach search and the account and phone lookups that take the value's kind. answered: type: integer minimum: 0 description: How many of them gave a definite answer, found or not found. found: type: integer minimum: 0 description: >- How many records the search found. They are among the person report's lookup records, each match naming this search. estimated_spend: type: integer minimum: 0 description: >- What the search may spend, in US cents, held against the environment's daily screening cap while it runs. spent: type: integer minimum: 0 description: What the search spent, in US cents, metered as screening work. error_code: enum: - not_answered - no_source - worker_attempts_exhausted description: >- Why a failed search found nothing: its sources did not answer, none could be asked, or it could not run before its attempts were spent. requested_by: type: string minLength: 1 maxLength: 256 description: Who started the search. created_at: type: string format: date-time finished_at: type: string format: date-time description: >- One search a person started on a value of one of a person's records. Nothing searches again by itself. description: >- The searches people started on this person's values, newest first: each names the value, and the record and field it came from. Absent when nobody searched. other_groups: type: object additionalProperties: false required: - total - items properties: total: type: integer minimum: 0 description: >- How many people of other groups match, of which items lists the 20 most recent. items: type: array maxItems: 20 items: type: object additionalProperties: false required: - group_id - group_name - group_starts_at - person_id - matched_on - match_state - highest_band - decision properties: group_id: type: string pattern: ^grp_[0-7][0-9A-HJKMNP-TV-Z]{25}$ group_name: type: string minLength: 1 maxLength: 200 group_starts_at: type: string format: date-time person_id: type: string pattern: ^per_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: The person on that group's list. matched_on: type: array minItems: 1 maxItems: 3 uniqueItems: true items: enum: - email - phone - external_id description: >- Which identifiers match, in this order. external_id appears only beside email or phone: the same external id alone is not a match, since ticket numbers may be reused across groups. match_state: enum: - unscreened - confirmed - probable - possible - none_found - inaccessible description: That person's match state in that group. no_profile_to_check: type: boolean description: >- true when that person's latest screening had no profile to check (see the person's no_profile_to_check). Left out otherwise. highest_band: anyOf: - enum: - critical - high - moderate - low - info - type: 'null' description: That person's most severe band in that group, or null. decision: anyOf: - enum: - cleared - watch - escalated - type: 'null' description: >- The latest reviewer decision in that group, or null before any. decided_by: type: string minLength: 1 maxLength: 256 description: Who made that decision. decided_at: type: string format: date-time description: When that decision was made. description: >- A person of another group in the same environment who shares an email or phone with this one, as that group recorded them. description: >- The 20 people of the most recent other groups, newest group first. description: >- The other groups of this environment where a person with the same email or phone appears, newest group first. History only: nothing in it changes this person's screening, band, match state or decision. description: >- Everything known about one person, and where else in the environment they appear. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.