> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Record a decision > Marks the person `cleared`, `watch` or `escalated` with a note. The latest decision is the person's decision. The next screening screens everyone on `watch` or `escalated` again. Requires the `groups` scope, within the key's own workspace and environment. ## OpenAPI ````yaml /openapi.json post /v1/workspaces/{workspace_id}/groups/{environment}/{group_id}/people/{person_id}/review openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/workspaces/{workspace_id}/groups/{environment}/{group_id}/people/{person_id}/review: post: tags: - groups summary: Record a decision description: >- Marks the person `cleared`, `watch` or `escalated` with a note. The latest decision is the person's decision. The next screening screens everyone on `watch` or `escalated` again. Requires the `groups` scope, within the key's own workspace and environment. operationId: reviewPerson parameters: - $ref: '#/components/parameters/WorkspaceId' - $ref: '#/components/parameters/Environment' - $ref: '#/components/parameters/GroupId' - $ref: '#/components/parameters/PersonId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PersonReviewRequest' responses: '200': $ref: '#/components/responses/PersonDecided' '400': $ref: '#/components/responses/InvalidGroupRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ControlForbidden' '404': $ref: '#/components/responses/WorkspaceNotFound' '409': $ref: '#/components/responses/GroupConflict' '415': $ref: '#/components/responses/UnsupportedMediaType' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/groups/test/grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM/people/per_01JA2Z8K6Q4V7W9XBCDEFGHJKM/review' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "decision": "escalated", "note": "Known to the venue team." }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.groups.reviewPerson({ workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: "test", groupId: "grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", personId: "per_01JA2Z8K6Q4V7W9XBCDEFGHJKM", body: { decision: "escalated", note: "Known to the venue team.", }, }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.groups.review_person(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="test", group_id="grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", person_id="per_01JA2Z8K6Q4V7W9XBCDEFGHJKM", decision="escalated", note="Known to the venue team.") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Groups.ReviewPerson(ctx, \"tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", components.KeyEnvironmentTest, \"grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", \"per_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", components.PersonReviewRequest{\n Decision: components.PersonDecisionEscalated,\n Note: noresponse.Pointer(\"Known to the venue team.\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.ReviewPersonRequest; import org.noresponse.models.operations.ReviewPersonResponse; import org.noresponse.models.shared.KeyEnvironment; import org.noresponse.models.shared.PersonDecision; import org.noresponse.models.shared.PersonReviewRequest; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); ReviewPersonRequest req = ReviewPersonRequest.builder() .workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .environment(KeyEnvironment.TEST) .groupId("grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .personId("per_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .body(PersonReviewRequest.builder() .decision(PersonDecision.ESCALATED) .note("Known to the venue team.") .build()) .build(); ReviewPersonResponse res = sdk.groups().reviewPerson() .request(req) .call(); if (res.person().isPresent()) { System.out.println(res.person().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Groups.ReviewPersonAsync( workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: KeyEnvironment.Test, groupId: "grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM", personId: "per_01JA2Z8K6Q4V7W9XBCDEFGHJKM", body: new PersonReviewRequest() { Decision = PersonDecision.Escalated, Note = "Known to the venue team.", } ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $body = new Shared\PersonReviewRequest( decision: Shared\PersonDecision::Escalated, note: 'Known to the venue team.', ); $response = $sdk->groups->reviewPerson( workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Shared\KeyEnvironment::Test, groupId: 'grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM', personId: 'per_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: $body ); $result = $response->result; // handle response - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.groups.review_person(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Models::Shared::KeyEnvironment::TEST, group_id: 'grp_01JA2Z8K6Q4V7W9XBCDEFGHJKM', person_id: 'per_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::PersonReviewRequest.new( decision: Models::Shared::PersonDecision::ESCALATED, note: 'Known to the venue team.' )) unless res.nil? # handle response end components: parameters: WorkspaceId: name: workspace_id in: path required: true schema: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. description: >- The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. Environment: name: environment in: path required: true schema: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. description: >- The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404. GroupId: name: group_id in: path required: true schema: type: string pattern: ^grp_[0-7][0-9A-HJKMNP-TV-Z]{25}$ PersonId: name: person_id in: path required: true schema: type: string pattern: ^per_[0-7][0-9A-HJKMNP-TV-Z]{25}$ schemas: PersonReviewRequest: type: object additionalProperties: false required: - decision properties: decision: enum: - cleared - watch - escalated description: cleared, watch or escalated. note: type: string minLength: 0 maxLength: 2000 description: Why, for the venue team and later reviewers. description: Records a decision on a person. Person: type: object additionalProperties: false required: - id - group_id - name - match_state - highest_band - decision - coverage - created_at - updated_at - spend properties: id: type: string pattern: ^per_[0-7][0-9A-HJKMNP-TV-Z]{25}$ group_id: type: string pattern: ^grp_[0-7][0-9A-HJKMNP-TV-Z]{25}$ external_id: type: string minLength: 1 maxLength: 128 description: >- Your own id for the person, unique within the group. A later row with the same external id updates this person. name: type: string minLength: 1 maxLength: 200 description: The person's full name. email: type: string minLength: 3 maxLength: 254 pattern: ^[^@\s]+@[^@\s]+$ description: The person's email. phone: type: string pattern: ^\+[1-9][0-9]{6,14}$ description: The person's phone in E.164 form. company: type: string minLength: 1 maxLength: 200 description: Where the person works. city: type: string minLength: 1 maxLength: 100 description: Where the person lives. handles: type: array maxItems: 20 items: type: object additionalProperties: false required: - platform - handle properties: platform: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. handle: type: string minLength: 1 maxLength: 100 description: The account's handle, without a leading @. description: An account the person is known to hold. description: Accounts the person is known to hold, at most 20. role: enum: - guest - crew - vendor - press description: >- The person's role in the group: guest (a ticket holder), crew, vendor or press. Leave it out when you do not know it: a person without one has no role, not guest. A later row naming the same person replaces it, and a change of role alone keeps the person's screening results. match_state: enum: - unscreened - confirmed - probable - possible - none_found - inaccessible description: >- How sure the latest screening is that it found the person's accounts. unscreened until a screening reaches the person, and after one that had no profile to check (no_profile_to_check). no_profile_to_check: type: boolean description: >- true when the latest screening reached the person but the list gave nothing to look up on any requested platform, such as no handle for a platform that reads supplied handles only: nobody looked for a profile. match_state stays unscreened, every platform is in coverage.not_searched, and the person is neither none_found nor failed and does not make the screening partial. Its lookups are on its report. Left out otherwise. highest_band: anyOf: - enum: - critical - high - moderate - low - info - type: 'null' description: The most severe finding's band, or null when nothing was flagged. decision: anyOf: - enum: - cleared - watch - escalated - type: 'null' description: The latest reviewer decision, or null before any. decision_note: type: string minLength: 1 maxLength: 2000 decided_by: type: string minLength: 1 maxLength: 256 decided_at: type: string format: date-time coverage: type: object additionalProperties: false required: - accounts_found - accounts_accessible - items_read - platforms properties: accounts_found: type: integer minimum: 0 maximum: 100 accounts_accessible: type: integer minimum: 0 maximum: 100 items_read: type: integer minimum: 0 maximum: 1000000 items_not_analysed: type: integer minimum: 0 maximum: 1000000 description: >- Items read that the analyser could not analyse. Above zero, the person is partial: a finding may be missing from them. not_analysed_by_reason: type: array maxItems: 8 items: type: object additionalProperties: false required: - reason - items properties: reason: enum: - video - image_unavailable - image_unsupported - image_limit - refused - unfinished - unverified - unspecified description: >- Why an item read was not analysed. video: a video, whose caption alone is read. image_unavailable: the image could not be fetched from the platform. image_unsupported: not a JPEG, PNG, GIF or WebP image, or too large to send. image_limit: past the most images one person's analysis reads. refused: the model declined to read it. unfinished: the model cut its batch short or answered outside the schema, or the request was rejected. unverified: a finding cited it with words it does not contain or an image it did not describe. unspecified: the analyser gave no reason. items: type: integer minimum: 1 maximum: 1000000 description: How many items read were not analysed for one reason. description: >- items_not_analysed split by reason, each reason once with at least one item. period_from: type: string format: date-time description: The oldest item read on any platform. period_to: type: string format: date-time description: The newest item read on any platform. platforms: type: array maxItems: 11 items: type: object additionalProperties: false required: - platform - status - accounts_found - items_read properties: platform: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. status: enum: - covered - none_found - inaccessible - failed - unavailable description: >- covered read at least one profile; none_found looked and found no account; inaccessible found accounts that are private or locked; failed could not finish looking; unavailable has no resolver or collector enabled. accounts_found: type: integer minimum: 0 maximum: 100 items_read: type: integer minimum: 0 maximum: 100000 description: What a screening read on one platform. not_searched: type: array maxItems: 11 uniqueItems: true items: enum: - instagram - x - bluesky - youtube - tiktok - facebook - threads - reddit - telegram - linkedin - github - scratch - dailymotion - substack - duolingo - dockerhub - wikipedia - internetarchive - spotify - patreon - wordpress - okru - flickr - synthetic description: >- A platform a screening can cover. github and scratch through flickr are each one read of the public profile a handle names, with no posts. synthetic is the deterministic connector's own platform, for exercising the product end to end with no network. description: >- Requested platforms where the person gave the screening nothing to look up, such as no handle for a platform that reads supplied handles only. Nothing looked and nothing failed: such a platform is not in platforms, is not none_found and does not make the person partial. description: >- What the latest screening read: accounts found, accessible, items read, the period covered and each platform's status. Zero, with no platforms, until a screening reaches the person. last_screening_id: type: string pattern: ^scn_[0-7][0-9A-HJKMNP-TV-Z]{25}$ screened_at: type: string format: date-time created_at: type: string format: date-time updated_at: type: string format: date-time spend: type: object additionalProperties: false required: - total_minor - by_implementation properties: total_minor: type: integer minimum: 0 maximum: 100000000000 description: The total, in US cents. by_implementation: type: array maxItems: 100 items: type: object additionalProperties: false required: - implementation - role - spend_minor properties: implementation: type: string pattern: ^[a-z][a-z0-9_]{0,31}$ description: >- The resolver, collector or analyser that produced a record, by its catalogue name. role: enum: - resolver - collector - analyser spend_minor: type: integer minimum: 0 maximum: 100000000000 description: What one implementation cost. description: What the latest screening of the person cost. description: A person and where their screening and review stand. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: PersonDecided: description: The person with the decision recorded. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/Person' InvalidGroupRequest: description: >- The body or query is invalid, or Idempotency-Key is missing, repeated or malformed. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_idempotency_key Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized ControlForbidden: description: >- workspace_forbidden: an API key without the management scope, or any API key on a route other than the key, settings and list routes. role_forbidden: a console credential's acting user is an active member whose role does not grant the operation. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden - role_forbidden WorkspaceNotFound: description: >- No such workspace, member, invite, key or environment for the caller. A workspace the acting user is not an active member of answers this too, as do another workspace and the other environment to an API key, so no answer shows which workspaces exist. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found GroupConflict: description: >- The group or screening's state does not allow the change, a bound is reached, the Idempotency-Key was used for another body, the environment cannot screen yet, or the screening's estimate exceeds what the daily screening cap has left. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - group_conflict - group_limit_reached - idempotency_key_reused - screening_cap_exceeded - screening_unavailable UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.