Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.

Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.

Body

application/json

POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.

platform
enum<string>
required

The authentication provider that calls the endpoint.

Available options:
workos,
auth0
hook_points
enum<string>[]

The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment.

Required array length: 1 - 2 elements

pre_registration runs before the user exists; post_login runs after a successful sign-in.

Available options:
pre_registration,
post_login
signing_secret
string

The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.

Required string length: 16 - 256
Pattern: ^[!-~]{16,256}$

Response

The integration. For Auth0, secret is shown here once only.

A hosted provider integration. Point the provider at url: a WorkOS user registration or authentication Action, or the NoResponse Auth0 Action, which sends secret as a bearer token. The answer allows or denies the event: deny only when the assessment's risk.block is true, and allow on every failure, so a fault on the NoResponse side lets the user through. secret is present only in the answers of POST /v1/integrations and POST /v1/integrations/{integration_id}/rotate for an Auth0 integration, and is not returned again.

integration_id
string
required

Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404.

Pattern: ^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$
platform
enum<string>
required

The authentication provider that calls the endpoint.

Available options:
workos,
auth0
hook_points
enum<string>[]
required

Each hook point at most once.

Required array length: 1 - 2 elements

pre_registration runs before the user exists; post_login runs after a successful sign-in.

Available options:
pre_registration,
post_login
url
string
required

The hosted endpoint, https://api.noresponse.org/hooks/{integration_id} in production.

Maximum string length: 256
Pattern: ^https://[A-Za-z0-9.-]+(?::[0-9]{1,5})?/hooks/int_[0-7][0-9A-HJKMNP-TV-Z]{25}$
created_at
string<date-time>
required
secret
string

Auth0 only, and only when it is created or rotated: the shared secret the Auth0 Action sends as Authorization: Bearer . nri_ and 43 unpadded base64url characters (32 random bytes). Store it as an Auth0 Action secret.

Pattern: ^nri_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$
rotated_at
string<date-time>

When the secret was last rotated; absent until the first rotation.

previous_secret_expires_at
string<date-time>

After a rotation, when the replaced secret stops being accepted; absent when no replaced secret is still accepted.