curl --request POST \
--url 'https://api.noresponse.org/v1/integrations' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"platform": "auth0"
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.integrations.create({
platform: "auth0",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.integrations.create(platform="auth0", signing_secret="wos_action_secret_k3Yx8pQ2mN7vR4tW")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Integrations.Create(ctx, components.IntegrationRequest{
Platform: components.IntegrationPlatformAuth0,
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.CreateIntegrationResponse;
import org.noresponse.models.shared.IntegrationPlatform;
import org.noresponse.models.shared.IntegrationRequest;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
IntegrationRequest req = IntegrationRequest.builder()
.platform(IntegrationPlatform.AUTH0)
.build();
CreateIntegrationResponse res = sdk.integrations().create()
.request(req)
.call();
if (res.integration().isPresent()) {
System.out.println(res.integration().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
IntegrationRequest req = new IntegrationRequest() {
Platform = IntegrationPlatform.Auth0,
};
var res = await sdk.Integrations.CreateAsync(req);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$request = new Shared\IntegrationRequest(
platform: Shared\IntegrationPlatform::Auth0,
);
$response = $sdk->integrations->create(
request: $request
);
if ($response->integration !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
req = Models::Shared::IntegrationRequest.new(
platform: Models::Shared::IntegrationPlatform::AUTH0
)
res = s.integrations.create(request: req)
unless res.nil?
# handle response
end
Register an integration
Registers a WorkOS or Auth0 integration and returns its hosted endpoint in url, so you can gate sign-ups and sign-ins with no server of your own.
- WorkOS: send the Actions signing secret from the WorkOS dashboard as
signing_secret, then point the user registration and authentication Actions aturl. - Auth0: send no secret. The answer’s
secretis the shared secret for the NoResponse Auth0 Action, shown once: store it as an Action secret.
hook_points defaults to both pre_registration and post_login. An event you leave out is allowed without an assessment. The hosted endpoint scores each WorkOS or Auth0 sign-up and sign-in, waits up to 2.5 seconds (WorkOS) or 4.5 seconds (Auth0) for the full assessment, and denies only when the account’s decision is block. Every failure on the NoResponse side answers allow.
Requires the integrations scope. You can hold 10 integrations. Registration is not idempotent: a retry after a lost answer registers another one.
curl --request POST \
--url 'https://api.noresponse.org/v1/integrations' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"platform": "auth0"
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.integrations.create({
platform: "auth0",
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.integrations.create(platform="auth0", signing_secret="wos_action_secret_k3Yx8pQ2mN7vR4tW")
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v5"
"github.com/noresponsehq/go/v5/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Integrations.Create(ctx, components.IntegrationRequest{
Platform: components.IntegrationPlatformAuth0,
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.CreateIntegrationResponse;
import org.noresponse.models.shared.IntegrationPlatform;
import org.noresponse.models.shared.IntegrationRequest;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
IntegrationRequest req = IntegrationRequest.builder()
.platform(IntegrationPlatform.AUTH0)
.build();
CreateIntegrationResponse res = sdk.integrations().create()
.request(req)
.call();
if (res.integration().isPresent()) {
System.out.println(res.integration().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
IntegrationRequest req = new IntegrationRequest() {
Platform = IntegrationPlatform.Auth0,
};
var res = await sdk.Integrations.CreateAsync(req);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$request = new Shared\IntegrationRequest(
platform: Shared\IntegrationPlatform::Auth0,
);
$response = $sdk->integrations->create(
request: $request
);
if ($response->integration !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
req = Models::Shared::IntegrationRequest.new(
platform: Models::Shared::IntegrationPlatform::AUTH0
)
res = s.integrations.create(request: req)
unless res.nil?
# handle response
end
Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Body
POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.
The authentication provider that calls the endpoint.
workos, auth0 The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment.
1 - 2 elementspre_registration runs before the user exists; post_login runs after a successful sign-in.
pre_registration, post_login The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
16 - 256^[!-~]{16,256}$Response
The integration. For Auth0, secret is shown here once only.
A hosted provider integration. Point the provider at url: a WorkOS user registration or authentication Action, or the NoResponse Auth0 Action, which sends secret as a bearer token. The answer allows or denies the event: deny only when the assessment's risk.block is true, and allow on every failure, so a fault on the NoResponse side lets the user through. secret is present only in the answers of POST /v1/integrations and POST /v1/integrations/{integration_id}/rotate for an Auth0 integration, and is not returned again.
Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404.
^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$The authentication provider that calls the endpoint.
workos, auth0 Each hook point at most once.
1 - 2 elementspre_registration runs before the user exists; post_login runs after a successful sign-in.
pre_registration, post_login The hosted endpoint, https://api.noresponse.org/hooks/{integration_id} in production.
256^https://[A-Za-z0-9.-]+(?::[0-9]{1,5})?/hooks/int_[0-7][0-9A-HJKMNP-TV-Z]{25}$Auth0 only, and only when it is created or rotated: the shared secret the Auth0 Action sends as Authorization: Bearer . nri_ and 43 unpadded base64url characters (32 random bytes). Store it as an Auth0 Action secret.
^nri_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$When the secret was last rotated; absent until the first rotation.
After a rotation, when the replaced secret stops being accepted; absent when no replaced secret is still accepted.