> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Register an integration > Registers a WorkOS or Auth0 integration and returns its hosted endpoint in `url`, so you can gate sign-ups and sign-ins with no server of your own. - **WorkOS**: send the Actions signing secret from the WorkOS dashboard as `signing_secret`, then point the user registration and authentication Actions at `url`. - **Auth0**: send no secret. The answer's `secret` is the shared secret for the NoResponse Auth0 Action, shown once: store it as an Action secret. `hook_points` defaults to both `pre_registration` and `post_login`. An event you leave out is allowed without an assessment. The hosted endpoint scores each WorkOS or Auth0 sign-up and sign-in, waits up to 2.5 seconds (WorkOS) or 4.5 seconds (Auth0) for the full assessment, and denies only when the account's decision is `block`. Every failure on the NoResponse side answers allow. Requires the `integrations` scope. You can hold 10 integrations. Registration is not idempotent: a retry after a lost answer registers another one. ## OpenAPI ````yaml /openapi.json post /v1/integrations openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses a signup, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys your signup gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: Rotate your own API key. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/integrations: post: tags: - integrations summary: Register an integration description: >- Registers a WorkOS or Auth0 integration and returns its hosted endpoint in `url`, so you can gate sign-ups and sign-ins with no server of your own. - **WorkOS**: send the Actions signing secret from the WorkOS dashboard as `signing_secret`, then point the user registration and authentication Actions at `url`. - **Auth0**: send no secret. The answer's `secret` is the shared secret for the NoResponse Auth0 Action, shown once: store it as an Action secret. `hook_points` defaults to both `pre_registration` and `post_login`. An event you leave out is allowed without an assessment. The hosted endpoint scores each WorkOS or Auth0 sign-up and sign-in, waits up to 2.5 seconds (WorkOS) or 4.5 seconds (Auth0) for the full assessment, and denies only when the account's decision is `block`. Every failure on the NoResponse side answers allow. Requires the `integrations` scope. You can hold 10 integrations. Registration is not idempotent: a retry after a lost answer registers another one. operationId: createIntegration requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/IntegrationRequest' examples: auth0: value: platform: auth0 workos: value: platform: workos hook_points: - pre_registration - post_login signing_secret: wos_action_secret_k3Yx8pQ2mN7vR4tW responses: '201': $ref: '#/components/responses/IntegrationCreated' '400': $ref: '#/components/responses/InvalidIntegration' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/WorkspaceForbidden' '409': $ref: '#/components/responses/TooManyIntegrations' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '429': $ref: '#/components/responses/RateLimited' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/integrations' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "platform": "auth0" }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.integrations.create({ platform: "auth0", }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.integrations.create(platform="auth0", signing_secret="wos_action_secret_k3Yx8pQ2mN7vR4tW") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v5\"\n\t\"github.com/noresponsehq/go/v5/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Integrations.Create(ctx, components.IntegrationRequest{\n Platform: components.IntegrationPlatformAuth0,\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.CreateIntegrationResponse; import org.noresponse.models.shared.IntegrationPlatform; import org.noresponse.models.shared.IntegrationRequest; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); IntegrationRequest req = IntegrationRequest.builder() .platform(IntegrationPlatform.AUTH0) .build(); CreateIntegrationResponse res = sdk.integrations().create() .request(req) .call(); if (res.integration().isPresent()) { System.out.println(res.integration().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); IntegrationRequest req = new IntegrationRequest() { Platform = IntegrationPlatform.Auth0, }; var res = await sdk.Integrations.CreateAsync(req); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $request = new Shared\IntegrationRequest( platform: Shared\IntegrationPlatform::Auth0, ); $response = $sdk->integrations->create( request: $request ); if ($response->integration !== null) { // handle response } - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) req = Models::Shared::IntegrationRequest.new( platform: Models::Shared::IntegrationPlatform::AUTH0 ) res = s.integrations.create(request: req) unless res.nil? # handle response end components: schemas: IntegrationRequest: title: Integration registration request description: >- POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once. type: object additionalProperties: false required: - platform properties: platform: enum: - workos - auth0 description: The authentication provider that calls the endpoint. hook_points: type: array minItems: 1 maxItems: 2 uniqueItems: true items: enum: - pre_registration - post_login description: >- pre_registration runs before the user exists; post_login runs after a successful sign-in. description: >- The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment. signing_secret: type: string minLength: 16 maxLength: 256 pattern: ^[!-~]{16,256}$ description: >- The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned. allOf: - if: required: - platform properties: platform: const: workos then: required: - signing_secret - if: required: - platform properties: platform: const: auth0 then: not: required: - signing_secret $defs: integration_platform: enum: - workos - auth0 description: The authentication provider that calls the endpoint. integration_hook_point: enum: - pre_registration - post_login description: >- pre_registration runs before the user exists; post_login runs after a successful sign-in. integration_hook_points: type: array minItems: 1 maxItems: 2 uniqueItems: true items: enum: - pre_registration - post_login description: >- pre_registration runs before the user exists; post_login runs after a successful sign-in. description: Each hook point at most once. integration_signing_secret: type: string minLength: 16 maxLength: 256 pattern: ^[!-~]{16,256}$ description: >- The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned. Integration: title: Integration description: >- A hosted provider integration. Point the provider at url: a WorkOS user registration or authentication Action, or the NoResponse Auth0 Action, which sends secret as a bearer token. The answer allows or denies the event: deny only when the assessment's risk.block is true, and allow on every failure, so a fault on the NoResponse side lets the user through. secret is present only in the answers of POST /v1/integrations and POST /v1/integrations/{integration_id}/rotate for an Auth0 integration, and is not returned again. type: object additionalProperties: false required: - integration_id - platform - hook_points - url - created_at properties: integration_id: type: string pattern: ^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404. platform: enum: - workos - auth0 description: The authentication provider that calls the endpoint. hook_points: type: array minItems: 1 maxItems: 2 uniqueItems: true items: enum: - pre_registration - post_login description: >- pre_registration runs before the user exists; post_login runs after a successful sign-in. description: Each hook point at most once. url: type: string maxLength: 256 pattern: >- ^https://[A-Za-z0-9.-]+(?::[0-9]{1,5})?/hooks/int_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The hosted endpoint, https://api.noresponse.org/hooks/{integration_id} in production. secret: type: string pattern: ^nri_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$ description: >- Auth0 only, and only when it is created or rotated: the shared secret the Auth0 Action sends as Authorization: Bearer . nri_ and 43 unpadded base64url characters (32 random bytes). Store it as an Auth0 Action secret. created_at: type: string format: date-time rotated_at: type: string format: date-time description: When the secret was last rotated; absent until the first rotation. previous_secret_expires_at: type: string format: date-time description: >- After a rotation, when the replaced secret stops being accepted; absent when no replaced secret is still accepted. $defs: integration_id: type: string pattern: ^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: IntegrationCreated: description: The integration. For Auth0, secret is shown here once only. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/Integration' examples: auth0: value: integration_id: int_01JA2Z8K6Q4V7W9XBCDEFGHJKM platform: auth0 hook_points: - pre_registration - post_login url: >- https://api.noresponse.org/hooks/int_01JA2Z8K6Q4V7W9XBCDEFGHJKM secret: nri_k3Yx8pQ2mN7vR4tW6zB9cD1eF5gH0jL4sP9uV2wX7yA created_at: '2026-10-14T09:00:00.000Z' workos: value: integration_id: int_01JA2Z9M3R5T8W1YBCDEFGHJKN platform: workos hook_points: - pre_registration - post_login url: >- https://api.noresponse.org/hooks/int_01JA2Z9M3R5T8W1YBCDEFGHJKN created_at: '2026-10-14T09:05:00.000Z' InvalidIntegration: description: >- The body is not JSON or does not match its schema (an unknown member such as tenant_id, an unknown platform or hook point, a hook point listed twice, a WorkOS integration without signing_secret or an Auth0 integration with one, or a rotation whose signing_secret does not fit the integration's platform). invalid_params names the offending fields, never their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized WorkspaceForbidden: description: >- The API key is valid but may not use this operation: it lacks the operation's scope, or its workspace is not entitled or is suspended. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden examples: missingScope: value: type: https://docs.noresponse.org/problems/workspace-forbidden title: Forbidden status: 403 detail: The API key does not carry a scope this operation accepts. code: workspace_forbidden request_id: 0123456789abcdef0123456789abcdef TooManyIntegrations: description: The workspace already holds 10 integrations. Delete one first. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - too_many_integrations examples: limit: value: type: https://docs.noresponse.org/problems/too-many-integrations title: Too many integrations status: 409 detail: The tenant already holds 10 integrations; delete one first. code: too_many_integrations request_id: 0123456789abcdef0123456789abcdef PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type RateLimited: description: >- The workspace's rate or concurrency limit is exhausted. Retry-After says when to retry; the provider applies its own fallback meanwhile. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - rate_limited examples: limited: value: type: https://docs.noresponse.org/problems/rate-limited title: Rate limited status: 429 detail: >- The tenant's assessment rate is exhausted; retry after the Retry-After interval. code: rate_limited request_id: 0123456789abcdef0123456789abcdef ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk and an account's history, and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.