Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.

Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk and an account's history, and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.

Path Parameters

integration_id
string
required

Path segment, matched case-sensitively. A value that does not match the integration_id shape, or another workspace's id, answers 404. Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404.

Pattern: ^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$

Body

application/json

POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS integration send the new signing_secret after regenerating it in the WorkOS dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.

signing_secret
string

The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.

Required string length: 16 - 256
Pattern: ^[!-~]{16,256}$

Response

The integration with its new secret. For Auth0, secret is the new shared secret, shown once. previous_secret_expires_at says until when the replaced secret is still accepted.

A hosted provider integration. Point the provider at url: a WorkOS user registration or authentication Action, or the NoResponse Auth0 Action, which sends secret as a bearer token. The answer allows or denies the event: deny only when the assessment's risk.block is true, and allow on every failure, so a fault on the NoResponse side lets the user through. secret is present only in the answers of POST /v1/integrations and POST /v1/integrations/{integration_id}/rotate for an Auth0 integration, and is not returned again.

integration_id
string
required

Opaque, server-assigned integration id: int_ and a 26-character Crockford base32 ULID. Another workspace's integration id answers 404.

Pattern: ^int_[0-7][0-9A-HJKMNP-TV-Z]{25}$
platform
enum<string>
required

The authentication provider that calls the endpoint.

Available options:
workos,
auth0
hook_points
enum<string>[]
required

Each hook point at most once.

Required array length: 1 - 2 elements

pre_registration runs before the user exists; post_login runs after a successful sign-in.

Available options:
pre_registration,
post_login
url
string
required

The hosted endpoint, https://api.noresponse.org/hooks/{integration_id} in production.

Maximum string length: 256
Pattern: ^https://[A-Za-z0-9.-]+(?::[0-9]{1,5})?/hooks/int_[0-7][0-9A-HJKMNP-TV-Z]{25}$
created_at
string<date-time>
required
secret
string

Auth0 only, and only when it is created or rotated: the shared secret the Auth0 Action sends as Authorization: Bearer . nri_ and 43 unpadded base64url characters (32 random bytes). Store it as an Auth0 Action secret.

Pattern: ^nri_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$
rotated_at
string<date-time>

When the secret was last rotated; absent until the first rotation.

previous_secret_expires_at
string<date-time>

After a rotation, when the replaced secret stops being accepted; absent when no replaced secret is still accepted.