curl --request POST \
--url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/keys' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"environment": "live",
"scopes": [
"assess"
]
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.keys.create({
workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: {
environment: "live",
scopes: [
"assess",
],
},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.keys.create(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="live", scopes=[
"assess",
])
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v7"
"github.com/noresponsehq/go/v7/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Keys.Create(ctx, "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", components.KeyRequest{
Environment: components.KeyEnvironmentLive,
Scopes: []components.KeyRequestScope{
components.KeyRequestScopeAssess,
},
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import java.util.List;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.CreateKeyResponse;
import org.noresponse.models.shared.KeyEnvironment;
import org.noresponse.models.shared.KeyRequest;
import org.noresponse.models.shared.KeyRequestScope;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
CreateKeyResponse res = sdk.keys().create()
.workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
.body(KeyRequest.builder()
.environment(KeyEnvironment.LIVE)
.scopes(List.of(
KeyRequestScope.ASSESS))
.build())
.call();
if (res.key().isPresent()) {
System.out.println(res.key().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
using System.Collections.Generic;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Keys.CreateAsync(
workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: new KeyRequest() {
Environment = KeyEnvironment.Live,
Scopes = new List<KeyRequestScope>() {
KeyRequestScope.Assess,
},
}
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\KeyRequest(
environment: Shared\KeyEnvironment::Live,
scopes: [
Shared\KeyRequestScope::Assess,
],
);
$response = $sdk->keys->create(
workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM',
body: $body
);
if ($response->key !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.keys.create(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::KeyRequest.new(
environment: Models::Shared::KeyEnvironment::LIVE,
scopes: [
Models::Shared::KeyRequestScope::ASSESS,
]
))
unless res.nil?
# handle response
end
{
"id": "01JA2ZE4K5M6N7P8Q9R0S1T2V3",
"workspace_id": "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"environment": "live",
"prefix": "nrk_live_01JA2ZE4K5M6N7P8Q9R0S1T2V3",
"scopes": [
"assess"
],
"status": "active",
"created_at": "2026-10-23T09:00:00.000Z",
"created_by": "user_2abc",
"key": "nrk_live_01JA2ZE4K5M6N7P8Q9R0S1T2V3_N0tARealSecretJustTheShapeOfOneAAAAAAAAAAAA"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 403,
"detail": "<string>",
"code": "workspace_forbidden",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 409,
"detail": "<string>",
"code": "key_limit_reached",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Create an API key
Creates an API key in the signing key’s environment and returns its secret once in key: store it now. workspace_id is your workspace’s id, as every key lists it.
The new key can hold only scopes the signing key holds, management included (403 workspace_forbidden otherwise), and created_by is the signing key’s prefix. An environment holds at most 100 keys that authenticate (409 key_limit_reached). Requires the management scope, and acts only in the signing key’s own workspace and environment: another workspace and the other environment answer 404.
Not idempotent: a retry after a lost answer creates a second key, which you can list and revoke.
curl --request POST \
--url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/keys' \
--header "Authorization: Bearer $NORESPONSE_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"environment": "live",
"scopes": [
"assess"
]
}'
import { NoResponse } from "@noresponse/node";
const noResponse = new NoResponse({
apiKey: process.env["NORESPONSE_API_KEY"] ?? "",
});
async function run() {
const result = await noResponse.keys.create({
workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: {
environment: "live",
scopes: [
"assess",
],
},
});
console.log(result);
}
run();
from noresponse import NoResponse
import os
with NoResponse(
api_key=os.getenv("NORESPONSE_API_KEY", ""),
) as no_response:
res = no_response.keys.create(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="live", scopes=[
"assess",
])
# Handle response
print(res)
package main
import(
"context"
"os"
noresponse "github.com/noresponsehq/go/v7"
"github.com/noresponsehq/go/v7/models/components"
"log"
)
func main() {
ctx := context.Background()
s := noresponse.New(
noresponse.WithSecurity(os.Getenv("NORESPONSE_API_KEY")),
)
res, err := s.Keys.Create(ctx, "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", components.KeyRequest{
Environment: components.KeyEnvironmentLive,
Scopes: []components.KeyRequestScope{
components.KeyRequestScopeAssess,
},
})
if err != nil {
log.Fatal(err)
}
if res != nil {
// handle response
}
}
package hello.world;
import java.lang.Exception;
import java.util.List;
import org.noresponse.NoResponse;
import org.noresponse.models.errors.AuthenticationException;
import org.noresponse.models.errors.BadRequestException;
import org.noresponse.models.errors.ConflictException;
import org.noresponse.models.errors.NotFoundException;
import org.noresponse.models.errors.PermissionDeniedException;
import org.noresponse.models.errors.RateLimitException;
import org.noresponse.models.operations.CreateKeyResponse;
import org.noresponse.models.shared.KeyEnvironment;
import org.noresponse.models.shared.KeyRequest;
import org.noresponse.models.shared.KeyRequestScope;
public class Application {
public static void main(String[] args) throws Exception {
NoResponse sdk = NoResponse.builder()
.apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", ""))
.build();
CreateKeyResponse res = sdk.keys().create()
.workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM")
.body(KeyRequest.builder()
.environment(KeyEnvironment.LIVE)
.scopes(List.of(
KeyRequestScope.ASSESS))
.build())
.call();
if (res.key().isPresent()) {
System.out.println(res.key().get());
}
}
}
using NoResponse;
using NoResponse.Models.Shared;
using System;
using System.Collections.Generic;
var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY"));
var res = await sdk.Keys.CreateAsync(
workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
body: new KeyRequest() {
Environment = KeyEnvironment.Live,
Scopes = new List<KeyRequestScope>() {
KeyRequestScope.Assess,
},
}
);
// handle response
<?php
declare(strict_types=1);
require 'vendor/autoload.php';
use NoResponse;
use NoResponse\Models\Shared;
$sdk = NoResponse\NoResponseClient::builder()
->setSecurity(
getenv('NORESPONSE_API_KEY') ?: ''
)
->build();
$body = new Shared\KeyRequest(
environment: Shared\KeyEnvironment::Live,
scopes: [
Shared\KeyRequestScope::Assess,
],
);
$response = $sdk->keys->create(
workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM',
body: $body
);
if ($response->key !== null) {
// handle response
}
require 'noresponse'
Models = ::NoResponse::Models
s = ::NoResponse::NoResponseClient.new(
api_key: ENV.fetch('NORESPONSE_API_KEY', '')
)
res = s.keys.create(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', body: Models::Shared::KeyRequest.new(
environment: Models::Shared::KeyEnvironment::LIVE,
scopes: [
Models::Shared::KeyRequestScope::ASSESS,
]
))
unless res.nil?
# handle response
end
{
"id": "01JA2ZE4K5M6N7P8Q9R0S1T2V3",
"workspace_id": "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM",
"environment": "live",
"prefix": "nrk_live_01JA2ZE4K5M6N7P8Q9R0S1T2V3",
"scopes": [
"assess"
],
"status": "active",
"created_at": "2026-10-23T09:00:00.000Z",
"created_by": "user_2abc",
"key": "nrk_live_01JA2ZE4K5M6N7P8Q9R0S1T2V3_N0tARealSecretJustTheShapeOfOneAAAAAAAAAAAA"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "invalid_request",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "unauthorized",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 403,
"detail": "<string>",
"code": "workspace_forbidden",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "not_found",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 409,
"detail": "<string>",
"code": "key_limit_reached",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 413,
"detail": "<string>",
"code": "payload_too_large",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 415,
"detail": "<string>",
"code": "unsupported_media_type",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "service_unavailable",
"request_id": "<string>",
"instance": "<string>",
"invalid_params": [
{
"field": "<string>",
"reason": "<string>",
"example": "<string>"
}
]
}Authorizations
Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. A key sees only its own environment's data.
Each key has one or more scopes: assess creates and reads assessments, records outcomes and reports key usage; history reads assessments, an account's current risk, the accounts whose risk changed and an account's history, records enforcements and erases an account; detailed adds the detailed view; webhooks registers, tests, rotates and deletes webhook endpoints; integrations registers and manages hosted provider integrations; management creates, lists and revokes the keys of its own environment and reads and changes that environment's settings. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403.
Path Parameters
The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.
^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$Body
POST /v1/workspaces/{workspace_id}/keys body. Creates an API key in one environment of the workspace with the scopes named, and returns its secret once. A live key needs the admin or owner role; a test key needs developer or above. An API key with the management scope creates keys in its own environment with scopes it holds itself. Each scope may appear once.
The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator.
live, test The key's scopes, each at most once.
1 - 7 elementsassess, history, delete, webhooks, detailed, integrations, management Response
The key and its secret, shown here once only.
One API key of a workspace, as the console shows it. A key belongs to exactly one environment. Every other field is safe to show.
The key's public id, a 26-character ULID.
^[0-7][0-9A-HJKMNP-TV-Z]{25}$The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.
^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator.
live, test The public start of the credential, nrk__, which identifies the key in logs and secret stores without its secret.
^nrk_(live|test)_[0-7][0-9A-HJKMNP-TV-Z]{25}$The key's scopes, each at most once.
1 - 7 elementsassess, history, delete, webhooks, detailed, integrations, management active: the key authenticates. expired: a rotation's overlap window has ended (expires_at). revoked: the key was revoked (revoked_at) and answers 401.
active, expired, revoked The external user id of the member who created the key through the console, or the prefix (nrk__) of the management key that created it. Absent for a key NoResponse issued or a rotation made.
1 - 256^[!-~]{1,256}$When a rotated key stops authenticating (POST /v1/keys/rotate). Absent for a key with no end.
The external user id of the member who revoked the key through the console, or the prefix of the management key that revoked it. Absent when the key is not revoked or NoResponse revoked it.
1 - 256^[!-~]{1,256}$The credential, nrk_. Present only in the 201 answer that created the key.
^nrk_(live|test)_[0-7][0-9A-HJKMNP-TV-Z]{25}_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$