> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Add a list entry > Adds an exact email (`kind: email`) or an email domain (`kind: email_domain`) with the action `block` or `allow`, and answers the entry with its value in canonical form. An account matches when one of its assessments sent the email, or an email of the domain. A `block` entry decides `block` for every flow and an `allow` entry decides `allow`. When both match, `block` wins. The account's risk carries `list_match` with the entry's id, and its score does not change. NoResponse propagates the change through retained accounts and sends `account.risk_changed` when a decision changes. A value already on the list answers 409 `list_entry_exists`. A full list answers 409 `list_limit_reached`. For an atomic batch with progress tracking, use the bulk list route. Requires `settings` and `policy_publish` together, or `management`, within the key's own workspace and environment. ## OpenAPI ````yaml /openapi.json post /v1/workspaces/{workspace_id}/lists/{environment} openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/workspaces/{workspace_id}/lists/{environment}: post: tags: - lists summary: Add a list entry description: >- Adds an exact email (`kind: email`) or an email domain (`kind: email_domain`) with the action `block` or `allow`, and answers the entry with its value in canonical form. An account matches when one of its assessments sent the email, or an email of the domain. A `block` entry decides `block` for every flow and an `allow` entry decides `allow`. When both match, `block` wins. The account's risk carries `list_match` with the entry's id, and its score does not change. NoResponse propagates the change through retained accounts and sends `account.risk_changed` when a decision changes. A value already on the list answers 409 `list_entry_exists`. A full list answers 409 `list_limit_reached`. For an atomic batch with progress tracking, use the bulk list route. Requires `settings` and `policy_publish` together, or `management`, within the key's own workspace and environment. operationId: createListEntry parameters: - $ref: '#/components/parameters/WorkspaceId' - $ref: '#/components/parameters/Environment' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ListEntryRequest' examples: default: value: kind: email_domain value: throwaway.example action: block note: Signup burst from one domain responses: '201': $ref: '#/components/responses/ListEntryCreated' '400': $ref: '#/components/responses/InvalidControlRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ControlForbidden' '404': $ref: '#/components/responses/WorkspaceNotFound' '409': $ref: '#/components/responses/ListEntryRefused' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request POST \ --url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/lists/live' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "kind": "email_domain", "value": "throwaway.example", "action": "block", "note": "Signup burst from one domain" }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.lists.create({ workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: "live", body: { kind: "email_domain", value: "throwaway.example", action: "block", note: "Signup burst from one domain", }, }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.lists.create(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="live", kind="email_domain", value="throwaway.example", action="block", note="Signup burst from one domain", expires_at="2026-01-01T00:00:00Z") # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Lists.Create(ctx, \"tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", components.KeyEnvironmentLive, components.ListEntryRequest{\n Kind: components.ListEntryKindEmailDomain,\n Value: \"throwaway.example\",\n Action: components.ListEntryActionBlock,\n Note: noresponse.Pointer(\"Signup burst from one domain\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.CreateListEntryResponse; import org.noresponse.models.shared.KeyEnvironment; import org.noresponse.models.shared.ListEntryAction; import org.noresponse.models.shared.ListEntryKind; import org.noresponse.models.shared.ListEntryRequest; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); CreateListEntryResponse res = sdk.lists().create() .workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .environment(KeyEnvironment.LIVE) .body(ListEntryRequest.builder() .kind(ListEntryKind.EMAIL_DOMAIN) .value("throwaway.example") .action(ListEntryAction.BLOCK) .note("Signup burst from one domain") .build()) .call(); if (res.listEntry().isPresent()) { System.out.println(res.listEntry().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Lists.CreateAsync( workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: KeyEnvironment.Live, body: new ListEntryRequest() { Kind = ListEntryKind.EmailDomain, Value = "throwaway.example", Action = ListEntryAction.Block, Note = "Signup burst from one domain", } ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $body = new Shared\ListEntryRequest( kind: Shared\ListEntryKind::EmailDomain, value: 'throwaway.example', action: Shared\ListEntryAction::Block, note: 'Signup burst from one domain', ); $response = $sdk->lists->create( workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Shared\KeyEnvironment::Live, body: $body ); $result = $response->result; // handle response - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.lists.create(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Models::Shared::KeyEnvironment::LIVE, body: Models::Shared::ListEntryRequest.new( kind: Models::Shared::ListEntryKind::EMAIL_DOMAIN, value: 'throwaway.example', action: Models::Shared::ListEntryAction::BLOCK, note: 'Signup burst from one domain' )) unless res.nil? # handle response end components: parameters: WorkspaceId: name: workspace_id in: path required: true schema: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. description: >- The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. Environment: name: environment in: path required: true schema: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. description: >- The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404. schemas: ListEntryRequest: title: List entry request description: >- POST /v1/workspaces/{workspace_id}/lists/{environment} body. Adds one entry to the environment's list and, in the same change, re-decides every account it matches: each sends account.risk_changed when a decision changes. Needs the admin or owner role, or a management key of the environment. type: object additionalProperties: false required: - kind - value - action properties: kind: enum: - email - email_domain description: >- email matches one address, whatever the case of its local part. email_domain matches every address of the registrable domain and of its subdomains. value: type: string minLength: 3 maxLength: 254 pattern: ^[^\s\x00-\x1f\x7f]+$ description: >- An email address for kind email, written as in an assessment request; an LDH domain (A-label for an internationalised one) such as example.com for kind email_domain, which must sit below a public suffix (co.uk alone is refused with 400). NoResponse stores it in canonical form and answers that form. action: enum: - block - allow description: >- block decides block for the accounts the entry matches; allow decides allow. Block wins when both match. note: type: string maxLength: 200 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Why the entry exists, for the people who manage the list. It is shown with the entry and decides nothing. expires_at: type: string format: date-time description: >- Optional expiry. An expired entry stops matching immediately; bounded maintenance removes it and propagates account risk changes. allOf: - if: required: - kind properties: kind: const: email then: properties: value: pattern: "^[^\\s@<>\\x00-\\x1f\\x7f-\\x9f­؜᠎​-‏‪-‮⁠-⁤⁦-\uFEFF-]{1,64}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z]{2,63}$" - if: required: - kind properties: kind: const: email_domain then: properties: value: maxLength: 253 pattern: >- ^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$ ListEntry: title: List entry description: >- One entry of an environment's list: an exact email or an email domain that decides an account whatever its score. An account matches when one of its admitted assessments sent the email, or an email of the domain. A block entry decides block for every flow and an allow entry decides allow; when both match, block wins. The account's risk carries the list_match reason with the entry's id, and its score stays the one the assessment's facts give. A held flow still waits for its investigation. type: object additionalProperties: false required: - id - workspace_id - environment - kind - value - action - created_at - created_by properties: id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: 'The entry''s id: lst_ and a ULID.' workspace_id: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. environment: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. kind: enum: - email - email_domain description: >- email matches one address, whatever the case of its local part. email_domain matches every address of the registrable domain and of its subdomains. value: type: string minLength: 3 maxLength: 254 pattern: ^[^\s\x00-\x1f\x7f]+$ description: >- The value the entry matches, in canonical form: an email lower-cased whole, or a domain lower-cased and taken to its registrable domain (mail.example.co.uk is stored as example.co.uk). action: enum: - block - allow description: >- block decides block for the accounts the entry matches; allow decides allow. Block wins when both match. note: type: string maxLength: 200 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Why the entry exists, for the people who manage the list. It is shown with the entry and decides nothing. created_at: type: string format: date-time created_by: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]{1,256}$ description: >- The external user id of the member who added the entry through the console, or the prefix (nrk__) of the management key that added it. expires_at: type: string format: date-time description: >- Optional expiry. An expired entry stops matching immediately; bounded maintenance removes it and propagates account risk changes. $defs: list_entry_id: type: string pattern: ^lst_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: 'The entry''s id: lst_ and a ULID.' list_entry_kind: enum: - email - email_domain description: >- email matches one address, whatever the case of its local part. email_domain matches every address of the registrable domain and of its subdomains. list_entry_action: enum: - block - allow description: >- block decides block for the accounts the entry matches; allow decides allow. Block wins when both match. list_entry_note: type: string maxLength: 200 pattern: ^[^\x00-\x1f\x7f]*$ description: >- Why the entry exists, for the people who manage the list. It is shown with the entry and decides nothing. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: ListEntryCreated: description: >- The entry, added, with its value in canonical form. Every account it matches was re-decided in the same change. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/ListEntry' examples: default: value: id: lst_01JA2ZE4K5M6N7P8Q9R0S1T2V3 workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM environment: live kind: email_domain value: throwaway.example action: block note: Signup burst from one domain created_at: '2026-10-23T09:00:00.000Z' created_by: user_2abc InvalidControlRequest: description: >- The body breaks its schema, or a console credential named no valid NR-Acting-User. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized ControlForbidden: description: >- workspace_forbidden: an API key without the management scope, or any API key on a route other than the key, settings and list routes. role_forbidden: a console credential's acting user is an active member whose role does not grant the operation. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden - role_forbidden WorkspaceNotFound: description: >- No such workspace, member, invite, key or environment for the caller. A workspace the acting user is not an active member of answers this too, as do another workspace and the other environment to an API key, so no answer shows which workspaces exist. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found ListEntryRefused: description: >- list_entry_exists: the value is already on the environment's list; delete its entry first to change its action. list_limit_reached: the environment already holds 10,000 entries. list_entry_too_broad: the entry matches more than 5,000 accounts. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 409 code: enum: - list_entry_exists - list_limit_reached - list_entry_too_broad PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.