> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Change your settings > Changes only what the body names, in one transaction: `retention_days`, `refused_sources`, and per flow `step_up`, `review`, `block` (`null` turns blocking off), `default_depth`, `admission`, `hold_seconds`, `on_expiry`, or `inherits_account_creation` to return `login` or `purchase` to `account_creation`'s thresholds. After the change each flow keeps 0 < `step_up` < `review` <= 100, and `block` off or `review` <= `block` <= 100; a change that breaks it answers 400 naming the flow. A policy change is one new `policy_version` with the signing key's prefix as `updated_by`, and every change is recorded in your workspace's audit log with the key as its actor. A change reaches assessments within a minute. Requires the `management` scope, and acts only in the signing key's own workspace and environment: another workspace and the other environment answer 404. ## OpenAPI ````yaml /openapi.json patch /v1/workspaces/{workspace_id}/settings/{environment} openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- With the `management` scope, read and change your environment's retention, decision thresholds, admission and refused sources. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. paths: /v1/workspaces/{workspace_id}/settings/{environment}: patch: tags: - settings summary: Change your settings description: >- Changes only what the body names, in one transaction: `retention_days`, `refused_sources`, and per flow `step_up`, `review`, `block` (`null` turns blocking off), `default_depth`, `admission`, `hold_seconds`, `on_expiry`, or `inherits_account_creation` to return `login` or `purchase` to `account_creation`'s thresholds. After the change each flow keeps 0 < `step_up` < `review` <= 100, and `block` off or `review` <= `block` <= 100; a change that breaks it answers 400 naming the flow. A policy change is one new `policy_version` with the signing key's prefix as `updated_by`, and every change is recorded in your workspace's audit log with the key as its actor. A change reaches assessments within a minute. Requires the `management` scope, and acts only in the signing key's own workspace and environment: another workspace and the other environment answer 404. operationId: updateSettings parameters: - $ref: '#/components/parameters/WorkspaceId' - $ref: '#/components/parameters/Environment' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SettingsRequest' examples: flows: value: retention_days: 90 flows: login: step_up: 30 review: 60 block: null default_depth: full purchase: inherits_account_creation: true account_creation: admission: held hold_seconds: 600 on_expiry: review refused_sources: - phone signup: value: flows: account_creation: block: 95 responses: '200': $ref: '#/components/responses/SettingsUpdated' '400': $ref: '#/components/responses/InvalidControlRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ControlForbidden' '404': $ref: '#/components/responses/WorkspaceNotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '415': $ref: '#/components/responses/UnsupportedMediaType' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request PATCH \ --url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/settings/live' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" \ --header 'Content-Type: application/json' \ --data '{ "retention_days": 90, "refused_sources": [ "phone" ], "flows": { "account_creation": { "admission": "held", "hold_seconds": 600, "on_expiry": "review" }, "login": { "step_up": 30, "review": 60, "block": null, "default_depth": "full" }, "purchase": { "inherits_account_creation": true } } }' - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.settings.update({ workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: "live", body: { retentionDays: 90, refusedSources: [ "phone", ], flows: { accountCreation: { admission: "held", holdSeconds: 600, onExpiry: "review", }, login: { stepUp: 30, review: 60, block: null, defaultDepth: "full", }, purchase: { inheritsAccountCreation: true, }, }, }, }); console.log(result); } run(); - lang: python label: Python source: | from noresponse import NoResponse, models import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.settings.update(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment="live", retention_days=90, refused_sources=[ "phone", ], flows=models.shared.SettingsRequestFlows( account_creation=models.shared.FlowChange( admission="held", hold_seconds=600, on_expiry="review", ), login=models.shared.FlowChange( step_up=30, review=60, block=None, default_depth="full", ), purchase=models.shared.FlowChange( inherits_account_creation=True, ), )) # Handle response print(res) - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v7\"\n\t\"github.com/noresponsehq/go/v7/models/components\"\n\t\"github.com/noresponsehq/go/v7/optionalnullable\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Settings.Update(ctx, \"tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM\", components.KeyEnvironmentLive, components.SettingsRequest{\n RetentionDays: noresponse.Pointer[int64](90),\n RefusedSources: []components.SourceID{\n components.SourceIDPhone,\n },\n Flows: &components.SettingsRequestFlows{\n AccountCreation: &components.FlowChange{\n Admission: components.AdmissionHeld.ToPointer(),\n HoldSeconds: noresponse.Pointer[int64](600),\n OnExpiry: components.OnExpiryReview.ToPointer(),\n },\n Login: &components.FlowChange{\n StepUp: noresponse.Pointer[int64](30),\n Review: noresponse.Pointer[int64](60),\n Block: optionalnullable.From[int64](nil),\n DefaultDepth: components.DefaultDepthFull.ToPointer(),\n },\n Purchase: &components.FlowChange{\n InheritsAccountCreation: noresponse.Pointer(true),\n },\n },\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n // handle response\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import java.util.List; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.UpdateSettingsResponse; import org.noresponse.models.shared.Admission; import org.noresponse.models.shared.DefaultDepth; import org.noresponse.models.shared.FlowChange; import org.noresponse.models.shared.KeyEnvironment; import org.noresponse.models.shared.OnExpiry; import org.noresponse.models.shared.SettingsRequest; import org.noresponse.models.shared.SettingsRequestFlows; import org.noresponse.models.shared.SourceId; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); UpdateSettingsResponse res = sdk.settings().update() .workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .environment(KeyEnvironment.LIVE) .body(SettingsRequest.builder() .retentionDays(90L) .refusedSources(List.of( SourceId.PHONE)) .flows(SettingsRequestFlows.builder() .accountCreation(FlowChange.builder() .admission(Admission.HELD) .holdSeconds(600L) .onExpiry(OnExpiry.REVIEW) .build()) .login(FlowChange.builder() .stepUp(30L) .review(60L) .block(null) .defaultDepth(DefaultDepth.FULL) .build()) .purchase(FlowChange.builder() .inheritsAccountCreation(true) .build()) .build()) .build()) .call(); if (res.settings().isPresent()) { System.out.println(res.settings().get()); } } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Shared; using System; using System.Collections.Generic; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); var res = await sdk.Settings.UpdateAsync( workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", environment: KeyEnvironment.Live, body: new SettingsRequest() { RetentionDays = 90, RefusedSources = new List() { SourceId.Phone, }, Flows = new SettingsRequestFlows() { AccountCreation = new FlowChange() { Admission = Admission.Held, HoldSeconds = 600, OnExpiry = OnExpiry.Review, }, Login = new FlowChange() { StepUp = 30, Review = 60, Block = null, DefaultDepth = DefaultDepth.Full, }, Purchase = new FlowChange() { InheritsAccountCreation = true, }, }, } ); // handle response - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $body = new Shared\SettingsRequest( retentionDays: 90, refusedSources: [ Shared\SourceId::Phone, ], flows: new Shared\SettingsRequestFlows( accountCreation: new Shared\FlowChange( admission: Shared\Admission::Held, holdSeconds: 600, onExpiry: Shared\OnExpiry::Review, ), login: new Shared\FlowChange( stepUp: 30, review: 60, block: null, defaultDepth: Shared\DefaultDepth::Full, ), purchase: new Shared\FlowChange( inheritsAccountCreation: true, ), ), ); $response = $sdk->settings->update( workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Shared\KeyEnvironment::Live, body: $body ); if ($response->settings !== null) { // handle response } - lang: ruby label: Ruby source: > require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) res = s.settings.update(workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', environment: Models::Shared::KeyEnvironment::LIVE, body: Models::Shared::SettingsRequest.new( retention_days: 90, refused_sources: [ Models::Shared::SourceId::PHONE, ], flows: Models::Shared::SettingsRequestFlows.new( account_creation: Models::Shared::FlowChange.new( admission: Models::Shared::Admission::HELD, hold_seconds: 600, on_expiry: Models::Shared::OnExpiry::REVIEW ), login: Models::Shared::FlowChange.new( step_up: 30, review: 60, block: nil, default_depth: Models::Shared::DefaultDepth::FULL ), purchase: Models::Shared::FlowChange.new( inherits_account_creation: true ) ) )) unless res.nil? # handle response end components: parameters: WorkspaceId: name: workspace_id in: path required: true schema: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. description: >- The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. Environment: name: environment in: path required: true schema: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. description: >- The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404. schemas: SettingsRequest: title: Environment settings change description: >- PATCH /v1/workspaces/{workspace_id}/settings/{environment} body. Changes only what it names, in one transaction; a policy change is one new policy_version. Needs the admin or owner role, or an API key with the management scope for its own environment. type: object additionalProperties: false minProperties: 1 properties: retention_days: type: integer minimum: 1 maximum: 365 refused_sources: type: array uniqueItems: true maxItems: 6 items: enum: - github - phone - breach - rdap - mx - ipintel description: >- A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers) or ipintel (IP intelligence). description: >- Replaces the refused sources; [] refuses none. A change applies to new assessments within a minute. flows: type: object additionalProperties: false minProperties: 1 properties: account_creation: allOf: - type: object additionalProperties: false minProperties: 1 description: >- A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100. properties: step_up: type: integer minimum: 1 maximum: 100 review: type: integer minimum: 1 maximum: 100 block: type: - integer - 'null' minimum: 1 maximum: 100 description: >- The score from which the decision is block; null turns blocking off. default_depth: enum: - quick - full inherits_account_creation: const: true description: >- Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. inherits_signup: const: true deprecated: true description: Alias of inherits_account_creation, still accepted. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. if: anyOf: - required: - inherits_account_creation - required: - inherits_signup then: not: anyOf: - required: - step_up - required: - review - required: - block - not: anyOf: - required: - inherits_account_creation - required: - inherits_signup login: type: object additionalProperties: false minProperties: 1 description: >- A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100. properties: step_up: type: integer minimum: 1 maximum: 100 review: type: integer minimum: 1 maximum: 100 block: type: - integer - 'null' minimum: 1 maximum: 100 description: >- The score from which the decision is block; null turns blocking off. default_depth: enum: - quick - full inherits_account_creation: const: true description: >- Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. inherits_signup: const: true deprecated: true description: Alias of inherits_account_creation, still accepted. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. if: anyOf: - required: - inherits_account_creation - required: - inherits_signup then: not: anyOf: - required: - step_up - required: - review - required: - block purchase: type: object additionalProperties: false minProperties: 1 description: >- A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100. properties: step_up: type: integer minimum: 1 maximum: 100 review: type: integer minimum: 1 maximum: 100 block: type: - integer - 'null' minimum: 1 maximum: 100 description: >- The score from which the decision is block; null turns blocking off. default_depth: enum: - quick - full inherits_account_creation: const: true description: >- Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. inherits_signup: const: true deprecated: true description: Alias of inherits_account_creation, still accepted. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. if: anyOf: - required: - inherits_account_creation - required: - inherits_signup then: not: anyOf: - required: - step_up - required: - review - required: - block signup: allOf: - type: object additionalProperties: false minProperties: 1 description: >- A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100. properties: step_up: type: integer minimum: 1 maximum: 100 review: type: integer minimum: 1 maximum: 100 block: type: - integer - 'null' minimum: 1 maximum: 100 description: >- The score from which the decision is block; null turns blocking off. default_depth: enum: - quick - full inherits_account_creation: const: true description: >- Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. inherits_signup: const: true deprecated: true description: Alias of inherits_account_creation, still accepted. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. if: anyOf: - required: - inherits_account_creation - required: - inherits_signup then: not: anyOf: - required: - step_up - required: - review - required: - block - not: anyOf: - required: - inherits_account_creation - required: - inherits_signup deprecated: true description: Alias of account_creation, still accepted. not: required: - account_creation - signup description: Use account_creation or its deprecated alias signup, never both. Settings: title: Environment settings description: >- One environment's settings: how long its assessments are kept, and for each flow the risk thresholds that decide it and the depth a request that names none is served at, and the sources it refuses. Live and test each have their own. A flow without thresholds of its own uses account_creation's (inherits_account_creation). Every change is recorded in the audit log as settings.updated, with who made it. type: object additionalProperties: false required: - workspace_id - environment - retention_days - policy_version - flows - refused_sources properties: workspace_id: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. environment: enum: - live - test description: >- The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator. retention_days: type: integer minimum: 1 maximum: 365 description: >- Days an assessment is kept after it is created, 1 to 365 (default 365). Shortening hides older assessments at once. policy_version: type: integer minimum: 0 description: >- How many times this environment's policy has changed; 0 while the defaults apply. A served risk.policy_version ends in +t once it is above 0. updated_by: type: string minLength: 1 maxLength: 256 pattern: ^[^\x00-\x1f\x7f]+$ description: Absent while the defaults apply. updated_at: type: string format: date-time description: When the policy last changed. Absent while the defaults apply. flows: type: object additionalProperties: false required: - account_creation - login - purchase properties: account_creation: type: object additionalProperties: false required: - step_up - review - default_depth - inherits_account_creation - admission - hold_seconds - on_expiry description: >- One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final. properties: step_up: type: integer minimum: 1 maximum: 99 review: type: integer minimum: 2 maximum: 100 block: type: integer minimum: 1 maximum: 100 description: >- The score from which the decision is block. Absent while blocking is off, the default. default_depth: enum: - quick - full description: >- The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login. inherits_account_creation: type: boolean description: >- true while this flow has no thresholds of its own and uses account_creation's, the default for login and purchase. Always false for signup. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. login: type: object additionalProperties: false required: - step_up - review - default_depth - inherits_account_creation - admission - hold_seconds - on_expiry description: >- One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final. properties: step_up: type: integer minimum: 1 maximum: 99 review: type: integer minimum: 2 maximum: 100 block: type: integer minimum: 1 maximum: 100 description: >- The score from which the decision is block. Absent while blocking is off, the default. default_depth: enum: - quick - full description: >- The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login. inherits_account_creation: type: boolean description: >- true while this flow has no thresholds of its own and uses account_creation's, the default for login and purchase. Always false for signup. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. purchase: type: object additionalProperties: false required: - step_up - review - default_depth - inherits_account_creation - admission - hold_seconds - on_expiry description: >- One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final. properties: step_up: type: integer minimum: 1 maximum: 99 review: type: integer minimum: 2 maximum: 100 block: type: integer minimum: 1 maximum: 100 description: >- The score from which the decision is block. Absent while blocking is off, the default. default_depth: enum: - quick - full description: >- The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login. inherits_account_creation: type: boolean description: >- true while this flow has no thresholds of its own and uses account_creation's, the default for login and purchase. Always false for signup. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. refused_sources: type: array uniqueItems: true maxItems: 6 items: enum: - github - phone - breach - rdap - mx - ipintel description: >- A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers) or ipintel (IP intelligence). description: >- The sources this environment refuses, sorted; empty, the default, refuses none. An assessment never contacts a refused source: its coverage is missing (an identifier with no other source lists coverage-unavailable as unavailable), never not_found, and a stored result of a refused source is not reused. $defs: flow_settings: type: object additionalProperties: false required: - step_up - review - default_depth - inherits_account_creation - admission - hold_seconds - on_expiry description: >- One flow's policy in force. A score below step_up is allow, below review step_up, and from review review; from block, when present, the decision is block. admission says when the flow's decision is final. properties: step_up: type: integer minimum: 1 maximum: 99 review: type: integer minimum: 2 maximum: 100 block: type: integer minimum: 1 maximum: 100 description: >- The score from which the decision is block. Absent while blocking is off, the default. default_depth: enum: - quick - full description: >- The depth a request for this flow that names none is served at. Defaults: full for account_creation and purchase, quick for login. inherits_account_creation: type: boolean description: >- true while this flow has no thresholds of its own and uses account_creation's, the default for login and purchase. Always false for signup. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. flow_change: type: object additionalProperties: false minProperties: 1 description: >- A change to one flow. A field left out keeps the value in force. Thresholds set on login or purchase start from the values in force, account_creation's while it inherits them. After the change, 0 < step_up < review <= 100 and block is off or review <= block <= 100. properties: step_up: type: integer minimum: 1 maximum: 100 review: type: integer minimum: 1 maximum: 100 block: type: - integer - 'null' minimum: 1 maximum: 100 description: >- The score from which the decision is block; null turns blocking off. default_depth: enum: - quick - full inherits_account_creation: const: true description: >- Login or purchase only: drop the flow's own thresholds so it uses account_creation's again. Not combined with step_up, review or block. inherits_signup: const: true deprecated: true description: Alias of inherits_account_creation, still accepted. admission: enum: - immediate - held description: >- immediate (the default): an assessment of this flow is decided from the evidence its answer has, and later evidence may change the decision. held: while the account's current assessment of this flow has not completed, the account's decision for the flow is held, and the final decision arrives as account.risk_changed when the investigation completes or hold_seconds pass, whichever is first. Each flow has its own admission. hold_seconds: type: integer minimum: 30 maximum: 86400 description: >- How long a held flow's assessment is held after it was created, 30 to 86400 seconds (default 300). Kept while the flow is immediate. on_expiry: enum: - allow - review - block description: >- The decision a held assessment takes when hold_seconds pass before its investigation completes, unless the evidence so far gives a stricter one (default review). It is announced as account.risk_changed like any other change, so an expired hold is always announced. A hosted provider hook, which cannot wait, answers a held account by it at once: deny for block, allow otherwise. Kept while the flow is immediate. if: anyOf: - required: - inherits_account_creation - required: - inherits_signup then: not: anyOf: - required: - step_up - required: - review - required: - block updated_by: type: string minLength: 1 maxLength: 256 pattern: ^[^\x00-\x1f\x7f]+$ source_id: enum: - github - phone - breach - rdap - mx - ipintel description: >- A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers) or ipintel (IP intelligence). refused_sources: type: array uniqueItems: true maxItems: 6 items: enum: - github - phone - breach - rdap - mx - ipintel description: >- A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers) or ipintel (IP intelligence). description: >- The sources this environment refuses, sorted; empty, the default, refuses none. An assessment never contacts a refused source: its coverage is missing (an identifier with no other source lists coverage-unavailable as unavailable), never not_found, and a stored result of a refused source is not reused. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 responses: SettingsUpdated: description: The environment's settings after the change. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/Settings' examples: changed: value: workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM environment: live retention_days: 90 policy_version: 3 updated_by: user_2abcDEF updated_at: '2026-10-23T09:30:00Z' flows: account_creation: step_up: 40 review: 75 block: 95 default_depth: full inherits_account_creation: false admission: held hold_seconds: 600 on_expiry: review login: step_up: 30 review: 60 default_depth: full inherits_account_creation: false admission: immediate hold_seconds: 300 on_expiry: review purchase: step_up: 40 review: 75 block: 95 default_depth: full inherits_account_creation: true admission: immediate hold_seconds: 300 on_expiry: review refused_sources: - phone InvalidControlRequest: description: >- The body breaks its schema, or a console credential named no valid NR-Acting-User. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized ControlForbidden: description: >- workspace_forbidden: an API key without the management scope, or any API key on a route other than the key and settings routes. role_forbidden: a console credential's acting user is an active member whose role does not grant the operation. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden - role_forbidden WorkspaceNotFound: description: >- No such workspace, member, invite, key or environment for the caller. A workspace the acting user is not an active member of answers this too, as do another workspace and the other environment to an API key, so no answer shows which workspaces exist. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found PayloadTooLarge: description: The body exceeds 32768 bytes. Refused before parsing. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 413 code: enum: - payload_too_large UnsupportedMediaType: description: Content-Type is not application/json. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 415 code: enum: - unsupported_media_type ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. A key sees only its own environment's data. Each key has one or more scopes: `assess` creates and reads assessments, records outcomes and reports key usage; `history` reads assessments, an account's current risk, the accounts whose risk changed and an account's history, records enforcements and erases an account; `detailed` adds the detailed view; `webhooks` registers, tests, rotates and deletes webhook endpoints; `integrations` registers and manages hosted provider integrations; `management` creates, lists and revokes the keys of its own environment and reads and changes that environment's settings. A missing, unknown, revoked or expired key answers 401. A valid key without the scope an operation needs answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.