Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace.

assess creates and reads assessments, records outcomes and reports key usage. investigate reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy history scope also permits account exports, submitted identifiers and enforcement reports. delete permits account and assessment deletion.

evidence or detailed adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. exports permits exports with the underlying account or audit scope. audit reads audit events and usage reads usage. audit_manage manages audit streams and retention, and includes audit-read and export authority.

webhooks manages webhook endpoints. integrations manages hosted auth-provider integrations. management manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions.

settings reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires settings and policy_publish together, or the legacy management scope.

groups creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment.

members reads the workspace directory. members_manage also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. management does not grant team access. API keys cannot change owners or accept invitations.

A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403.

Path Parameters

workspace_id
string
required

The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
environment
enum<string>
required

The environment: live or test. Each has its own settings. Any other value answers 400. An API key reads and changes only its own environment's; the other answers 404. The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator.

Available options:
live,
test

Body

application/json

Publish a captured configuration as a new version. Version checks and publication are atomic. Longer retention does not revive expired records, and restored policy does not undo customer enforcement.

version
integer
required
Required range: 0 <= x <= 2147483647
expected_policy_version
integer
required
Required range: 0 <= x <= 2147483647
change_reason
string
required
Required string length: 1 - 500
Pattern: ^[^\x00-\x1f\x7f]*$

Response

Restore captured settings as a new guarded version.

One environment's settings: how long its assessments are kept, and for each flow the risk thresholds that decide it and the depth a request that names none is served at, the sources it refuses, and the daily cap on screening spend. Live and test each have their own. A flow without thresholds of its own uses account_creation's (inherits_account_creation). Every change is recorded in the audit log as settings.updated, with who made it.

workspace_id
string
required

The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
environment
enum<string>
required

The environment the key belongs to. A live key assesses with live sources; a test key answers from the deterministic simulator.

Available options:
live,
test
retention_days
integer
required

Days an assessment is kept after it is created, 1 to 365 (default 365). Shortening hides older assessments at once.

Required range: 1 <= x <= 365
policy_version
integer
required

The monotonic settings configuration epoch, including retention changes. Zero while defaults apply. Historical assessments keep their frozen policy version; the active version reaches new assessments within a minute.

Required range: x >= 0
flows
object
required
refused_sources
enum<string>[]
required

The sources this environment refuses, sorted; empty, the default, refuses none. An assessment never contacts a refused source: its coverage is missing (an identifier with no other source lists coverage-unavailable as unavailable), never not_found, and a stored result of a refused source is not reused.

Maximum array length: 25

A NoResponse source: github (GitHub accounts), phone (the phone lookup), breach (breach exposure), rdap (the email domain's registration), mx (the email domain's mail servers), ipintel (IP intelligence) or an email account source that searches one platform for an account by email address (adobe, nvidia, wix, life360, zapier, google). google runs only for Gmail addresses. scratch, dailymotion, substack, duolingo, dockerhub, wikipedia, internetarchive, telegram, spotify, patreon, wordpress, okru and flickr each search that platform for an account by username; telegram also searches by phone number, through a logged-in Telegram lookup account. whatsapp searches WhatsApp for an account by phone number.

Available options:
github,
phone,
breach,
rdap,
mx,
ipintel,
adobe,
nvidia,
wix,
life360,
zapier,
google,
scratch,
dailymotion,
substack,
duolingo,
dockerhub,
wikipedia,
internetarchive,
telegram,
spotify,
patreon,
wordpress,
okru,
flickr,
whatsapp
screening_daily_cap
integer | null
required

The most the environment's screenings may spend in one UTC day, in minor units of USD (cents), 0 to 100000000; null is no cap. Default 50000. A screening whose estimated_spend exceeds the cap less the day's recorded spend and what open screenings may still spend answers 409 screening_cap_exceeded.

Required range: 0 <= x <= 100000000
updated_by
string

Absent while the defaults apply.

Required string length: 1 - 256
Pattern: ^[^\x00-\x1f\x7f]+$
updated_at
string<date-time>

When the policy last changed. Absent while the defaults apply.