> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # Audit event recorded > Event type `audit.event`. Sent only to an explicit audit-stream subscription. `data` contains the immutable audit event, with its actor, action, target, outcome and affected environment. The stream begins at subscription creation. It applies your environment and action filters before each delivery. Use audit exports for available earlier events. Delivery is at least once and unordered. Deduplicate on the webhook `id`, which remains stable across retries and endpoint deliveries. Verify `NR-Webhook-Signature` over the raw body before parsing. Signatures and retry schedules follow the other webhook event types. Stopping a stream or shortening retention prevents future eligible deliveries. Data already delivered follows your receiver's retention policy. Replay retained audit events through the audit-stream replay route. The ordinary webhook replay route refuses them. ## OpenAPI ````yaml /openapi.json webhook audit.event openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: {} components: securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.