> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoint verification

> Sent when you ask for it with `POST /v1/webhooks/{endpoint_id}/test`, before any assessment event reaches the endpoint. Verify the signature, then answer 200 with `Content-Type: application/json` and the body `{"challenge": "<the same value>"}` within 5 seconds.

Anything else leaves the endpoint unverified, and no assessment event is sent to it.



## OpenAPI

````yaml /openapi.json webhook endpoint.verification
openapi: 3.1.0
info:
  title: NoResponse API
  version: '1'
  description: >-
    The NoResponse API assesses a signup, login or purchase and answers with the
    account's one current risk: a 0 to 100 score, a decision for the flow
    (`allow`, `step_up`, `review` or `block`), the reasons behind it and the
    decision for each flow. The assessment's own facts, such as its status,
    confidence and incomplete sources, sit under `detail`.


    Authenticate every request with your API key as `Authorization: Bearer
    nrk_...`. Call the API only from your backend.


    Guides, SDKs and webhook verification are at
    [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC
    9457 problem document; see
    [Errors](https://docs.noresponse.org/reference/errors).
servers:
  - url: https://api.noresponse.org
    description: Production
security:
  - tenantBearer: []
tags:
  - name: assess
    x-displayName: Assessments
    x-group: Assessments
    description: Create, read and list assessments, and report outcomes.
  - name: accounts
    x-displayName: Accounts
    x-group: Accounts
    description: >-
      Each of your accounts holds one current risk, and its assessments are its
      history.
  - name: usage
    x-displayName: Key usage
    x-group: Key usage
    description: >-
      Report usage of the API keys your signup gate issued, so a shared or
      stolen key raises its account's risk.
  - name: keys
    x-displayName: API keys
    x-group: API keys
    description: Rotate your own API key.
  - name: integrations
    x-displayName: Integrations
    x-group: Integrations
    description: >-
      Hosted endpoints that answer your WorkOS or Auth0 sign-up and sign-in
      hooks.
  - name: webhooks
    x-displayName: Webhooks
    x-group: Webhooks
    description: Your webhook endpoints, and the signed events NoResponse sends to them.
paths: {}
components:
  securitySchemes:
    tenantBearer:
      type: http
      scheme: bearer
      description: >-
        Your API key, sent as `Authorization: Bearer <key>`. A key is
        `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a
        43-character secret. A key sees only its own environment's data.


        Each key has one or more scopes: `assess` creates and reads assessments,
        records outcomes and reports key usage; `history` reads assessments, an
        account's current risk and an account's history, and erases an account;
        `detailed` adds the detailed view; `webhooks` registers, tests, rotates
        and deletes webhook endpoints; `integrations` registers and manages
        hosted provider integrations. A missing, unknown, revoked or expired key
        answers 401. A valid key without the scope an operation needs answers
        403.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.