Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace.

assess creates and reads assessments, records outcomes and reports key usage. investigate reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy history scope also permits account exports, submitted identifiers and enforcement reports. delete permits account and assessment deletion.

evidence or detailed adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. exports permits exports with the underlying account or audit scope. audit reads audit events and usage reads usage. audit_manage manages audit streams and retention, and includes audit-read and export authority.

webhooks manages webhook endpoints. integrations manages hosted auth-provider integrations. management manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions.

settings reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires settings and policy_publish together, or the legacy management scope.

groups creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment.

members reads the workspace directory. members_manage also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. management does not grant team access. API keys cannot change owners or accept invitations.

A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403.

Path Parameters

workspace_id
string
required

The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$

Body

application/json

Read a past [from,to) interval of at most 31 days. The complete retained populations must fit a combined 100000-row budget and a 1500ms SQL statement budget. No pagination or sampled totals; choose a shorter interval after a row-budget refusal.

environment
enum<string>
required
Available options:
live,
test
from
string<date-time>
required
to
string<date-time>
required

Response

Complete retained outcome, enforcement and review populations with independent denominators and label coverage. The data snapshot and audit commit complete before any counts are returned.

The three populations have independent denominators and must not be added or compared as one funnel. All counts and retention come from one database statement snapshot. as_of is its start time; retained_from is the maximum current retention horizon, not a promise of history before erasure. Erased or expired detail is excluded, even before maintenance removes it. Counts describe retained observations only; no false-positive, false-negative, prevented-loss or causal claims are inferred. Every successful read is transactionally audited before the response.

workspace_id
string
required

The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
environment
enum<string>
required
Available options:
live,
test
from
string<date-time>
required
to
string<date-time>
required
as_of
string<date-time>
required
retained_from
string<date-time>
required
retention_days
integer
required
Required range: 1 <= x <= 365
row_budget
any
required
records_read
integer
required
Required range: 0 <= x <= 100000
truncated
any
required
outcomes
object
required

One account whose current completed assessment was created in [from,to) and remains retained at as_of. The effective account feedback head is read at as_of, even if received outside this window; expiry or an unknown correction never revives an older label. reported includes unknown; label_coverage numerator excludes unknown, denominator is eligible accounts. This is a changing current-account cohort, not a historical assessment cohort.

enforcements
object
required

Retained customer enforcement report rows created in [from,to), one row per account/risk_version/flow/action. A later applied report can replace failed at the original created_at; retries are not additional attempts here. applied_coverage divides reported_applied by report rows, including explicit action none; it is not independently verified execution, all requested actions, or prevented fraud. Unreported actions are unknown.

reviews
object
required

Reviews created in [from,to) whose review and current account assessment remain retained. Status and assignment are current at as_of, not a transition history. label_coverage numerator is resolved reviews labeled benign or abuse; denominator is resolved reviews. Inconclusive is not a known outcome. Review conclusions do not change account feedback or enforcement.