# NoResponse docs

> Developer docs for the NoResponse API: one current risk score, decision and reasons for every account.

- [Overview](https://docs.noresponse.org/index.md): One call at account creation, login or purchase returns the current risk of the account and a decision that your platform applies.
- [Quickstart](https://docs.noresponse.org/quickstart.md): Gate the free credits or first API key of a new account on one NoResponse call. Works with Clerk, WorkOS, Auth0 or your own login.
- [Authentication](https://docs.noresponse.org/authentication.md): Bearer API keys, the five scopes, where keys live and how to rotate one without a failed request.
- [Test your integration](https://docs.noresponse.org/testing.md): How a test key answers from a simulator, the magic emails and phone numbers that give each decision, and how to change to live.
- [Connect an agent](https://docs.noresponse.org/guides/agents.md): Give an AI agent the NoResponse tools over MCP: the hosted server at mcp.noresponse.org, the npm package for a local server, and the Claude Desktop extension.
- [Assess account creation, login and purchase](https://docs.noresponse.org/guides/assess.md): The full request to POST /v1/assessments, every field and limit, and the fallback that you choose for pending answers and errors.
- [Pass your auth session](https://docs.noresponse.org/guides/auth-session.md): Send the facts your auth provider already verified, from Clerk, WorkOS, Auth0, Supabase, Firebase or any OIDC issuer, so they count in the score.
- [Deny risky accounts at your auth provider](https://docs.noresponse.org/guides/deny-at-account-creation.md): Point an Auth0 Action or a WorkOS Action at a hosted NoResponse endpoint. Your auth provider then refuses an account creation or a login whose risk score reaches your block threshold. No server of your own.
- [Turn an assessment into a decision](https://docs.noresponse.org/guides/decisions.md): Ordered rules that change an assessment into allow, step up, review or block, what to store with each decision, and how to run the rules again on a webhook.
- [Pending, retries and idempotency](https://docs.noresponse.org/guides/pending.md): What a 202 carries, how to wait for the final assessment, how Idempotency-Key binds a request for 24 hours, and how the SDKs retry.
- [Act on late results](https://docs.noresponse.org/guides/late-results.md): When evidence arrives after your account creation gate answered, NoResponse sends assessment.updated. Verify it, skip test events and stale revisions, then revoke the user's sessions or ban the user in Clerk, WorkOS, Auth0 or your own login.
- [Webhooks](https://docs.noresponse.org/guides/webhooks.md): Receive the final assessment and verify its signature. Handle duplicates, versions, expiry, changed and deleted accounts, deleted workspaces and disabled endpoints.
- [Report outcomes](https://docs.noresponse.org/guides/outcomes.md): Tell NoResponse the outcome of an assessed account, with the six outcome values and when to send each one.
- [Report key usage](https://docs.noresponse.org/guides/key-usage.md): Send the usage of the API keys that your gate issues at account creation, so that a shared or stolen key increases the risk of its account.
- [Clerk](https://docs.noresponse.org/integrations/clerk.md): Assess a new Clerk account with the facts that Clerk verified, through the Clerk backend SDK and the fromClerk adapter.
- [WorkOS](https://docs.noresponse.org/integrations/workos.md): Assess a new WorkOS AuthKit account with the facts that WorkOS verified, through the WorkOS SDK and the fromWorkOS adapter.
- [Auth0](https://docs.noresponse.org/integrations/auth0.md): Assess a new Auth0 account with fromAuth0 and the Management API, and act on late results on every Auth0 plan.
- [Other OIDC providers](https://docs.noresponse.org/integrations/oidc.md): Assess a new account from any OpenID Connect provider with fromOIDC and overrides. Find the dedicated adapters for Supabase, Firebase, Cognito, Entra ID, Keycloak and Ory.
- [Node SDK](https://docs.noresponse.org/sdks/typescript.md): @noresponse/node 3.0: install, client options and environment variables, every method, the error classes, retries, webhook helpers, auth adapters and logging.
- [Python SDK](https://docs.noresponse.org/sdks/python.md): noresponse 3.x for Python 3.10 and later. Install, client options, every method, errors, retries, webhooks, auth adapters, logging and upgrades.
- [Go SDK](https://docs.noresponse.org/sdks/go.md): Go SDK v3: install, client options, every method, idempotency keys, typed errors, retries, paging, waiting, webhook helpers and auth adapters.
- [Java SDK](https://docs.noresponse.org/sdks/java.md): The NoResponse Java client: install from JitPack, client options, every method, the exception classes, retries, webhook verification and auth adapters.
- [.NET SDK](https://docs.noresponse.org/sdks/csharp.md): The NoResponse client for C# and .NET 8. Install from GitHub, client options, every method, exceptions, retries, webhooks and auth adapters.
- [PHP SDK](https://docs.noresponse.org/sdks/php.md): The NoResponse PHP client: install with Composer, client options, every method, the exception classes, retries, webhook verification and auth adapters.
- [Ruby SDK](https://docs.noresponse.org/sdks/ruby.md): The NoResponse Ruby client: install from RubyGems, client options, every method, the error classes, retries, webhook verification and auth adapters.
- [Changelog](https://docs.noresponse.org/changelog.md): The versions of the NoResponse API and the SDKs, and the changes in each version.
- [API reference](https://docs.noresponse.org/api-reference/index.md): Every NoResponse API endpoint and webhook event, with a playground that sends real requests with your own key.
- [Create an assessment](https://docs.noresponse.org/reference/create-assessment.md): POST /v1/assessments: every request field with its type, limit and default, and the 200 and 202 answers with their headers.
- [The assessment object](https://docs.noresponse.org/reference/assessment.md): Every field of an assessment: the risk and decision of the account, the enum values, the summary facts, coverage, incomplete sources and timestamps.
- [Reason codes](https://docs.noresponse.org/reference/reason-codes.md): All 37 reason codes that an assessment or an account can carry: the meaning, the effect on the score and the identifier of each.
- [Get and query assessments](https://docs.noresponse.org/reference/get-and-query.md): Get, delete and query assessments: one assessment by id, the history of an account with cursor pagination, and what happens after expiry.
- [Accounts](https://docs.noresponse.org/reference/accounts.md): Get the one current risk of an account with a decision for each flow, page through its assessments, and delete the account.
- [Key usage batches](https://docs.noresponse.org/reference/key-usage.md): POST /v1/key_usage/batches reports requests made with the API keys that your account creation gate issued: the event fields, the limits, idempotency and the answer.
- [Data retention](https://docs.noresponse.org/reference/data-retention.md): How long NoResponse keeps an assessment and the records around it, and which request values the API refuses.
- [Create an assessment](https://docs.noresponse.org/api-reference/assess/create-an-assessment.md): Assesses one signup, login or purchase, named by `flow`. `depth` sets how long the answer waits: `quick` waits only for the sources that answer within 500 ms, `full` waits up to 3,000 ms. It defaults to `full` for `signup` and `purchase` and `quick` for `login`, and `deadline_ms` can lower either.
- [Retrieve an assessment](https://docs.noresponse.org/api-reference/assess/retrieve-an-assessment.md): Returns the latest version of one assessment. This is the authoritative read: use it to poll a `pending` answer or to refresh one a webhook told you about.
- [Delete an assessment](https://docs.noresponse.org/api-reference/assess/delete-an-assessment.md): Deletes one of your assessments in the environment of your key, with its versions, evidence and outcomes. An abuse outcome you reported on it stops counting toward other assessments. Afterwards `GET /v1/assessments/{assessment_id}` answers 404 and the assessment leaves the account's history.
- [Report an outcome](https://docs.noresponse.org/api-reference/assess/report-an-outcome.md): Tells NoResponse what you later learned about an assessed account.
- [List an account's assessments](https://docs.noresponse.org/api-reference/assess/list-an-accounts-assessments.md): Pages through the unexpired assessments for one of your accounts, newest first, each at its latest version.
- [Retrieve an account](https://docs.noresponse.org/api-reference/accounts/retrieve-an-account.md): Returns the one current risk of one of your accounts. An account is the `account_id` you send with your assessments, and every assessment updates it.
- [Erase an account](https://docs.noresponse.org/api-reference/accounts/erase-an-account.md): Erases one of your accounts in the environment of your key, for example when your user asks you to delete their data. Every assessment of the account goes, with its versions, evidence and outcomes, and an abuse outcome you reported on one of them stops counting toward other assessments. An assessmen…
- [List an account's assessments by URL](https://docs.noresponse.org/api-reference/accounts/list-an-accounts-assessments-by-url.md): The same pages as `POST /v1/assessments/query`, for the account in the path: its unexpired assessments, newest first, each at its latest version. An account with no assessments answers 200 with empty `items`.
- [Report key usage](https://docs.noresponse.org/api-reference/usage/report-key-usage.md): Records requests made with API keys your signup gate issued to your accounts, one event per request. Each event names the key by its SHA-256, the `issued_credential.sha256` the account's assessment carried, and gives the client `ip`, `occurred_at` and optionally `user_agent`, `model`, `input_tokens`…
- [Rotate your API key](https://docs.noresponse.org/api-reference/keys/rotate-your-api-key.md): Creates a new key with the same scopes as the key that signs this request, and returns it once. Store it straight away: it is never shown again.
- [List integrations](https://docs.noresponse.org/api-reference/integrations/list-integrations.md): Lists your integrations, oldest first. Secrets are not listed. Requires the `integrations` scope.
- [Register an integration](https://docs.noresponse.org/api-reference/integrations/register-an-integration.md): Registers a WorkOS or Auth0 integration and returns its hosted endpoint in `url`, so you can gate sign-ups and sign-ins with no server of your own.
- [Delete an integration](https://docs.noresponse.org/api-reference/integrations/delete-an-integration.md): Deletes the integration and its secrets. Its endpoint answers 404 from then on, so remove the Action from your provider first. Requires the `integrations` scope.
- [Rotate an integration's secret](https://docs.noresponse.org/api-reference/integrations/rotate-an-integrations-secret.md): For Auth0, send `{}`: the answer's `secret` is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as `signing_secret`.
- [List your webhook endpoints](https://docs.noresponse.org/api-reference/webhooks/list-your-webhook-endpoints.md): Every endpoint you hold, in every state, with the ids of its signing keys. Secrets are not returned. Requires the `webhooks` scope.
- [Register a webhook endpoint](https://docs.noresponse.org/api-reference/webhooks/register-a-webhook-endpoint.md): Registers an endpoint and returns it with its first signing secret. The secret is shown only in this answer: store it where your receiver reads it.
- [Delete a webhook endpoint](https://docs.noresponse.org/api-reference/webhooks/delete-a-webhook-endpoint.md): Deletes the endpoint and its signing keys. Deliveries still queued for it are dropped. An endpoint that is already gone answers 404. Requires the `webhooks` scope.
- [Rotate a webhook signing key](https://docs.noresponse.org/api-reference/webhooks/rotate-a-webhook-signing-key.md): Issues a new signing key for the endpoint and returns its secret once. Every delivery from now on is signed with it.
- [Send a test event](https://docs.noresponse.org/api-reference/webhooks/send-a-test-event.md): `endpoint.verification` sends a signed challenge now and answers whether the endpoint echoed it within 5 seconds. An echo verifies the endpoint, including one that was disabled.
- [List delivery attempts](https://docs.noresponse.org/api-reference/webhooks/list-delivery-attempts.md): Every POST the endpoint received, newest first: the `event_id` and `event_type`, which `attempt` it was, whether it was a `replay`, `delivered` or `failed`, the `response_code`, the `failure` reason and `latency_ms`.
- [Replay a delivery](https://docs.noresponse.org/api-reference/webhooks/replay-a-delivery.md): Queues the event for the endpoint again: the same `event_id` and the same body it received, with a new `NR-Webhook-Timestamp` and a signature from the endpoint's current signing key. It is retried like any other delivery, and its attempts are listed with `"replay": true`.
- [Assessment updated](https://docs.noresponse.org/api-reference/webhooks/assessment-updated.md): Sent when an assessment's score, band, recommendation, coverage or status changes. `data` is the whole assessment, exactly as `GET /v1/assessments/{assessment_id}` returns it at that `detail.assessment_version`: the account's current risk in `account` and the assessment's own facts in `detail`.
- [Endpoint verification](https://docs.noresponse.org/api-reference/webhooks/endpoint-verification.md): Sent when you ask for it with `POST /v1/webhooks/{endpoint_id}/test`, before any assessment event reaches the endpoint. Verify the signature, then answer 200 with `Content-Type: application/json` and the body `{"challenge": "<the same value>"}` within 5 seconds.
- [Account erased](https://docs.noresponse.org/api-reference/webhooks/account-erased.md): Sent once to your verified endpoints, in the environment the account was erased in, when `DELETE /v1/accounts/{account_id}` deleted at least one assessment of the account. `data` holds the `account_id`, `assessments_deleted` and `deleted_at`.
- [Workspace deleted](https://docs.noresponse.org/api-reference/webhooks/workspace-deleted.md): Sent once to the verified endpoints of each environment, live and test, when your workspace is deleted from the NoResponse console. `data` holds the `workspace_id`, the `environment` (`live` or `test`) and `deleted_at`.
- [Webhook endpoint disabled](https://docs.noresponse.org/api-reference/webhooks/webhook-endpoint-disabled.md): Sent to the other verified endpoints of an environment when one of its endpoints was disabled because every delivery to it failed for 72 hours without a break. `data` holds the `endpoint_id`, `failing_since` (when the failures began) and `disabled_at`.
- [Account decision changed](https://docs.noresponse.org/api-reference/webhooks/account-decision-changed.md): Sent once to your verified endpoints, in the account's environment, when the account's decision for at least one flow (`signup`, `login` or `purchase`) changes. `data.account` is the account as `GET /v1/accounts/{account_id}` answers it for the assessment version that made the change, with the new s…
- [Errors and limits](https://docs.noresponse.org/reference/errors.md): The problem document of every error, every code by status, which codes to retry, the request limits, rate limiting and the SDK error classes.
- [400 invalid_request](https://docs.noresponse.org/problems/invalid-request.md): The body is not JSON, or it does not match the request schema.
- [400 invalid_idempotency_key](https://docs.noresponse.org/problems/invalid-idempotency-key.md): The request has no Idempotency-Key header, or its key is malformed.
- [400 invalid_cursor](https://docs.noresponse.org/problems/invalid-cursor.md): POST /v1/assessments/query got a cursor that NoResponse cannot accept.
- [401 unauthorized](https://docs.noresponse.org/problems/unauthorized.md): The request has no Authorization header, or its key is malformed, unknown, revoked or expired.
- [403 workspace_forbidden](https://docs.noresponse.org/problems/workspace-forbidden.md): The key is valid, but it does not carry a scope that the operation needs.
- [404 not_found](https://docs.noresponse.org/problems/not-found.md): The assessment id is unknown, has expired, is malformed or belongs to another workspace.
- [405 method_not_allowed](https://docs.noresponse.org/problems/method-not-allowed.md): The route exists, but it does not accept this HTTP method. An example is GET /v1/assessments.
- [409 idempotency_key_reused](https://docs.noresponse.org/problems/idempotency-key-reused.md): You sent an Idempotency-Key again within 24 hours with a different body.
- [409 key_rotation_in_progress](https://docs.noresponse.org/problems/key-rotation-in-progress.md): You called POST /v1/keys/rotate with a key that you rotated before. That key is still in its overlap window.
- [400 webhook_url_refused](https://docs.noresponse.org/problems/webhook-url-refused.md): POST /v1/webhooks got a URL that is not a permitted webhook destination.
- [409 webhook_endpoint_limit_reached](https://docs.noresponse.org/problems/webhook-endpoint-limit-reached.md): You called POST /v1/webhooks when you already have 5 endpoints.
- [409 webhook_endpoint_unverified](https://docs.noresponse.org/problems/webhook-endpoint-unverified.md): POST /v1/webhooks/{endpoint_id}/test asked for assessment.updated for an endpoint that is not verified.
- [409 too_many_integrations](https://docs.noresponse.org/problems/too-many-integrations.md): You called POST /v1/integrations when you already have 10 integrations.
- [401 invalid_hook_signature](https://docs.noresponse.org/problems/invalid-hook-signature.md): Your auth provider called the hosted endpoint of an integration, and NoResponse refused the call.
- [413 payload_too_large](https://docs.noresponse.org/problems/payload-too-large.md): The request body is larger than 32,768 bytes. For a key usage batch, the limit is 262,144 bytes (256 KiB).
- [415 unsupported_media_type](https://docs.noresponse.org/problems/unsupported-media-type.md): The request has a body, but its Content-Type header is not application/json.
- [429 rate_limited](https://docs.noresponse.org/problems/rate-limited.md): Your workspace has used all of its request rate or its concurrency limit.
- [500 internal_error](https://docs.noresponse.org/problems/internal-error.md): An unexpected failure on NoResponse's side.
- [503 service_unavailable](https://docs.noresponse.org/problems/service-unavailable.md): NoResponse could not start the assessment because of overload, a shutdown or a dependency that is down.

## OpenAPI Specs

- [openapi](/openapi.json)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.