NoResponse Python SDK

Install it with pip install noresponse (Python 3.11 or later) and import noresponse_sdk. To work on the SDK, install it from source with pip install -e apps/identity-intelligence/sdks/python and run python -m unittest discover -s apps/identity-intelligence/sdks/python/tests -v.

import os
from noresponse_sdk import Client

client = Client(
    api_key=os.environ["NORESPONSE_API_KEY"],
    base_url=os.environ["NORESPONSE_API_URL"],  # https://api.noresponse.org in production
)
assessment = client.assess_signup(
    account_id="usr_123",
    email="person@example.com",   # email, username or phone: at least one
    name="Jane A. Doe",           # optional, used only for matching
    ip="73.162.18.45",            # optional, the signup's public IP
    idempotency_key="signup-usr_123-0000001",
)
# Pending means no recommendation: never allow. Enforce your own fallback policy.

client.assess(account_id=..., identifiers={...}, idempotency_key=...) takes the identifiers mapping directly (email, username, phone, name, ip). Also supports client.get_assessment(assessment_id), client.query_assessments(account_id=..., limit=..., cursor=...) and client.record_outcome(assessment_id, outcome=..., idempotency_key=...) to report what was later learned about the account (confirmed_abuse, account_takeover, chargeback, false_positive, legitimate or unknown). The two read methods each take response_mode="detailed" (with the detailed key scope) to add risk.details and signals, and refuses raw. assess() also accepts typed flow and region policy context; bounded retries of network failures, 429 and 503 are enabled with max_retries.

For signed webhooks call verify_webhook(raw_body, list_of_raw_header_pairs, secrets_by_key_id). It checks the v1= HMAC-SHA256 signature over the raw bytes, the 300-second window and the event id, refuses repeated or case-variant headers, and returns the typed WebhookEvent. An assessment.updated event's data is the full assessment as get_assessment returns it; webhook_assessment(event) returns it as a typed Assessment. webhook_verification_response(event) echoes a verified registration challenge.

Only call the API from a trusted backend. All recommendations are advisory and not calibrated probabilities. The SDK does not turn a timeout, pending assessment, blocked source or absence of evidence into an allow decision. See example rules for turning an assessment into an action.

Every request, response, summary, detail, signal and webhook type is a TypedDict in noresponse_sdk.generated_models, generated from the provider OpenAPI contract. See provider onboarding for key rotation, webhook verification, retries and staging setup.