Metadata-Version: 2.4
Name: noresponse
Version: 1.0.1
Summary: Server-side NoResponse Identity Intelligence SDK
License-Expression: Apache-2.0
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# NoResponse Python SDK

Install it with `pip install noresponse` (Python 3.11 or later) and import `noresponse_sdk`. To work on the SDK, install it from source with `pip install -e apps/identity-intelligence/sdks/python` and run `python -m unittest discover -s apps/identity-intelligence/sdks/python/tests -v`.

```python
import os
from noresponse_sdk import Client

client = Client(
    api_key=os.environ["NORESPONSE_API_KEY"],
    base_url=os.environ["NORESPONSE_API_URL"],  # https://api.noresponse.org in production
)
assessment = client.assess_signup(
    account_id="usr_123",
    email="person@example.com",   # email, username or phone: at least one
    name="Jane A. Doe",           # optional, used only for matching
    ip="73.162.18.45",            # optional, the signup's public IP
    idempotency_key="signup-usr_123-0000001",
)
# Pending means no recommendation: never allow. Enforce your own fallback policy.
```

`client.assess(account_id=..., identifiers={...}, idempotency_key=...)` takes the identifiers mapping directly (`email`, `username`, `phone`, `name`, `ip`). Also supports `client.get_assessment(assessment_id)`, `client.query_assessments(account_id=..., limit=..., cursor=...)` and `client.record_outcome(assessment_id, outcome=..., idempotency_key=...)` to report what was later learned about the account (`confirmed_abuse`, `account_takeover`, `chargeback`, `false_positive`, `legitimate` or `unknown`). The two read methods each take `response_mode="detailed"` (with the `detailed` key scope) to add `risk.details` and `signals`, and refuses `raw`. `assess()` also accepts typed `flow` and `region` policy context; bounded retries of network failures, 429 and 503 are enabled with `max_retries`.

For signed webhooks call `verify_webhook(raw_body, list_of_raw_header_pairs, secrets_by_key_id)`. It checks the `v1=` HMAC-SHA256 signature over the raw bytes, the 300-second window and the event id, refuses repeated or case-variant headers, and returns the typed `WebhookEvent`. An `assessment.updated` event's `data` is the full assessment as `get_assessment` returns it; `webhook_assessment(event)` returns it as a typed `Assessment`. `webhook_verification_response(event)` echoes a verified registration challenge.

Only call the API from a trusted backend. All recommendations are advisory and not calibrated probabilities. The SDK does not turn a timeout, pending assessment, blocked source or absence of evidence into an allow decision. See [example rules](../docs/example-rules.md) for turning an assessment into an action.

Every request, response, summary, detail, signal and webhook type is a TypedDict in `noresponse_sdk.generated_models`, generated from the provider OpenAPI contract. See [provider onboarding](../docs/provider-onboarding.md) for key rotation, webhook verification, retries and staging setup.
