API overview
The Noxtica server APIs are HTTPS JSON APIs that your own back end calls. These pages are generated from the OpenAPI specifications that Noxtica publishes, so every route, parameter, field and status code listed here comes from the same source as the specification files.
The specifications themselves are published as files: /docs/api/openapi.json holds every public operation of the four APIs, and /docs/api/openapi/<api>.json holds one API each (v1, kyc, pulse, mcp); every file is also served as YAML, at the same address with the YAML extension. Import them into a client generator, an API workspace, or an AI agent. See Integrate with an AI agent.
Call these APIs from a server you control. A server API key is a secret and must never reach a browser or a mobile app. Availability is account-specific: the modules enabled for your account and the scopes on your key decide which operations you can call.
Production (collect.noxtica.com)
Production ingest host (ingest.noxtica.com)
https://ingest.noxtica.com
Production (backoffice.noxtica.com)
https://backoffice.noxtica.com
APIs
Production (pulse.noxtica.com)
https://pulse.noxtica.com
APIs
Base URLs
Send each request to the base URL listed for the API you call.
| Environment | Base URL | Key prefix | APIs |
|---|---|---|---|
| Production | https://collect.noxtica.com | sk_prod_ | Identity verification API, Risk scoring and agent trust API, Protected actions API, Device intelligence API, Mobile and device identity API, Telemetry ingestion API, Observability query API, Health and public key endpoints |
| Production ingest host | https://ingest.noxtica.com | Telemetry ingestion API, Observability query API | |
| Production | https://backoffice.noxtica.com | MCP server | |
| Production (not yet deployed) | https://pulse.noxtica.com | Pulse tenant API |
Authentication
Operations authenticate with the credential named in their section. The credential formats are:
| Credential | Header | Used by |
|---|---|---|
ApiKeyAuth | Authorization: Bearer sk_<random> | Identity verification API, Risk scoring and agent trust API, Protected actions API, Device intelligence API, Mobile and device identity API, Observability query API |
SessionTokenAuth | Authorization: Bearer kycs.<tenant>.<secret> | Identity verification API |
ApmIngestKeyAuth | Authorization: Bearer sk_apm_<random> | Telemetry ingestion API |
CodingAgentKeyAuth | Authorization: Bearer cak_<random> | Observability query API |
McpTokenAuth | Authorization: Bearer mcp_<random> | MCP server |
tenantKey | Authorization: Bearer sk_prod_<32 hex> | Pulse tenant API |
See Authentication for key handling and the scope each operation requires.
Scopes
A key can call an operation only if it carries the scope the operation requires. The reference names 22 scopes; the Authentication page lists the operations that need each one.
Errors
Error responses use the HTTP status code and a JSON body that carries a machine-readable code and a request id. See Errors for the body, the codes each API returns and how to report a failed request.
Rate limits
A request that exceeds a limit receives status 429 with a Retry-After header. See Rate limits for how to back off and retry.
Idempotency
These operations accept an Idempotency-Key header. Send a new, unique value for each logical operation and the same value when you retry it, so a retry cannot repeat the operation.
| Operation | Header | Length |
|---|---|---|
kycVerify | Required | 8 to 128 characters |
kycVerifyBatchSubmit | Required | 8 to 128 characters |
kycSessionMint | Optional | 8 to 128 characters |
offlineCaptureBundleAdmit | Required | 8 to 128 characters |
Pagination
These operations return results in pages. Pass the cursor from one response, unchanged, in the cursor query parameter of the next request.
| Operation | Page size | Cursor in the response |
|---|---|---|
v1ListDevices | default 50, maximum 200 | nextCursor |
v1ListAccountDevices | default 50, maximum 200 | nextCursor |
v1ListEvents | default 50, maximum 200 | nextCursor |
v1ListVisits | default 50, maximum 200 | nextCursor |
v1ExportFingerprints | X-Noxtica-Export-Next-Cursor, next_cursor | |
v1ExportEvents | X-Noxtica-Export-Next-Cursor, next_cursor | |
v1ExportVisits | X-Noxtica-Export-Next-Cursor, next_cursor | |
v1ExportScoredEvents | X-Noxtica-Export-Next-Cursor | |
v1ListLabels | default 50, maximum 200 | nextCursor |
v1ApmListProjects | default 50, maximum 200 | next_cursor |
v1ApmListProjectEnvironments | default 50, maximum 200 | next_cursor |
v1ApmSearchTraces | default 50, maximum 200 | next_cursor |
pulseTenantListDecisions | default 50, maximum 200 | nextCursor |
Webhooks
Noxtica sends signed webhook deliveries for 11 event types: kyc.session.completed, kyc.session.cancelled, kyc.verification.completed, kyc.erasure.completed, kyc.document.expiry_warning, kyc.reverification.due, submission.scored, risk.high, risk.flagged, risk.cluster_flagged, account.agent_linked. See Webhooks for the headers, the signature and the event catalog.
API reference
| API | What it covers | Operations | Credential |
|---|---|---|---|
| Identity verification API | Verify identities, run hosted verification sessions, batch and re-verify, store evidence, and receive signed KYC, KYB and KYM webhooks. | 25 | ApiKeyAuth, SessionTokenAuth |
| Risk scoring and agent trust API | Score a request, look up IP and device reputation, verify AI agents, and mint signed crawler vouchers from your server. | 7 | ApiKeyAuth |
| Protected actions API | Redeem the request id a browser obtains for a protected action (login, signup, checkout) before your server lets the action proceed. | 1 | ApiKeyAuth |
| Device intelligence API | Read devices, events and visits, export data, fetch the sealed-results key, write labels, and manage behavioral baselines. | 18 | ApiKeyAuth |
| Mobile and device identity API | Verify mobile attestation and integrity, deliver app configuration, and manage passkeys, handoff, delegation, recovery, wallet state and offline capture. | 22 | ApiKeyAuth |
| Telemetry ingestion API | Send OpenTelemetry traces, metrics, logs, profiles and deployment markers with an ingestion key. | 5 | ApmIngestKeyAuth |
| Observability query API | Query projects, traces, services and releases, manage environment policy, run exports and privacy-request lookups, and read recent signals from a coding agent. | 17 | ApiKeyAuth, CodingAgentKeyAuth |
| MCP server | Connect an AI assistant or your own code to your workspace through the Model Context Protocol with a scoped token. | 1 | McpTokenAuth |
| Pulse tenant API | Read player status and decisions, create link codes, and manage links from your own back end with a tenant API key. | 7 | tenantKey |
| Health and public key endpoints | The unauthenticated collector health probe and the public signing-key documents for verifying signed envelopes and Agent Passports offline. | 3 | None |
This page is generated from the Noxtica OpenAPI specification release v0.4.0: kyc.yaml version 1.2.0-2026-10-27 (SHA-256 c91a695cfde0), mcp.yaml version 0.1.0-2026-10-27 (SHA-256 1a4875efa736), pulse.yaml version 0.9.0-2026-10-27 (SHA-256 95196a58bb5b), v1.yaml version 1.3.0-2026-10-27 (SHA-256 3fd15257a022). Do not edit it by hand.