Pulse tenant API

Read player status and decisions, create link codes, and manage links from your own back end with a tenant API key.

Credential: tenantKey. See Authentication.

Status of one player (pseudonymous subject) of the calling tenant

GET /pulse/v1/tenant/subjects/{subject}

Server-to-server, scope read:pulse. subject is a psub_… enrolment pseudonym, the pairwise link subject plnk_… or the tenant’s own externalUserId (both resolve ONLY through an ACTIVE link: after an unlink they answer 404 subject_not_found; an externalUserId linked in several applications is 409 ambiguous_subject unless ?appId= names one). A subject resolved through a link shows only the scopes the player consented to (status: enrolled/revokedAt/reasonCode; attestation_level: deviceAttestationLevel; last_seen: lastSeen; open_signals: openSignals) and echoes them in scopes. The tenant is always the key’s tenant: unknown subjects and other tenants’ subjects are the same 404 subject_not_found. The answer carries no account PII and no enrolment, device or key identifier. A revoked subject answers enrolled: false with revokedAt and reasonCode. openSignals are the subject’s open detections (open, under_review), newest first, at most 50, with tenant-safe fields only; [] when there are none. Cache-Control: no-store. Times are epoch milliseconds.

Authentication: Bearer token (tenantKey), scope read:pulse.

Parameters

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl "https://pulse.noxtica.com/pulse/v1/tenant/subjects/psub_01M4GW6CR553W8AAWXEG17RDJW" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/subjects/psub_01M4GW6CR553W8AAWXEG17RDJW', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/subjects/psub_01M4GW6CR553W8AAWXEG17RDJW",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

List the tenant’s response decisions (audit), newest first

GET /pulse/v1/tenant/decisions

Server-to-server, scope read:pulse. Every response action the device executed, suppressed or dry-ran under the tenant’s signed profile, with its reason code, the outcome of record, the linked detection’s review status and appeal state, and the hint state. Keyset-paged (cursor from nextCursor). Pseudonyms (psub, deviceRef) and closed codes only: no account id, e-mail, enrolment id, evidence, profile hash or staff identity. subject resolves like the subject status; for a linked subject the player must have granted open_signals (403 scope_not_granted). Cache-Control: no-store.

Authentication: Bearer token (tenantKey), scope read:pulse.

Parameters

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl "https://pulse.noxtica.com/pulse/v1/tenant/decisions" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/decisions', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/decisions",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

One response decision

GET /pulse/v1/tenant/decisions/{id}

Scope read:pulse. 404 decision_not_found for an unknown or another tenant’s id (indistinguishable).

Authentication: Bearer token (tenantKey), scope read:pulse.

Parameters

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl "https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Withdraw an active response hint

POST /pulse/v1/tenant/decisions/{id}/reverse

Scope write:pulse. The tenant back end marks the decision’s ACTIVE hint as handled or withdrawn, with a closed reasonCode. The reversal is an append-only audit event (actor = the API key id) and is announced by the pulse.response.v1 webhook (transition reversed). Idempotent: an already reversed hint answers 200 and writes nothing. A decision without an active hint (a dry run, a suppressed action, an expired hint) is 409 hint_not_active.

Authentication: Bearer token (tenantKey), scope write:pulse.

Parameters

Request body

Content type application/json, required.

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl -X POST "https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id/reverse" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "reasonCode": "handled"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id/reverse', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    reasonCode: 'handled',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/decisions/example-id/reverse",
    data=json.dumps({
        "reasonCode": "handled",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Issue a one-time link code for one of the tenant’s own users

POST /pulse/v1/tenant/link-codes

Server-to-server, scope write:pulse. The tenant backend (a launcher, a game server) asks for a code for ITS user externalUserId in one of its applications and hands the returned url to that person. The code is shown once, valid 10 minutes, single use; only its SHA-256 is stored. The person opens the URL signed in to their Pulse account, sees the tenant, the application, the masked user id and the data the tenant will see, and approves (the link is the consent receipt) or denies. At most 5 unconsumed codes exist per (application, externalUserId) (429 too_many_outstanding_codes, Retry-After: 600); 30 codes per key per minute and 600 per tenant per hour (429 rate_limited). A user id that already has an active link in that application is 409 external_user_already_linked (unlink it first). Cache-Control: no-store.

Authentication: Bearer token (tenantKey), scope write:pulse.

Request body

Content type application/json, required.

Responses

Response headers

Response fields (201, application/json)

Example request

curl

curl -X POST "https://pulse.noxtica.com/pulse/v1/tenant/link-codes" \
  -H "Authorization: Bearer $NOXTICA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "externalUserId": "example-externalUserId",
  "appId": "example-appId"
}'

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/link-codes', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    externalUserId: 'example-externalUserId',
    appId: 'example-appId',
  }),
});
console.log(response.status, await response.text());

Python (standard library)

import json
import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/link-codes",
    data=json.dumps({
        "externalUserId": "example-externalUserId",
        "appId": "example-appId",
    }).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Read one link of the calling tenant

GET /pulse/v1/tenant/links/{subject}

Scope read:pulse. subject is the pairwise plnk_… (resolves in EVERY state, so an unlink is observable as state: unlinked with unlinkedBy) or the tenant’s own externalUserId (resolves only through its ACTIVE link; 409 ambiguous_subject when it is linked in several applications unless ?appId= names one). Another tenant’s link, an unknown subject and an unlinked externalUserId are the same 404 subject_not_found. The answer never carries an account id, e-mail, psub or device fact. Cache-Control: no-store.

Authentication: Bearer token (tenantKey), scope read:pulse.

Parameters

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl "https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="GET",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

Unlink a player (tenant side)

DELETE /pulse/v1/tenant/links/{subject}

Scope write:pulse. Ends the link (unlinkedBy: tenant): the player’s enrolments of that application lose the binding, the link is audited, and a pulse.enrolment.linked.v1 webhook (transition: unlinked) is queued in the same transaction. Idempotent: an already unlinked link answers 200 with changed: false and writes nothing. Same subject forms, ?appId= rule and 404 subject_not_found as GET. The player can link again with a new code; that creates a NEW plnk_… subject.

Authentication: Bearer token (tenantKey), scope write:pulse.

Parameters

Responses

Response headers

Response fields (200, application/json)

Example request

curl

curl -X DELETE "https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW" \
  -H "Authorization: Bearer $NOXTICA_API_KEY"

Node.js (global fetch, Node 18 or later)

const response = await fetch('https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.NOXTICA_API_KEY}`,
  },
});
console.log(response.status, await response.text());

Python (standard library)

import os
import urllib.request

request = urllib.request.Request(
    "https://pulse.noxtica.com/pulse/v1/tenant/links/plnk_01M4GW6CR553W8AAWXEG17RDJW",
    headers={
        "Authorization": f"Bearer {os.environ['NOXTICA_API_KEY']}",
    },
    method="DELETE",
)
with urllib.request.urlopen(request) as response:
    print(response.status, response.read().decode())

This page is generated from the Noxtica OpenAPI specification release v0.4.0: pulse.yaml version 0.9.0-2026-10-27 (SHA-256 95196a58bb5b). Do not edit it by hand.