--- title: "API overview" description: "Base URLs, authentication, scopes, errors, rate limits, idempotency and pagination for the Noxtica server APIs, generated from the published OpenAPI specifications." canonical_url: "https://noxtica.com/docs/api/" markdown_url: "https://noxtica.com/docs/api/index.md" last_updated: 2026-10-27 published: 2026-10-27 section: "server-apis" section_title: "Server APIs" openapi_release: "v0.4.0" openapi_spec_version: "0.4.0" site: "Noxtica" language: "en" source: markdown --- # API overview The Noxtica server APIs are HTTPS JSON APIs that your own back end calls. These pages are generated from the OpenAPI specifications that Noxtica publishes, so every route, parameter, field and status code listed here comes from the same source as the specification files. The specifications themselves are published as files: [`/docs/api/openapi.json`](https://noxtica.com/docs/api/openapi.json) holds every public operation of the four APIs, and `/docs/api/openapi/.json` holds one API each (`v1`, `kyc`, `pulse`, `mcp`); every file is also served as YAML, at the same address with the YAML extension. Import them into a client generator, an API workspace, or an AI agent. See [Integrate with an AI agent](https://noxtica.com/docs/ai-agents/). Call these APIs from a server you control. A server API key is a secret and must never reach a browser or a mobile app. Availability is account-specific: the modules enabled for your account and the scopes on your key decide which operations you can call. ## Base URLs Send each request to the base URL listed for the API you call. | Environment | Base URL | Key prefix | APIs | | --- | --- | --- | --- | | Production | `https://collect.noxtica.com` | `sk_prod_` | [Identity verification API](https://noxtica.com/docs/api/reference/kyc/), [Risk scoring and agent trust API](https://noxtica.com/docs/api/reference/score/), [Protected actions API](https://noxtica.com/docs/api/reference/protected-actions/), [Device intelligence API](https://noxtica.com/docs/api/reference/device/), [Mobile and device identity API](https://noxtica.com/docs/api/reference/mobile/), [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/), [Observability query API](https://noxtica.com/docs/api/reference/observability/), [Health and public key endpoints](https://noxtica.com/docs/api/reference/status/) | | Production ingest host | `https://ingest.noxtica.com` | | [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/), [Observability query API](https://noxtica.com/docs/api/reference/observability/) | | Production | `https://backoffice.noxtica.com` | | [MCP server](https://noxtica.com/docs/api/reference/mcp/) | | Production (not yet deployed) | `https://pulse.noxtica.com` | | [Pulse tenant API](https://noxtica.com/docs/api/reference/pulse/) | ## Authentication Operations authenticate with the credential named in their section. The credential formats are: | Credential | Header | Used by | | --- | --- | --- | | `ApiKeyAuth` | `Authorization: Bearer sk_` | [Identity verification API](https://noxtica.com/docs/api/reference/kyc/), [Risk scoring and agent trust API](https://noxtica.com/docs/api/reference/score/), [Protected actions API](https://noxtica.com/docs/api/reference/protected-actions/), [Device intelligence API](https://noxtica.com/docs/api/reference/device/), [Mobile and device identity API](https://noxtica.com/docs/api/reference/mobile/), [Observability query API](https://noxtica.com/docs/api/reference/observability/) | | `SessionTokenAuth` | `Authorization: Bearer kycs..` | [Identity verification API](https://noxtica.com/docs/api/reference/kyc/) | | `ApmIngestKeyAuth` | `Authorization: Bearer sk_apm_` | [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/) | | `CodingAgentKeyAuth` | `Authorization: Bearer cak_` | [Observability query API](https://noxtica.com/docs/api/reference/observability/) | | `McpTokenAuth` | `Authorization: Bearer mcp_` | [MCP server](https://noxtica.com/docs/api/reference/mcp/) | | `tenantKey` | `Authorization: Bearer sk_prod_<32 hex>` | [Pulse tenant API](https://noxtica.com/docs/api/reference/pulse/) | See [Authentication](https://noxtica.com/docs/api/authentication/) for key handling and the scope each operation requires. ## Scopes A key can call an operation only if it carries the scope the operation requires. The reference names 22 scopes; the [Authentication](https://noxtica.com/docs/api/authentication/) page lists the operations that need each one. ## Errors Error responses use the HTTP status code and a JSON body that carries a machine-readable code and a request id. See [Errors](https://noxtica.com/docs/api/errors/) for the body, the codes each API returns and how to report a failed request. ## Rate limits A request that exceeds a limit receives status `429` with a `Retry-After` header. See [Rate limits](https://noxtica.com/docs/api/rate-limits/) for how to back off and retry. ## Idempotency These operations accept an `Idempotency-Key` header. Send a new, unique value for each logical operation and the same value when you retry it, so a retry cannot repeat the operation. | Operation | Header | Length | | --- | --- | --- | | [`kycVerify`](https://noxtica.com/docs/api/reference/kyc/#kycVerify) | Required | 8 to 128 characters | | [`kycVerifyBatchSubmit`](https://noxtica.com/docs/api/reference/kyc/#kycVerifyBatchSubmit) | Required | 8 to 128 characters | | [`kycSessionMint`](https://noxtica.com/docs/api/reference/kyc/#kycSessionMint) | Optional | 8 to 128 characters | | [`offlineCaptureBundleAdmit`](https://noxtica.com/docs/api/reference/mobile/#offlineCaptureBundleAdmit) | Required | 8 to 128 characters | ## Pagination These operations return results in pages. Pass the cursor from one response, unchanged, in the `cursor` query parameter of the next request. | Operation | Page size | Cursor in the response | | --- | --- | --- | | [`v1ListDevices`](https://noxtica.com/docs/api/reference/device/#v1ListDevices) | default 50, maximum 200 | `nextCursor` | | [`v1ListAccountDevices`](https://noxtica.com/docs/api/reference/device/#v1ListAccountDevices) | default 50, maximum 200 | `nextCursor` | | [`v1ListEvents`](https://noxtica.com/docs/api/reference/device/#v1ListEvents) | default 50, maximum 200 | `nextCursor` | | [`v1ListVisits`](https://noxtica.com/docs/api/reference/device/#v1ListVisits) | default 50, maximum 200 | `nextCursor` | | [`v1ExportFingerprints`](https://noxtica.com/docs/api/reference/device/#v1ExportFingerprints) | | `X-Noxtica-Export-Next-Cursor`, `next_cursor` | | [`v1ExportEvents`](https://noxtica.com/docs/api/reference/device/#v1ExportEvents) | | `X-Noxtica-Export-Next-Cursor`, `next_cursor` | | [`v1ExportVisits`](https://noxtica.com/docs/api/reference/device/#v1ExportVisits) | | `X-Noxtica-Export-Next-Cursor`, `next_cursor` | | [`v1ExportScoredEvents`](https://noxtica.com/docs/api/reference/device/#v1ExportScoredEvents) | | `X-Noxtica-Export-Next-Cursor` | | [`v1ListLabels`](https://noxtica.com/docs/api/reference/device/#v1ListLabels) | default 50, maximum 200 | `nextCursor` | | [`v1ApmListProjects`](https://noxtica.com/docs/api/reference/observability/#v1ApmListProjects) | default 50, maximum 200 | `next_cursor` | | [`v1ApmListProjectEnvironments`](https://noxtica.com/docs/api/reference/observability/#v1ApmListProjectEnvironments) | default 50, maximum 200 | `next_cursor` | | [`v1ApmSearchTraces`](https://noxtica.com/docs/api/reference/observability/#v1ApmSearchTraces) | default 50, maximum 200 | `next_cursor` | | [`pulseTenantListDecisions`](https://noxtica.com/docs/api/reference/pulse/#pulseTenantListDecisions) | default 50, maximum 200 | `nextCursor` | ## Webhooks Noxtica sends signed webhook deliveries for 11 event types: `kyc.session.completed`, `kyc.session.cancelled`, `kyc.verification.completed`, `kyc.erasure.completed`, `kyc.document.expiry_warning`, `kyc.reverification.due`, `submission.scored`, `risk.high`, `risk.flagged`, `risk.cluster_flagged`, `account.agent_linked`. See [Webhooks](https://noxtica.com/docs/api/webhooks/) for the headers, the signature and the event catalog. ## API reference | API | What it covers | Operations | Credential | | --- | --- | --- | --- | | [Identity verification API](https://noxtica.com/docs/api/reference/kyc/) | Verify identities, run hosted verification sessions, batch and re-verify, store evidence, and receive signed KYC, KYB and KYM webhooks. | 25 | `ApiKeyAuth`, `SessionTokenAuth` | | [Risk scoring and agent trust API](https://noxtica.com/docs/api/reference/score/) | Score a request, look up IP and device reputation, verify AI agents, and mint signed crawler vouchers from your server. | 7 | `ApiKeyAuth` | | [Protected actions API](https://noxtica.com/docs/api/reference/protected-actions/) | Redeem the request id a browser obtains for a protected action (login, signup, checkout) before your server lets the action proceed. | 1 | `ApiKeyAuth` | | [Device intelligence API](https://noxtica.com/docs/api/reference/device/) | Read devices, events and visits, export data, fetch the sealed-results key, write labels, and manage behavioral baselines. | 18 | `ApiKeyAuth` | | [Mobile and device identity API](https://noxtica.com/docs/api/reference/mobile/) | Verify mobile attestation and integrity, deliver app configuration, and manage passkeys, handoff, delegation, recovery, wallet state and offline capture. | 22 | `ApiKeyAuth` | | [Telemetry ingestion API](https://noxtica.com/docs/api/reference/ingest/) | Send OpenTelemetry traces, metrics, logs, profiles and deployment markers with an ingestion key. | 5 | `ApmIngestKeyAuth` | | [Observability query API](https://noxtica.com/docs/api/reference/observability/) | Query projects, traces, services and releases, manage environment policy, run exports and privacy-request lookups, and read recent signals from a coding agent. | 17 | `ApiKeyAuth`, `CodingAgentKeyAuth` | | [MCP server](https://noxtica.com/docs/api/reference/mcp/) | Connect an AI assistant or your own code to your workspace through the Model Context Protocol with a scoped token. | 1 | `McpTokenAuth` | | [Pulse tenant API](https://noxtica.com/docs/api/reference/pulse/) | Read player status and decisions, create link codes, and manage links from your own back end with a tenant API key. | 7 | `tenantKey` | | [Health and public key endpoints](https://noxtica.com/docs/api/reference/status/) | The unauthenticated collector health probe and the public signing-key documents for verifying signed envelopes and Agent Passports offline. | 3 | None | _This page is generated from the Noxtica OpenAPI specification release `v0.4.0`: `kyc.yaml` version `1.2.0-2026-10-27` (SHA-256 `c91a695cfde0`), `mcp.yaml` version `0.1.0-2026-10-27` (SHA-256 `1a4875efa736`), `pulse.yaml` version `0.9.0-2026-10-27` (SHA-256 `95196a58bb5b`), `v1.yaml` version `1.3.0-2026-10-27` (SHA-256 `3fd15257a022`). Do not edit it by hand._