Read the tenant's recent policy decisions

GET

/v1/policy/decisions

const url = 'https://example.com/v1/policy/decisions?limit=20';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/v1/policy/decisions?limit=20' \
  --header 'Authorization: Bearer <token>'

Returns the calling tenant’s most-recent policy decisions (allow, warn, and deny), newest first — the audit-capture read side (spec 0009). Each row carries the action, the matched rule position, the coarse reason, and the agent/tool it applied to; a request body is never recorded (invariant #3). Tenant-scoped: a tenant only ever sees its own decisions.

Authorizations

oidcBearer

Parameters

Query Parameters

limit

integer

default: 20 >= 1 <= 100

Maximum decisions to return, newest first. Clamped to [1, 100]; defaults to 20.

Responses

200

The tenant’s recent policy decisions.

application/json

The GET /v1/policy/decisions response — recent decisions, newest first.

object

data

required

Array<object>

One recorded policy decision (spec 0009 audit capture). reason is the coarse, rule-position explanation — never call content (invariant #3).

object

required

The pdec_<uuidv7> decision ID (opaque).

string

agent_id

required

The agent the decision applied to.

string

protocol

required

The agent’s protocol (e.g. mcp, http).

string

mcp_tool

The parsed MCP tool the decision applied to; null for protocol=http calls.

string

nullable

action

required

string

Allowed values: allow warn deny

matched_rule

required

The 1-based position of the rule that produced the action, or empty when it came from default/on_error.

string

reason

required

A coarse explanation of the action.

string

created_at

required

string format: date-time

limit

required

The effective limit applied to this response.

integer

Example

{
  "data": [
    {
      "action": "allow"
    }
  ]
}

401

Missing or invalid bearer token, or the token’s tenant/user claims are absent. No body.

500

An unexpected server-side error. No body (internal detail is never returned to callers, invariant