Evaluate policies (dry-run)
curl --request POST \
--url https://api.meshqu.com/v1/decisions/evaluate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'X-MeshQu-Tenant-Id: <api-key>' \
--data '
{
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
}
}
'import requests
url = "https://api.meshqu.com/v1/decisions/evaluate"
payload = {
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
}
}
headers = {
"Authorization": "Bearer <token>",
"X-MeshQu-Tenant-Id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
'X-MeshQu-Tenant-Id': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
context: {
decision_type: '<string>',
fields: {},
evidence: [{kind: '<string>', ref: '<string>', hash: '<string>', data: {}}],
metadata: {
actor_id: '<string>',
correlation_id: '<string>',
ip_address: '<string>',
user_agent: '<string>',
timestamp: '2023-11-07T05:31:56Z'
}
},
options: {
snapshot_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
evaluation_time: '2023-11-07T05:31:56Z'
}
})
};
fetch('https://api.meshqu.com/v1/decisions/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.meshqu.com/v1/decisions/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
'decision_type' => '<string>',
'fields' => [
],
'evidence' => [
[
'kind' => '<string>',
'ref' => '<string>',
'hash' => '<string>',
'data' => [
]
]
],
'metadata' => [
'actor_id' => '<string>',
'correlation_id' => '<string>',
'ip_address' => '<string>',
'user_agent' => '<string>',
'timestamp' => '2023-11-07T05:31:56Z'
]
],
'options' => [
'snapshot_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'evaluation_time' => '2023-11-07T05:31:56Z'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"X-MeshQu-Tenant-Id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.meshqu.com/v1/decisions/evaluate"
payload := strings.NewReader("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/decisions/evaluate")
.header("Authorization", "Bearer <token>")
.header("X-MeshQu-Tenant-Id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.meshqu.com/v1/decisions/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}"
response = http.request(request)
puts response.read_body{
"result": {
"decision": "ALLOW",
"violations": [
{
"rule_code": "<string>",
"severity": "low",
"reason": "<string>",
"reason_code": "FIELD_MISSING",
"field": "<string>",
"actual_value": "<unknown>",
"expected_value": "<unknown>",
"details": {},
"policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"is_shadow": true
}
],
"rules_evaluated": 123,
"evaluation_time_ms": 123,
"timestamp": "2023-11-07T05:31:56Z",
"policy_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluated_rules_hash": "<string>",
"integrity_hash": "<string>",
"transparency_anchor": {
"provider": "<string>",
"entry_uuid": "<string>",
"log_index": 123,
"inclusion_proof": {
"hashes": [
"<string>"
],
"log_index": 123,
"root_hash": "<string>",
"tree_size": 123
},
"anchored_at": "2023-11-07T05:31:56Z",
"rekor_public_url": "<string>"
},
"action": {
"type": "<string>",
"reference_id": "<string>",
"metadata": {}
},
"dry_run": true,
"rules_na": 123,
"na_rules": [
{
"rule_code": "<string>",
"when": "<unknown>",
"reason": "<string>"
}
],
"signature": "<string>",
"signature_kid": "<string>",
"signature_algorithm": "<string>",
"receipt_schema_version": 1,
"policy_snapshot_digest": "<string>",
"evidence_manifest_digest": "<string>",
"shadow_converted": true,
"original_decision": "ALLOW",
"is_shadow": true
},
"snapshot": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"hash": "<string>",
"rules_count": 123,
"policies_count": 123,
"cached": true
},
"duration_ms": 123,
"shadow_mode": {
"enabled": true,
"original_decision": "DENY"
},
"governance_source": {
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_name": "<string>",
"level": 1
},
"timing": {
"total_ms": 123,
"snapshot_resolve_ms": 123,
"engine_evaluate_ms": 123,
"source": "cache"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}Decisions
Evaluate policies (dry-run)
Evaluates a decision context against the tenant’s active policies and returns the verdict. This is a preview. It is not a record, and its result is not a receipt.
No decision is recorded. No decision id is returned, no audit event is written, and there is nothing to look up afterwards. Resolving the active policies may append one row to the tenant’s append-only policy-snapshot table — that row records POLICY state, never the context you submitted, and a repeat evaluation against unchanged policies appends nothing.
The result is deliberately unsigned. result.dry_run is true and no signature,
signature_kid or signature_algorithm is emitted, so the bytes of a dry-run result can
never be presented as a receipt — offline, by anyone, at any later date.
Returns:
- result.dry_run: always true on this endpoint, present on no recorded receipt
- result.decision: ALLOW, DENY, REVIEW, or ALERT
- result.violations: Rule violations with details
- result.integrity_hash: SHA-256 over the canonical evaluation payload. Reproducible, so you can recompute it yourself; unsigned, so on its own it attests nothing
- snapshot: the policy state the verdict was read against
options.snapshot_id carries the ratification guard with it: a snapshot pinning a policy
version that is not the active ratified one is refused. To re-derive a decision that was
already recorded, use POST /v1/decisions//replay.
Use POST /v1/decisions/record to evaluate AND record.
POST
/
v1
/
decisions
/
evaluate
Evaluate policies (dry-run)
curl --request POST \
--url https://api.meshqu.com/v1/decisions/evaluate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'X-MeshQu-Tenant-Id: <api-key>' \
--data '
{
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
}
}
'import requests
url = "https://api.meshqu.com/v1/decisions/evaluate"
payload = {
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
}
}
headers = {
"Authorization": "Bearer <token>",
"X-MeshQu-Tenant-Id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
'X-MeshQu-Tenant-Id': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
context: {
decision_type: '<string>',
fields: {},
evidence: [{kind: '<string>', ref: '<string>', hash: '<string>', data: {}}],
metadata: {
actor_id: '<string>',
correlation_id: '<string>',
ip_address: '<string>',
user_agent: '<string>',
timestamp: '2023-11-07T05:31:56Z'
}
},
options: {
snapshot_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
evaluation_time: '2023-11-07T05:31:56Z'
}
})
};
fetch('https://api.meshqu.com/v1/decisions/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.meshqu.com/v1/decisions/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
'decision_type' => '<string>',
'fields' => [
],
'evidence' => [
[
'kind' => '<string>',
'ref' => '<string>',
'hash' => '<string>',
'data' => [
]
]
],
'metadata' => [
'actor_id' => '<string>',
'correlation_id' => '<string>',
'ip_address' => '<string>',
'user_agent' => '<string>',
'timestamp' => '2023-11-07T05:31:56Z'
]
],
'options' => [
'snapshot_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'evaluation_time' => '2023-11-07T05:31:56Z'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"X-MeshQu-Tenant-Id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.meshqu.com/v1/decisions/evaluate"
payload := strings.NewReader("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/decisions/evaluate")
.header("Authorization", "Bearer <token>")
.header("X-MeshQu-Tenant-Id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.meshqu.com/v1/decisions/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n }\n}"
response = http.request(request)
puts response.read_body{
"result": {
"decision": "ALLOW",
"violations": [
{
"rule_code": "<string>",
"severity": "low",
"reason": "<string>",
"reason_code": "FIELD_MISSING",
"field": "<string>",
"actual_value": "<unknown>",
"expected_value": "<unknown>",
"details": {},
"policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"is_shadow": true
}
],
"rules_evaluated": 123,
"evaluation_time_ms": 123,
"timestamp": "2023-11-07T05:31:56Z",
"policy_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluated_rules_hash": "<string>",
"integrity_hash": "<string>",
"transparency_anchor": {
"provider": "<string>",
"entry_uuid": "<string>",
"log_index": 123,
"inclusion_proof": {
"hashes": [
"<string>"
],
"log_index": 123,
"root_hash": "<string>",
"tree_size": 123
},
"anchored_at": "2023-11-07T05:31:56Z",
"rekor_public_url": "<string>"
},
"action": {
"type": "<string>",
"reference_id": "<string>",
"metadata": {}
},
"dry_run": true,
"rules_na": 123,
"na_rules": [
{
"rule_code": "<string>",
"when": "<unknown>",
"reason": "<string>"
}
],
"signature": "<string>",
"signature_kid": "<string>",
"signature_algorithm": "<string>",
"receipt_schema_version": 1,
"policy_snapshot_digest": "<string>",
"evidence_manifest_digest": "<string>",
"shadow_converted": true,
"original_decision": "ALLOW",
"is_shadow": true
},
"snapshot": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"hash": "<string>",
"rules_count": 123,
"policies_count": 123,
"cached": true
},
"duration_ms": 123,
"shadow_mode": {
"enabled": true,
"original_decision": "DENY"
},
"governance_source": {
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_name": "<string>",
"level": 1
},
"timing": {
"total_ms": 123,
"snapshot_resolve_ms": 123,
"engine_evaluate_ms": 123,
"source": "cache"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Body
application/json
Request to evaluate policies against a decision context
Response
Response from policy evaluation endpoint
Response from policy evaluation endpoint
Result of a dry-run policy evaluation — a preview, never a receipt
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Total request duration in milliseconds
Show child attributes
Show child attributes
Attribution of which tenant policies governed this decision
Show child attributes
Show child attributes
Per-phase timing breakdown for the evaluation
Show child attributes
Show child attributes
⌘I