Evaluate policies (dry-run)
curl --request POST \
--url https://api.meshqu.com/v1/decisions/evaluate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'X-MeshQu-Tenant-Id: <api-key>' \
--data '
{
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
},
"source": "<unknown>"
}
'import requests
url = "https://api.meshqu.com/v1/decisions/evaluate"
payload = {
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
},
"source": "<unknown>"
}
headers = {
"Authorization": "Bearer <token>",
"X-MeshQu-Tenant-Id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
'X-MeshQu-Tenant-Id': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
context: {
decision_type: '<string>',
fields: {},
evidence: [{kind: '<string>', ref: '<string>', hash: '<string>', data: {}}],
metadata: {
actor_id: '<string>',
correlation_id: '<string>',
ip_address: '<string>',
user_agent: '<string>',
timestamp: '2023-11-07T05:31:56Z'
}
},
options: {
snapshot_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
evaluation_time: '2023-11-07T05:31:56Z'
},
source: '<unknown>'
})
};
fetch('https://api.meshqu.com/v1/decisions/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.meshqu.com/v1/decisions/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
'decision_type' => '<string>',
'fields' => [
],
'evidence' => [
[
'kind' => '<string>',
'ref' => '<string>',
'hash' => '<string>',
'data' => [
]
]
],
'metadata' => [
'actor_id' => '<string>',
'correlation_id' => '<string>',
'ip_address' => '<string>',
'user_agent' => '<string>',
'timestamp' => '2023-11-07T05:31:56Z'
]
],
'options' => [
'snapshot_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'evaluation_time' => '2023-11-07T05:31:56Z'
],
'source' => '<unknown>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"X-MeshQu-Tenant-Id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.meshqu.com/v1/decisions/evaluate"
payload := strings.NewReader("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/decisions/evaluate")
.header("Authorization", "Bearer <token>")
.header("X-MeshQu-Tenant-Id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.meshqu.com/v1/decisions/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}"
response = http.request(request)
puts response.read_body{
"result": {
"decision": "ALLOW",
"violations": [
{
"rule_code": "<string>",
"severity": "low",
"reason": "<string>",
"reason_code": "FIELD_MISSING",
"field": "<string>",
"actual_value": "<unknown>",
"expected_value": "<unknown>",
"details": {},
"policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"is_shadow": true
}
],
"rules_evaluated": 123,
"evaluation_time_ms": 123,
"timestamp": "2023-11-07T05:31:56Z",
"policy_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluated_rules_hash": "<string>",
"integrity_hash": "<string>",
"transparency_anchor": {
"provider": "<string>",
"entry_uuid": "<string>",
"log_index": 123,
"inclusion_proof": {
"hashes": [
"<string>"
],
"log_index": 123,
"root_hash": "<string>",
"tree_size": 123
},
"anchored_at": "2023-11-07T05:31:56Z",
"rekor_public_url": "<string>"
},
"action": {
"type": "<string>",
"reference_id": "<string>",
"metadata": {}
},
"dry_run": true,
"rules_na": 123,
"na_rules": [
{
"rule_code": "<string>",
"reason": "<string>",
"when": "<unknown>"
}
],
"signature": "<string>",
"signature_kid": "<string>",
"signature_algorithm": "<string>",
"receipt_schema_version": 1,
"policy_snapshot_digest": "<string>",
"evidence_manifest_digest": "<string>",
"shadow_converted": true,
"original_decision": "ALLOW",
"is_shadow": true
},
"snapshot": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"hash": "<string>",
"rules_count": 123,
"policies_count": 123,
"cached": true
},
"duration_ms": 123,
"shadow_mode": {
"enabled": true,
"original_decision": "DENY"
},
"governance_source": {
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_name": "<string>",
"level": 1
},
"timing": {
"total_ms": 123,
"snapshot_resolve_ms": 123,
"engine_evaluate_ms": 123,
"source": "cache"
},
"governance_coverage": {
"coverage": "NO_ACTIVE_RULES",
"permission_established": false,
"cryptographically_established": true,
"detail": "<string>"
},
"rule_sources": {}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}Decisions
Evaluate policies (dry-run)
Evaluates a decision context against the tenant’s active policies and returns the verdict. This is a preview. It is not a record, and its result is not a receipt.
No decision is recorded. No decision id is returned, no audit event is written, and there is nothing to look up afterwards. This endpoint does not store the decision context you submit. Policy state may be resolved or snapshotted to produce the result.
The result is deliberately unsigned. result.dry_run is true and no signature,
signature_kid or signature_algorithm is emitted, so the bytes of a dry-run result can
never be presented as a receipt — offline, by anyone, at any later date.
Returns:
- result.dry_run: always true on this endpoint, present on no recorded receipt
- result.decision: ALLOW, DENY, REVIEW, or ALERT
- result.violations: Rule violations with details
- result.integrity_hash: SHA-256 over the canonical evaluation payload. Reproducible, so you can recompute it yourself; unsigned, so on its own it attests nothing
- snapshot: the policy state the verdict was read against
options.snapshot_id carries the ratification guard with it: a snapshot pinning a policy
version that is not the active ratified one is refused. To re-derive a decision that was
already recorded, use POST /v1/decisions//replay.
Use POST /v1/decisions/record to evaluate AND record.
POST
/
v1
/
decisions
/
evaluate
Evaluate policies (dry-run)
curl --request POST \
--url https://api.meshqu.com/v1/decisions/evaluate \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'X-MeshQu-Tenant-Id: <api-key>' \
--data '
{
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
},
"source": "<unknown>"
}
'import requests
url = "https://api.meshqu.com/v1/decisions/evaluate"
payload = {
"context": {
"decision_type": "<string>",
"fields": {},
"evidence": [
{
"kind": "<string>",
"ref": "<string>",
"hash": "<string>",
"data": {}
}
],
"metadata": {
"actor_id": "<string>",
"correlation_id": "<string>",
"ip_address": "<string>",
"user_agent": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
},
"options": {
"snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluation_time": "2023-11-07T05:31:56Z"
},
"source": "<unknown>"
}
headers = {
"Authorization": "Bearer <token>",
"X-MeshQu-Tenant-Id": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
'X-MeshQu-Tenant-Id': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
context: {
decision_type: '<string>',
fields: {},
evidence: [{kind: '<string>', ref: '<string>', hash: '<string>', data: {}}],
metadata: {
actor_id: '<string>',
correlation_id: '<string>',
ip_address: '<string>',
user_agent: '<string>',
timestamp: '2023-11-07T05:31:56Z'
}
},
options: {
snapshot_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
evaluation_time: '2023-11-07T05:31:56Z'
},
source: '<unknown>'
})
};
fetch('https://api.meshqu.com/v1/decisions/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.meshqu.com/v1/decisions/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
'decision_type' => '<string>',
'fields' => [
],
'evidence' => [
[
'kind' => '<string>',
'ref' => '<string>',
'hash' => '<string>',
'data' => [
]
]
],
'metadata' => [
'actor_id' => '<string>',
'correlation_id' => '<string>',
'ip_address' => '<string>',
'user_agent' => '<string>',
'timestamp' => '2023-11-07T05:31:56Z'
]
],
'options' => [
'snapshot_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'evaluation_time' => '2023-11-07T05:31:56Z'
],
'source' => '<unknown>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"X-MeshQu-Tenant-Id: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.meshqu.com/v1/decisions/evaluate"
payload := strings.NewReader("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/decisions/evaluate")
.header("Authorization", "Bearer <token>")
.header("X-MeshQu-Tenant-Id", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.meshqu.com/v1/decisions/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {\n \"decision_type\": \"<string>\",\n \"fields\": {},\n \"evidence\": [\n {\n \"kind\": \"<string>\",\n \"ref\": \"<string>\",\n \"hash\": \"<string>\",\n \"data\": {}\n }\n ],\n \"metadata\": {\n \"actor_id\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"ip_address\": \"<string>\",\n \"user_agent\": \"<string>\",\n \"timestamp\": \"2023-11-07T05:31:56Z\"\n }\n },\n \"options\": {\n \"snapshot_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n },\n \"source\": \"<unknown>\"\n}"
response = http.request(request)
puts response.read_body{
"result": {
"decision": "ALLOW",
"violations": [
{
"rule_code": "<string>",
"severity": "low",
"reason": "<string>",
"reason_code": "FIELD_MISSING",
"field": "<string>",
"actual_value": "<unknown>",
"expected_value": "<unknown>",
"details": {},
"policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"is_shadow": true
}
],
"rules_evaluated": 123,
"evaluation_time_ms": 123,
"timestamp": "2023-11-07T05:31:56Z",
"policy_snapshot_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"evaluated_rules_hash": "<string>",
"integrity_hash": "<string>",
"transparency_anchor": {
"provider": "<string>",
"entry_uuid": "<string>",
"log_index": 123,
"inclusion_proof": {
"hashes": [
"<string>"
],
"log_index": 123,
"root_hash": "<string>",
"tree_size": 123
},
"anchored_at": "2023-11-07T05:31:56Z",
"rekor_public_url": "<string>"
},
"action": {
"type": "<string>",
"reference_id": "<string>",
"metadata": {}
},
"dry_run": true,
"rules_na": 123,
"na_rules": [
{
"rule_code": "<string>",
"reason": "<string>",
"when": "<unknown>"
}
],
"signature": "<string>",
"signature_kid": "<string>",
"signature_algorithm": "<string>",
"receipt_schema_version": 1,
"policy_snapshot_digest": "<string>",
"evidence_manifest_digest": "<string>",
"shadow_converted": true,
"original_decision": "ALLOW",
"is_shadow": true
},
"snapshot": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"hash": "<string>",
"rules_count": 123,
"policies_count": 123,
"cached": true
},
"duration_ms": 123,
"shadow_mode": {
"enabled": true,
"original_decision": "DENY"
},
"governance_source": {
"tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"tenant_name": "<string>",
"level": 1
},
"timing": {
"total_ms": 123,
"snapshot_resolve_ms": 123,
"engine_evaluate_ms": 123,
"source": "cache"
},
"governance_coverage": {
"coverage": "NO_ACTIVE_RULES",
"permission_established": false,
"cryptographically_established": true,
"detail": "<string>"
},
"rule_sources": {}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": "<unknown>"
},
"correlation_id": "<string>"
}Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on authenticated routes. A missing or non-UUID value returns 400 MISSING_TENANT_ID or INVALID_TENANT_ID before API-key authentication.
Body
application/json
Request to evaluate policies against a decision context
Response
Response from policy evaluation endpoint
Response from policy evaluation endpoint
Result of a dry-run policy evaluation — a preview, never a receipt
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Total request duration in milliseconds
Show child attributes
Show child attributes
Attribution of which tenant policies governed this decision
Show child attributes
Show child attributes
Per-phase timing breakdown for the evaluation
Show child attributes
Show child attributes
UNSIGNED response-envelope advisory, not a receipt field. Present only when no applicable rule was evaluated. Stripping it does not change the signed payload; treating its absence as permission is a client error.
Show child attributes
Show child attributes
Rule code to the source reference its author recorded. Present only when at least one rule in the governing snapshot carries one. Not part of the signed result: join it to violations[].rule_code or na_rules[].rule_code.
Show child attributes
Show child attributes
⌘I