> ## Documentation Index > Fetch the complete documentation index at: https://docs.meshqu.com/llms.txt > Use this file to discover all available pages before exploring further. # Evaluate policies (dry-run) > Evaluates policies against a decision context without persisting. Returns: - **decision**: ALLOW, DENY, REVIEW, or ALERT - **violations**: Rule violations with details - **integrity_hash**: Cryptographic proof of evaluation - **snapshot**: Policy state used Use POST /v1/decisions/record to evaluate AND persist. ## OpenAPI ````yaml /api/openapi.json post /v1/decisions/evaluate openapi: 3.1.0 info: title: MeshQu API description: >- Governance infrastructure for policy-aware AI decisions. MeshQu does not run tools. It governs decisions about them. version: 1.9.0 contact: name: MeshQu Support email: support@meshqu.com license: name: Proprietary servers: - url: https://api.meshqu.com description: Deployed environment security: - apiKey: [] tenantId: [] tags: - name: Operations description: Health, readiness, metrics, and signing keys - name: Policies description: Policy management - name: Policy Groups description: Policy group management - name: Decisions description: Policy evaluation and recording - name: Chains description: Decision chain verification and sealing - name: Receipts description: Public receipt and bundle retrieval - name: Forms description: Attestation forms and public submission - name: Alerts description: Alert management and webhooks - name: Audit description: Audit log retrieval and verification - name: API Keys description: API key administration - name: Admin description: Tenant and platform administration - name: Dashboard description: Console dashboard data - name: Metrics description: Decision and overview metrics - name: Fields description: Field catalogue - name: Settings description: Tenant settings - name: Rule Creation Logs description: Rule authoring telemetry paths: /v1/decisions/evaluate: post: tags: - Decisions summary: Evaluate policies (dry-run) description: |- Evaluates policies against a decision context without persisting. Returns: - **decision**: ALLOW, DENY, REVIEW, or ALERT - **violations**: Rule violations with details - **integrity_hash**: Cryptographic proof of evaluation - **snapshot**: Policy state used Use POST /v1/decisions/record to evaluate AND persist. operationId: postV1DecisionsEvaluate requestBody: required: true content: application/json: schema: description: Request to evaluate policies against a decision context type: object properties: context: description: Canonical DecisionContext for policy evaluation type: object properties: decision_type: minLength: 1 description: Type of decision being evaluated type: string fields: description: Domain-agnostic field values for evaluation type: object additionalProperties: {} evidence: description: Supporting evidence for the decision type: array items: type: object properties: kind: description: >- Type of evidence (document, graph_query, external_api) type: string ref: description: Reference identifier for the evidence type: string hash: description: Content hash for verification type: string data: description: Additional evidence metadata type: object additionalProperties: {} required: - kind metadata: additionalProperties: true type: object properties: actor_id: description: Actor making the request type: string correlation_id: description: Request correlation ID type: string ip_address: description: IP address of the requestor type: string user_agent: description: User agent string type: string timestamp: format: date-time description: Request timestamp type: string source_artifact: description: Cryptographic binding to a source document type: object properties: type: description: Type of source artifact anyOf: - type: string enum: - PDF - type: string enum: - DOCX - type: string enum: - JSON_PAYLOAD - type: string enum: - IMAGE - type: string enum: - STRING - type: string enum: - OTHER hash: pattern: ^[a-f0-9]{64}$ description: >- SHA-256 hash of the artifact (64 lowercase hex characters) type: string hash_algorithm: description: Hash algorithm used (currently only SHA-256) type: string enum: - SHA-256 reference_id: maxLength: 255 description: Client reference ID for the artifact type: string filename: maxLength: 255 description: Original filename of the artifact type: string byte_size: minimum: 0 description: Size of the artifact in bytes type: integer required: - type - hash - hash_algorithm required: - decision_type - fields options: type: object properties: snapshot_id: format: uuid description: Use specific snapshot for replay (optional) type: string evaluation_time: format: date-time description: Override evaluation time for replay (optional) type: string action: description: Action bound to this decision receipt type: object properties: type: description: >- Type of action authorized (e.g., payment_execute, loan_approve) type: string reference_id: description: Client's reference ID for the action (e.g., INV-88423) type: string metadata: description: Additional action metadata type: object additionalProperties: {} required: - type - reference_id required: - context description: Request to evaluate policies against a decision context responses: '200': description: Response from policy evaluation endpoint content: application/json: schema: description: Response from policy evaluation endpoint type: object properties: result: description: Result of a policy evaluation type: object properties: decision: description: 'Final decision: ALLOW, DENY, REVIEW, or ALERT' anyOf: - type: string enum: - ALLOW - type: string enum: - DENY - type: string enum: - REVIEW - type: string enum: - ALERT violations: description: List of policy violations detected type: array items: type: object properties: rule_code: description: >- Unique code identifying the rule that was violated type: string severity: description: Severity of the violation anyOf: - type: string enum: - low - type: string enum: - medium - type: string enum: - high - type: string enum: - critical reason_code: description: >- Structured reason code for programmatic aggregation anyOf: - type: string enum: - FIELD_MISSING - type: string enum: - FIELD_FORBIDDEN - type: string enum: - FIELD_TOO_SHORT - type: string enum: - DATE_INVALID - type: string enum: - DATE_EXPIRED - type: string enum: - DATE_IN_FUTURE - type: string enum: - DATE_TOO_LATE - type: string enum: - DATE_TOO_EARLY - type: string enum: - DATE_ORDER_VIOLATED - type: string enum: - VALUE_NOT_NUMERIC - type: string enum: - VALUE_BELOW_MIN - type: string enum: - VALUE_ABOVE_MAX - type: string enum: - VALUE_NOT_GREATER_THAN - type: string enum: - VALUE_NOT_LESS_THAN - type: string enum: - VALUE_NOT_ALLOWED - type: string enum: - VALUE_FORBIDDEN - type: string enum: - LIST_MISCONFIGURED reason: description: Human-readable explanation of the violation type: string field: description: Field that triggered the violation type: string actual_value: description: Actual value that caused the violation expected_value: description: Expected value or constraint details: description: Additional violation context type: object additionalProperties: {} policy_id: format: uuid description: Policy ID that owns the violated rule type: string is_shadow: description: >- Whether this violation came from a shadow-mode policy type: boolean required: - rule_code - severity - reason rules_evaluated: description: Number of rules evaluated type: integer rules_na: description: >- Number of rules skipped due to when clause not matching type: integer na_rules: description: Rules that were not applicable due to when clause type: array items: type: object properties: rule_code: description: Rule code that was skipped type: string when: description: The when clause that excluded the rule reason: description: >- Human-readable reason why the rule was not applicable type: string required: - rule_code - when - reason evaluation_time_ms: description: Evaluation duration in milliseconds type: number timestamp: format: date-time description: ISO timestamp of the evaluation type: string policy_snapshot_id: format: uuid description: UUID of the frozen policy snapshot used type: string evaluated_rules_hash: description: >- SHA-256 hash of the evaluated rules (code, condition, severity, when) type: string integrity_hash: description: SHA-256 integrity hash of the entire evaluation type: string signature: description: >- Base64url-encoded Ed25519 signature over the integrity hash type: string signature_kid: description: Key ID of the signing key used type: string signature_algorithm: description: Signature algorithm (ed25519) type: string transparency_anchor: description: >- Sigstore Rekor transparency anchor, null if anchoring failed anyOf: - type: object properties: provider: description: Transparency log provider type: string entry_uuid: description: Rekor entry UUID type: string log_index: description: Rekor log index type: integer inclusion_proof: type: object properties: hashes: type: array items: type: string log_index: type: integer root_hash: type: string tree_size: type: integer required: - hashes - log_index - root_hash - tree_size anchored_at: format: date-time description: When the entry was anchored type: string rekor_public_url: anyOf: - format: uri description: Direct URL to the Rekor entry type: string - type: 'null' required: - provider - entry_uuid - log_index - inclusion_proof - anchored_at - type: 'null' action: description: Action bound to the receipt (null when not bound) anyOf: - description: Action bound to this decision receipt type: object properties: type: description: >- Type of action authorized (e.g., payment_execute, loan_approve) type: string reference_id: description: >- Client's reference ID for the action (e.g., INV-88423) type: string metadata: description: Additional action metadata type: object additionalProperties: {} required: - type - reference_id - type: 'null' receipt_schema_version: description: Receipt envelope schema version (1 = legacy, 2 = RCP2) anyOf: - type: number enum: - 1 - type: number enum: - 2 policy_snapshot_digest: anyOf: - pattern: ^[0-9a-f]{64}$ description: >- SHA-256 hex digest of the canonical policy snapshot type: string - type: 'null' evidence_manifest_digest: anyOf: - pattern: ^[0-9a-f]{64}$ description: >- SHA-256 hex digest of the evidence manifest (if provided) type: string - type: 'null' shadow_converted: description: >- Whether shadow mode converted this decision (DENY suppressed to ALERT because every violation came from a shadow-mode policy). Bound into the integrity hash. type: boolean original_decision: description: >- Decision before shadow-mode conversion (null when no conversion occurred). Bound into the integrity hash. anyOf: - type: string enum: - ALLOW - type: string enum: - DENY - type: string enum: - REVIEW - type: string enum: - ALERT - type: 'null' required: - decision - violations - rules_evaluated - evaluation_time_ms - timestamp - policy_snapshot_id - evaluated_rules_hash - integrity_hash - transparency_anchor - action snapshot: type: object properties: id: format: uuid description: Snapshot UUID type: string hash: description: SHA-256 hash of the snapshot content type: string rules_count: description: Number of rules in the snapshot type: integer policies_count: description: Number of policies in the snapshot type: integer cached: description: Whether the snapshot was reused from cache type: boolean required: - id - hash - rules_count - policies_count - cached duration_ms: description: Total request duration in milliseconds type: number timing: description: Per-phase timing breakdown for the evaluation type: object properties: total_ms: description: Total evaluation duration in milliseconds type: number snapshot_resolve_ms: description: Time to resolve policy snapshot in milliseconds type: number engine_evaluate_ms: description: Time for pure policy engine evaluation in milliseconds type: number source: description: >- Source of the policy snapshot: cache hit or database lookup anyOf: - type: string enum: - cache - type: string enum: - db required: - total_ms - snapshot_resolve_ms - engine_evaluate_ms - source shadow_mode: type: object properties: enabled: description: >- True if policy is in shadow mode (observe but not enforce) type: boolean original_decision: description: >- Original decision before shadow mode conversion (only present if converted) anyOf: - type: string enum: - DENY - type: string enum: - REVIEW required: - enabled governance_source: description: >- Attribution of which tenant policies governed this decision type: object properties: tenant_id: format: uuid description: Tenant ID whose policies governed this decision type: string tenant_name: description: >- Human-readable tenant name (snapshot at evaluation time) type: string level: minimum: 0 description: >- Governance level: 0 = local tenant, 1+ = inherited from parent type: integer required: - tenant_id - tenant_name - level required: - result - snapshot - duration_ms - shadow_mode - governance_source '400': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error '404': description: Default Response content: application/json: schema: type: object properties: error: type: object properties: code: description: Error code type: string message: description: Human-readable message type: string details: description: Additional error details required: - code - message correlation_id: description: Request correlation ID type: string required: - error components: securitySchemes: apiKey: type: http scheme: bearer bearerFormat: mqu_ description: >- MeshQu API key passed as a bearer token: `Authorization: Bearer mqu_…`. Mint one in the console (Settings → API keys). tenantId: type: apiKey name: X-MeshQu-Tenant-Id in: header description: >- Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked. ````