Run a bounded synthetic case pack against a stored policy version

curl --request POST \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "case_pack": {
    "profile": "meshqu-case-pack/v1",
    "cases": [
      {
        "case_id": "<string>",
        "context": {
          "decision_type": "<string>",
          "fields": {}
        },
        "expected": {
          "disposition": "PROCEED",
          "expected_rule_codes": [
            "<string>"
          ]
        },
        "authored_by": "independent",
        "authored_at": "2023-11-07T05:31:56Z"
      }
    ]
  },
  "evaluation_time": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions"

payload = {
    "case_pack": {
        "profile": "meshqu-case-pack/v1",
        "cases": [
            {
                "case_id": "<string>",
                "context": {
                    "decision_type": "<string>",
                    "fields": {}
                },
                "expected": {
                    "disposition": "PROCEED",
                    "expected_rule_codes": ["<string>"]
                },
                "authored_by": "independent",
                "authored_at": "2023-11-07T05:31:56Z"
            }
        ]
    },
    "evaluation_time": "2023-11-07T05:31:56Z"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    case_pack: {
      profile: 'meshqu-case-pack/v1',
      cases: [
        {
          case_id: '<string>',
          context: {decision_type: '<string>', fields: {}},
          expected: {disposition: 'PROCEED', expected_rule_codes: ['<string>']},
          authored_by: 'independent',
          authored_at: '2023-11-07T05:31:56Z'
        }
      ]
    },
    evaluation_time: '2023-11-07T05:31:56Z'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'case_pack' => [
        'profile' => 'meshqu-case-pack/v1',
        'cases' => [
                [
                                'case_id' => '<string>',
                                'context' => [
                                                                'decision_type' => '<string>',
                                                                'fields' => [
                                                                                                                                
                                                                ]
                                ],
                                'expected' => [
                                                                'disposition' => 'PROCEED',
                                                                'expected_rule_codes' => [
                                                                                                                                '<string>'
                                                                ]
                                ],
                                'authored_by' => 'independent',
                                'authored_at' => '2023-11-07T05:31:56Z'
                ]
        ]
    ],
    'evaluation_time' => '2023-11-07T05:31:56Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions"

	payload := strings.NewReader("{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "synthetic": true,
  "non_billing": true,
  "persisted": false,
  "profile": "meshqu-case-pack/v1",
  "evaluator_version": "<string>",
  "evaluation_time": "2023-11-07T05:31:56Z",
  "executed_at": "2023-11-07T05:31:56Z",
  "results": [
    {
      "case_id": "<string>",
      "expected_disposition": "PROCEED",
      "engine_output": {
        "decision": "<string>",
        "violations": [
          "<unknown>"
        ],
        "na_rules": [
          "<unknown>"
        ],
        "rules_evaluated": 123
      },
      "behavioural_match": "match",
      "notes": "<string>"
    }
  ],
  "summary": {
    "match": 123,
    "mismatch": 123,
    "unrepresentable": 123,
    "not_scored": 123,
    "operational_failure": 123
  },
  "canary": {
    "rejected": false,
    "compared": 123,
    "vacuous": true,
    "coincident_case_ids": [
      "<string>"
    ]
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Policy Review

Run a bounded synthetic case pack against a stored policy version

Executes an independently authored case pack against the rules stored on this policy version, in process, and returns the per-case results.

SYNTHETIC. No decision, receipt, policy snapshot or audit row is created, nothing is signed and nothing is persisted. The response carries no integrity_hash, no signature and no decision id — it is not receipt-shaped and cannot be presented as a real evaluation. Non-billing, and rate-limited under the standard per-tenant/per-key tier.

RECORDS what the stored rules did for each supplied case at the supplied evaluation_time, and how that compares to the case’s expectation.

ESTABLISHES deterministic agreement for the exact cases, rules, context and evaluator version exercised. It does NOT establish completeness beyond those cases, the truth of the case classifications, or source fidelity — the spike found one invented rule and one over-broad rule that oracle execution did not catch.

Five scoring states, not a pass rate. match and mismatch are the scored outcomes. unrepresentable is an expected NOT_APPLICABLE: the evaluator has no verdict for “this policy does not apply”, and its zero-rule ALLOW is retained as engine output rather than promoted to the policy outcome. not_scored is an expected OUT_OF_SCOPE_INSUFFICIENT_EVIDENCE, or a case with no expectation. operational_failure is an evaluator exception for that case — an indeterminate state, never an ALLOW. The summary reports five counts and no ratio, because the states do not roll up.

422 CASE_PACK_CANDIDATE_DERIVED refuses a pack that declares non-independent authorship AND whose every comparable expectation names exactly the rule codes the candidate fires. That check is narrow: it cannot detect a derived pack that declares independent, and coincidence with the firing set is also what a CORRECT independent oracle looks like.

POST

policies

{id}

versions

{version}

case-executions

Run a bounded synthetic case pack against a stored policy version

curl --request POST \
  --url https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-MeshQu-Tenant-Id: <api-key>' \
  --data '
{
  "case_pack": {
    "profile": "meshqu-case-pack/v1",
    "cases": [
      {
        "case_id": "<string>",
        "context": {
          "decision_type": "<string>",
          "fields": {}
        },
        "expected": {
          "disposition": "PROCEED",
          "expected_rule_codes": [
            "<string>"
          ]
        },
        "authored_by": "independent",
        "authored_at": "2023-11-07T05:31:56Z"
      }
    ]
  },
  "evaluation_time": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions"

payload = {
    "case_pack": {
        "profile": "meshqu-case-pack/v1",
        "cases": [
            {
                "case_id": "<string>",
                "context": {
                    "decision_type": "<string>",
                    "fields": {}
                },
                "expected": {
                    "disposition": "PROCEED",
                    "expected_rule_codes": ["<string>"]
                },
                "authored_by": "independent",
                "authored_at": "2023-11-07T05:31:56Z"
            }
        ]
    },
    "evaluation_time": "2023-11-07T05:31:56Z"
}
headers = {
    "Authorization": "Bearer <token>",
    "X-MeshQu-Tenant-Id": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-MeshQu-Tenant-Id': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    case_pack: {
      profile: 'meshqu-case-pack/v1',
      cases: [
        {
          case_id: '<string>',
          context: {decision_type: '<string>', fields: {}},
          expected: {disposition: 'PROCEED', expected_rule_codes: ['<string>']},
          authored_by: 'independent',
          authored_at: '2023-11-07T05:31:56Z'
        }
      ]
    },
    evaluation_time: '2023-11-07T05:31:56Z'
  })
};

fetch('https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'case_pack' => [
        'profile' => 'meshqu-case-pack/v1',
        'cases' => [
                [
                                'case_id' => '<string>',
                                'context' => [
                                                                'decision_type' => '<string>',
                                                                'fields' => [
                                                                                                                                
                                                                ]
                                ],
                                'expected' => [
                                                                'disposition' => 'PROCEED',
                                                                'expected_rule_codes' => [
                                                                                                                                '<string>'
                                                                ]
                                ],
                                'authored_by' => 'independent',
                                'authored_at' => '2023-11-07T05:31:56Z'
                ]
        ]
    ],
    'evaluation_time' => '2023-11-07T05:31:56Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-MeshQu-Tenant-Id: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions"

	payload := strings.NewReader("{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-MeshQu-Tenant-Id", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions")
  .header("Authorization", "Bearer <token>")
  .header("X-MeshQu-Tenant-Id", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.meshqu.com/v1/policies/{id}/versions/{version}/case-executions")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-MeshQu-Tenant-Id"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"case_pack\": {\n    \"profile\": \"meshqu-case-pack/v1\",\n    \"cases\": [\n      {\n        \"case_id\": \"<string>\",\n        \"context\": {\n          \"decision_type\": \"<string>\",\n          \"fields\": {}\n        },\n        \"expected\": {\n          \"disposition\": \"PROCEED\",\n          \"expected_rule_codes\": [\n            \"<string>\"\n          ]\n        },\n        \"authored_by\": \"independent\",\n        \"authored_at\": \"2023-11-07T05:31:56Z\"\n      }\n    ]\n  },\n  \"evaluation_time\": \"2023-11-07T05:31:56Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "synthetic": true,
  "non_billing": true,
  "persisted": false,
  "profile": "meshqu-case-pack/v1",
  "evaluator_version": "<string>",
  "evaluation_time": "2023-11-07T05:31:56Z",
  "executed_at": "2023-11-07T05:31:56Z",
  "results": [
    {
      "case_id": "<string>",
      "expected_disposition": "PROCEED",
      "engine_output": {
        "decision": "<string>",
        "violations": [
          "<unknown>"
        ],
        "na_rules": [
          "<unknown>"
        ],
        "rules_evaluated": 123
      },
      "behavioural_match": "match",
      "notes": "<string>"
    }
  ],
  "summary": {
    "match": 123,
    "mismatch": 123,
    "unrepresentable": 123,
    "not_scored": 123,
    "operational_failure": 123
  },
  "canary": {
    "rejected": false,
    "compared": 123,
    "vacuous": true,
    "coincident_case_ids": [
      "<string>"
    ]
  }
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

{
  "error": {
    "code": "<string>",
    "message": "<string>",
    "details": "<unknown>"
  },
  "correlation_id": "<string>"
}

Authorizations

Authorization

string

header

required

MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).

X-MeshQu-Tenant-Id

string

header

required

Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.

Path Parameters

string<uuid>

required

Policy id.

version

integer

required

Policy version number.

Required range: x >= 1

Body

application/json

case_pack

object

required

Show child attributes

evaluation_time

string<date-time>

required

The evaluation instant. REQUIRED and supplied by the caller, because determinism is the point: same pack + same rules + same evaluation_time gives the same results. A server clock here would make two identical runs differ.

Response

Default Response

synthetic

enum<boolean>

required

Always true. This is a synthetic preview: no decision, receipt, policy snapshot or audit row was created, nothing was signed, and nothing was persisted. It is non-billing and rate-limited under the standard per-tenant/per-key tier.

Available options:

true

non_billing

enum<boolean>

required

Always true. Synthetic case executions are not metered as evaluations.

Available options:

true

persisted

enum<boolean>

required

Always false. Stated as a field rather than only in prose so a client can assert it, and so a future change that began persisting would have to change this literal and every test reading it.

Available options:

false

profile

enum<string>

required

Available options:

meshqu-case-pack/v1

evaluator_version

string

required

Names the SEMANTICS of the shared verdict loop, not a build, package version or deployment.

evaluation_time

string<date-time>

required

executed_at

string<date-time>

required

PRESENTATION metadata. Excluded from the digest-bound projection that occupies the review package's case_execution_results slot, so re-running identical work does not move a package digest.

results

object[]

required

Show child attributes

summary

object

required

Show child attributes

canary

object

required

The candidate-derivation canary verdict for the executed pack. A REJECTED pack never reaches this response — it is a 422. See the 422 description for the heuristic's stated limits.

Show child attributes

Getting Started

Concepts

API Reference

SDK

Guides

Recipes

Security

Meta

Run a bounded synthetic case pack against a stored policy version

Authorizations

Path Parameters

Body

Response