Evaluate policies
curl --request POST \
--url https://api.truthlocks.com/v1/policies/evaluate \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '{
"context": {}
}'import requests
url = "https://api.truthlocks.com/v1/policies/evaluate"
payload = { "context": {} }
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({context: {}})
};
fetch('https://api.truthlocks.com/v1/policies/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/policies/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/policies/evaluate"
payload := strings.NewReader("{\n \"context\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/policies/evaluate")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/policies/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {}\n}"
response = http.request(request)
puts response.read_body{
"decision": "ALLOW",
"matched_policy": "<string>",
"matched_rule": "<string>",
"reason": "<string>"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Policies
Evaluate policy
Simulate a policy evaluation against a sample input to test rules before enforcing them.
POST
/
v1
/
policies
/
evaluate
Evaluate policies
curl --request POST \
--url https://api.truthlocks.com/v1/policies/evaluate \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '{
"context": {}
}'import requests
url = "https://api.truthlocks.com/v1/policies/evaluate"
payload = { "context": {} }
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({context: {}})
};
fetch('https://api.truthlocks.com/v1/policies/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/policies/evaluate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'context' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/policies/evaluate"
payload := strings.NewReader("{\n \"context\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/policies/evaluate")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"context\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/policies/evaluate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"context\": {}\n}"
response = http.request(request)
puts response.read_body{
"decision": "ALLOW",
"matched_policy": "<string>",
"matched_rule": "<string>",
"reason": "<string>"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Evaluates all active policies that match the given action and target against the provided input. Use this endpoint to test how your policies behave before activating them in production.
The response includes which rules matched, whether the request would be allowed, and a
decision_id for audit trail queries.
The
reasons field is only populated when the request is denied. Allowed responses return an empty array. If you previously relied on evaluation_ms for performance monitoring, that field has been removed — query resource_type=policy_decision in the decision audit trail instead.Every evaluation is recorded in the audit log with a SHA-256 hash of the input for tamper-evidence. Use the
decision_id to look up the decision in audit queries.Parameters
string
required
The policy category to evaluate:
MINT, VERIFY, or BUNDLE_EXPORT.string
required
The binding target type:
ISSUER, VERIFICATION_PROFILE, or TENANT_DEFAULT.string
UUID of the specific target. Omit for
TENANT_DEFAULT to evaluate tenant-wide policies.object
required
Key-value pairs representing the request context. Supports dot-notation for nested fields (e.g.,
key.age_days).Common fields include jurisdiction, trust_tier, status, risk_rating, assurance_level, key.age_days, and key.status. See the available fields reference for the full list.Responses
Response fields
| Field | Type | Description |
|---|---|---|
allowed | boolean | Whether the request would be permitted under the current active policies. |
matched_rules | string[] | IDs of rules that matched the input. Empty when no rule matched and the default effect applied. |
reasons | string[] | Explanation of why the request was denied. Always an empty array when allowed is true. |
decision_id | string | Unique identifier for this evaluation. Use it to look up the full decision record in the audit trail. |
Authorizations
API key for machine-to-machine authentication
Body
application/json

