Evaluate policies
Policies
Evaluate policy
Simulate a policy evaluation against a sample input to test rules before enforcing them.
POST
Evaluate policies
Evaluates all active policies that match the given action and target against the provided input. Use this endpoint to test how your policies behave before activating them in production.
The response includes which rules matched, whether the request would be allowed, and a
decision_id for audit trail queries.
The
reasons field is only populated when the request is denied. Allowed responses return an empty array. If you previously relied on evaluation_ms for performance monitoring, that field has been removed — query resource_type=policy_decision in the decision audit trail instead.Every evaluation is recorded in the audit log with a SHA-256 hash of the input for tamper-evidence. Use the
decision_id to look up the decision in audit queries.Parameters
string
required
The policy category to evaluate:
MINT, VERIFY, or BUNDLE_EXPORT.string
required
The binding target type:
ISSUER, VERIFICATION_PROFILE, or TENANT_DEFAULT.string
UUID of the specific target. Omit for
TENANT_DEFAULT to evaluate tenant-wide policies.object
required
Key-value pairs representing the request context. Supports dot-notation for nested fields (e.g.,
key.age_days).Common fields include jurisdiction, trust_tier, status, risk_rating, assurance_level, key.age_days, and key.status. See the available fields reference for the full list.Responses
Response fields
Authorizations
API key for machine-to-machine authentication
Body
application/json

