API Reference

Core runtime endpoints for authorization decisions and evidence. Full field definitions: Runtime Integration Contract.

POST /v1/runtime/evaluate

Canonical runtime authorization. Authenticate with x-api-key. Returns ALLOW, REQUIRE_APPROVAL, or BLOCK. BobSentry does not execute the downstream action.

curl -X POST https://runtime.bobsentry.com/v1/runtime/evaluate \
  -H "x-api-key: $BOBSENTRY_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "action": "deploy_production",
    "agent_id": "infra-agent",
    "action_environment": "PRODUCTION",
    "schema_version": "2026-06",
    "metadata": { "system": "payments" }
  }'

GET /v1/runtime/decisions/:decisionId

Look up a prior decision and its approval_status (for example PENDING, APPROVED, DENIED, EXPIRED). Use the same x-api-key. Evaluation credentials cannot approve; humans resolve approvals in the console.

GET /v1/evidence/:requestId

Retrieve the signed evidence bundle for a decision (decision_id / request id).

Not for evaluate keys

POST /v1/approvals/:ticketId/respond

Platform/console approval respond path. Do not document tenant evaluate credentials as able to self-approve. Prefer the BobSentry console Approvals UI for human authorization.

Legacy POST /v1/decide is not the public integrator contract. Use POST /v1/runtime/evaluate.