POST /evaluate

Evaluate a tool call against the active policy. Returns an admission decision.

Request

POST /evaluate HTTP/1.1
Host: api.sector8.ai
Authorization: Bearer YOUR_API_KEY
X-Client-ID: YOUR_CLIENT_ID
Content-Type: application/json

{
  "tool_name": "bash",
  "arguments": {
    "command": "cat /etc/passwd"
  },
  "session_id": "session-abc123",
  "user_id": "engineer-42",
  "context": {
    "source": "claude_code",
    "project": "backend"
  }
}

Request fields

Field	Required	Description
tool_name	✓	Tool being called: bash, read_file, write_file, web_fetch, or custom registered tools
arguments	✓	Tool arguments as a JSON object
session_id	✓	Stable session identifier — required for multi-turn escalation scoring
user_id		Engineer or agent identifier for per-user telemetry
context		Additional metadata included in the telemetry record

Response — ALLOW

{
  "decision": "ALLOW",
  "reason_code": null,
  "pre_filter_decision": "PASS",
  "semantic_score": 0.08,
  "semantic_cluster": null,
  "policy_version_id": "0dbca364d66447469637bafa2282e635124fcb99eecd6383038e3b652577ebc7",
  "decision_trace_id": "17e797c0-eb5c-4f97-b4a1-2d3e4f5a6b7c",
  "evidence_hash": null,
  "has_forensic_payload": false
}

Response — DENY

{
  "decision": "DENY",
  "reason_code": "SENSITIVE_PATH_BLOCKED",
  "pre_filter_decision": "BLOCK",
  "semantic_score": 0.94,
  "semantic_cluster": "pii_exfiltration",
  "policy_version_id": "0dbca364d66447469637bafa2282e635124fcb99eecd6383038e3b652577ebc7",
  "decision_trace_id": "32819155-d21a-49c8-9509-79338d980fa9",
  "evidence_hash": "bdbde1558fb883573b0f6e8630ccba1edaf6bed8cb035fa6a48912809149f287",
  "has_forensic_payload": true
}

Response fields

Field	Type	Description
decision	string	"ALLOW" or "DENY"
reason_code	string|null	Machine-readable denial reason. See reason codes.
pre_filter_decision	string	"BLOCK", "PASS", or "REVIEW"
semantic_score	number	0.0–1.0 semantic threat similarity score
semantic_cluster	string|null	Nearest threat cluster when score is significant
policy_version_id	string	Signed policy bundle hash — links decision to policy state
decision_trace_id	string	UUID — links to full admission trace in telemetry
evidence_hash	string|null	SHA-256 of blocked payload. Present on all DENY records.
has_forensic_payload	boolean	true on 100% of DENY records

evidence_hash is a cryptographic hash of the blocked payload. It can be used to verify the contents of a denial record have not been tampered with after the fact.