---
title: "Counts-only pre-deploy gate for the EPIC-KEYS-001A T1 URL policy"
method: GET
path: "/api/v1/admin/endpoint-url-policy"
tags: ["admin"]
---

# Counts-only pre-deploy gate for the EPIC-KEYS-001A T1 URL policy

`GET /api/v1/admin/endpoint-url-policy`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/admin/endpoint-url-policy`
- Auth: none declared

Count stored agent URLs that the T1 credential-carrier policy rejects.

EPIC-KEYS-001A T1 refuses userinfo, query strings, and fragments on every
persisted customer-supplied URL. Rows written *before* that guard can still
carry one, and such a row now reads back as ``null`` and fails dispatch —
so the affected count is a release gate, not a curiosity: a non-zero
``endpoint`` count means real agents stop screening the moment this
deploys.

This exists because host access is forbidden (CLAUDE.md rule #13 / the
diagnostic-endpoint convention): without an HTTP path there is no way to
take this measurement on staging or production at all.

Counts only. It never selects, returns, hashes, logs, or serializes a URL
value, and it touches no credential column — the expressions below are
boolean aggregates, and the response carries integers exclusively.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)