Controls

Inline control-point check

Ask for a policy verdict on a tool action BEFORE running it. Authenticates an sk_live_ API key (Authorization: Bearer or X-API-Key); org/tenant are resolved from the key — never from the body. Requires the controls:check scope (controls:* and * also pass). The HTTP status IS part of the verdict: 200 = pass/redact, 202 = pause_for_approval, 403 = block (all share the verdict body shape). Your own code is the enforcement point — Dobby only decides.

post/api/v1/controls/check

Request

Base URL: http://dobby-ai.com
URL: http://dobby-ai.com/api/v1/controls/check
Auth: HTTP bearer

Request body

tool_namestring required

The tool/action about to run

tool_argumentsobject

Arguments of the attempted action

session_idstring

trace_idstring

correlation_idstring

Shared id linking this verdict to LLM-call telemetry — echoed back in the verdict

workflow_idstring

reasoningobject

Example request

{
  "tool_name": "send_external_email",
  "tool_arguments": {
    "to": "someone@example.com"
  },
  "actor": {
    "actor_id": "billing-agent",
    "actor_type": "ai_agent"
  }
}

Response

Verdict — pass or redact (proceed)

action'pass' | 'block' | 'redact' | 'pause_for_approval'

decision_idstring

Pass this to /api/v1/controls/outcome to close the adherence loop

correlation_idstring

Echo of the request's correlation_id (when provided)

reasonstring

Human-readable explanation of the verdict

Example response

{
  "action": "block",
  "decision_id": "dec_abc123def456",
  "reason": "Blocked by tenant policy: no external email with PII"
}

Changes

No recorded changes to this operation across all 1 revision of this API.