---
title: "Inline control-point check"
method: POST
path: "/api/v1/controls/check"
tags: ["Controls"]
---

# Inline control-point check

`POST /api/v1/controls/check`

## Request

- Base URL: `http://dobby-ai.com`
- URL: `http://dobby-ai.com/api/v1/controls/check`
- Auth: HTTP bearer

Ask for a policy verdict on a tool action BEFORE running it. Authenticates an `sk_live_` API key (`Authorization: Bearer` or `X-API-Key`); org/tenant are resolved from the key — never from the body. Requires the `controls:check` scope (`controls:*` and `*` also pass). The HTTP status IS part of the verdict: 200 = pass/redact, 202 = pause_for_approval, 403 = block (all share the verdict body shape). Your own code is the enforcement point — Dobby only decides.

## Request body

- object
  - `tool_name` string, required: The tool/action about to run
  - `tool_arguments` object: Arguments of the attempted action
  - `actor` object: Defaults to {"actor_id": "sdk", "actor_type": "ai_agent"} when omitted
    - `actor_id` string
    - `actor_type` string
    - `actor_name` string
  - `session_id` string
  - `trace_id` string
  - `correlation_id` string: Shared id linking this verdict to LLM-call telemetry — echoed back in the verdict
  - `workflow_id` string
  - `reasoning` object

## Response `200`

Verdict — pass or redact (proceed)

- ControlVerdict: Policy verdict for an inline control-point check. The HTTP status mirrors `action`: 200 pass/redact, 202 pause_for_approval, 403 block.
  - `action` 'pass' | 'block' | 'redact' | 'pause_for_approval'
  - `decision_id` string: Pass this to /api/v1/controls/outcome to close the adherence loop
  - `correlation_id` string: Echo of the request's correlation_id (when provided)
  - `reason` string: Human-readable explanation of the verdict

## Other responses

- `202`: Verdict — pause_for_approval (same body shape)
- `400`: Bad Request - Invalid parameters
- `401`: Unauthorized - Missing or invalid authentication
- `403`: Verdict — block (same body shape; not an auth error). Distinguish a scope denial: a 403 whose body has `error: insufficient_scope` and NO `action` field means the key lacks `controls:check` — grant the scope, do not treat it as a policy block.
- `502`: Policy engine unavailable or returned an unexpected response

---

[API](https://skmtc.dev/dobby-ai/apis/dobby-platform-api.md) · [All operations](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dobby-ai/apis/dobby-platform-api/revisions/398634f0306f?raw)