---
title: "Preview /api/request's verdict (a dry run of its one pass)"
method: POST
path: "/api/policies/test"
tags: ["Proxy Mode"]
---

# Preview /api/request's verdict (a dry run of its one pass)

`POST /api/policies/test`

## Request

- Base URL: `https://agent.getaxonflow.com`
- URL: `https://agent.getaxonflow.com/api/policies/test`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/docs/api/policies/test/post.ts> (a function with typed inputs; its response is checked against the schema)

Previews what `POST /api/request` would decide for the authenticated
credential, through the same pass: the same detector evaluation and
the same anchored enforcing seam. A policy is tested against the
engine that enforces it (PRD v11 §1 item 10). It records no decision:
no `audit_logs` row, no enforce-decision count, no circuit-breaker
violation and no signed decision. The shared engine's evaluation that
feeds the pass still counts in its metrics, and where the engine
carries an audit queue a matched block is logged to
`policy_violations`, as before v11.0.0.

**Changed in v11.0.0 (#4253).** It used to preview two legacy passes
and resolve the governance segments of the body's `user_email`. It now
decides for the credential that authenticated the call
(`subject_type` `Client`): on Community as `/api/request` decides a
request that carries no user token; on Enterprise, where
`/api/request` requires a user token, as the credential's service
identity, the way `/api/v1/decide` decides a token-less caller - and
it is refused 401 where the organization requires a user token, as
decide refuses it. `user_email` is accepted and ignored (a body field is not a
principal), `segments_resolved` is no longer in the response, and the
response gains `engine`, `subject_type` and `policy_bundle`. Where the
anchored engine cannot decide, the preview answers 503, as the route
does.

## Request body

- object
  - `query` string, required: Query to preview
  - `user_email` string: Accepted and ignored since v11.0.0 (#4253): the preview is decided for the authenticated credential.
  - `request_type` string: Request type

## Response `200`

The verdict /api/request would give

- PolicyTestResponse: `POST /api/policies/test`'s preview of `/api/request`'s verdict for the authenticated credential (#4253).
  - `blocked` boolean, required
  - `reason` string: The refusal's reason; empty when the preview allows.
  - `triggered_policies` string[], required: The policies the verdict names, the deciding one first. Always an array, empty when nothing triggered.
  - `checks_performed` string[]
  - `processing_time_ms` integer
  - `engine` 'anchored', required
  - `subject_type` string
  - `policy_bundle` string

## Other responses

- `400`: Invalid request body or parameters
- `401`: Missing or invalid authentication. Handler-written 401s use the `{success, error}` envelope; 401s written by the auth middleware use the `{"error": {"code", "message"}}` envelope (JSONError).
- `503`: The anchored engine could not decide the preview (for example, no enforcer is wired in the process): `blocked` is true and `triggered_policies` is `["decision_enforcement_unavailable"]`.

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-agent-api/revisions/34d30fcb7fa1?raw)