---
title: "Evaluate bounded workflow signals for possible agent-governance relevance."
method: POST
path: "/v1/public/discovery/diagnose"
---

# Evaluate bounded workflow signals for possible agent-governance relevance.

`POST /v1/public/discovery/diagnose`

## Request

- Base URL: `https://api.getmarrow.ai`
- URL: `https://api.getmarrow.ai/v1/public/discovery/diagnose`
- Auth: none required

Vendor-published optional diagnostic. Accepts only enumerated and boolean workflow signals; raw prompts, source code, credentials, customer data, and free-form descriptions are not accepted.

## Request body

- union
  - object
    - `schema_version` '1.0', required
    - `agent_count` integer, required
    - `actions` string[], required
    - `surfaces` string[]
    - `repeated_workflow` boolean, required
    - `sensitive_data` boolean, required
    - `controls` object, required
      - `human_approval` boolean, required
      - `rollback` boolean, required
      - `proof_pack` boolean, required
      - `outcome_closure` boolean, required
      - `pre_action_gate` boolean, required
    - `discovery_attribution` object, required
      - `placement_id` string, required
      - `retrieval_token` string, required
  - object
    - `schema_version` '1.0', required
    - `profile` 'governance_readiness_v1', required
    - `scenario` 'single_agent' | 'agent_team' | 'production_agent', required
    - `control_evidence` object, required
      - `named_owner` boolean, required
      - `action_policy` boolean, required
      - `risk_gate` boolean, required
      - `proof_capture` boolean, required
      - `outcome_closure` boolean, required
      - `access_scope` boolean, required
      - `review_cadence` boolean, required
    - `discovery_attribution` object, required
      - `placement_id` string, required
      - `retrieval_token` string, required

## Response `200`

Bounded governance relevance assessment.

- object
  - `data` union, required
    - object
      - `schema_version` '1.0', required
      - `vendor` 'Marrow', required
      - `risk_level` 'low' | 'medium' | 'high', required
      - `relevant` boolean, required
      - `missing_controls` string[], required
      - `recommendation` object, required
        - `optional` unknown, required
        - `requires_operator_approval` unknown, required
        - `message` string, required
        - `signup_url` string, uri, required
      - `privacy_boundary` object, required
        - `accepted_data` 'sanitized workflow metadata only', required
        - `raw_request_stored` unknown, required
        - `message` string, required
      - `attribution` object, required
        - `available` boolean, required
        - `diagnostic_id` string, nullable, required
        - `expires_at` string, date-time, nullable, required
        - `placement_id` string
        - `retrieval_id` string
    - object
      - `schema_version` '1.0', required
      - `profile` 'governance_readiness_v1', required
      - `score` integer, required
      - `score_basis` 'declared_baseline_controls', required
      - `risk_band` 'needs_foundation' | 'material_gaps' | 'controlled_with_gaps' | 'baseline_ready', required
      - `controls_present` string[], required
      - `controls_required` string[], required
      - `controls_not_evidenced` string[], required
      - `immediate_next_action` string, required
      - `limitations` string[], required
      - `recommendation` object, required
        - `optional` unknown, required
        - `requires_operator_approval` unknown, required
        - `message` string, required
        - `signup_url` string, uri, required
      - `privacy_boundary` object, required
        - `accepted_data` 'sanitized workflow metadata only', required
        - `raw_request_stored` unknown, required
        - `message` string, required
      - `attribution` object, required
        - `available` boolean, required
        - `diagnostic_id` string, nullable, required
        - `expires_at` string, date-time, nullable, required
        - `placement_id` string
        - `retrieval_id` string

## Other responses

- `400`: Invalid request.
- `401`: Missing or invalid API key.
- `403`: Authenticated identity is not allowed to perform this action.
- `429`: Capacity or fairness limit reached; follow Retry-After when present.

---

[API](https://skmtc.dev/getmarrow/apis/marrow-agent-governance-api.md) · [All operations](https://skmtc.dev/getmarrow/apis/marrow-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getmarrow/apis/marrow-agent-governance-api/revisions/3b29084f6cc5?raw)