---
title: "AuthZEN access evaluation (Sanction as PDP)"
method: POST
path: "/access/v1/evaluation"
---

# AuthZEN access evaluation (Sanction as PDP)

`POST /access/v1/evaluation`

## Request

- Base URL: `https://getsanction.com/api`
- URL: `https://getsanction.com/api/access/v1/evaluation`
- Auth: API key in header `x-api-key`

OpenID AuthZEN Authorization API 1.0 single-evaluation endpoint. POST the standard subject/action/resource tuple and receive { decision: boolean } — evaluated against the same engine as /v1/authorize, but decision-only: nothing is persisted, no budget debited, no approval opened (the contract of ?simulate=true). resource.type routes the request: 'tool' → the tool block/allow/escalate ladder; 'spend' and 'provision' → the dollar ladders against live budget state. subject.id must be the authenticated agent's id or name. Echoes X-Request-ID.

## Request body

- AuthZenEvaluationRequest: OpenID AuthZEN 1.0 evaluation request. subject.id must be the authenticated agent's id or name. resource.type selects the ladder: 'tool' (resource.id = tool name), 'spend' (properties: amount_usd required, category), 'provision' (resource.id = resource; properties: amount_usd required, category, quantity, unit_price_usd, line_item). Properties may be set on the resource or the action; action properties win.
  - `subject` AuthZenEntity, required: An AuthZEN subject or resource: a typed identifier with optional properties.
    - `type` string, required
    - `id` string, required
    - `properties` object
  - `action` AuthZenAction, required
    - `name` string, required
    - `properties` object
  - `resource` AuthZenEntity, required: An AuthZEN subject or resource: a typed identifier with optional properties.
    - `type` string, required
    - `id` string, required
    - `properties` object
  - `context` object

## Response `200`

Evaluation result — a deny is HTTP 200 with decision:false

- AuthZenDecision: AuthZEN decision. Per the spec a deny is a successful evaluation: HTTP 200 with decision:false. context carries Sanction's stable machine code (e.g. TOOL_BLOCKED, ESCALATION_REQUIRED, DAILY_BUDGET_EXCEEDED, SUBJECT_MISMATCH), the human reason, and a remediation hint. A would-escalate outcome is decision:false whose remediation names the Sanction endpoint that opens the real approval.
  - `decision` boolean, required
  - `context` object
    - `code` string
    - `reason` string
    - `remediation` string

## Other responses

- `400`: Malformed request (including missing amount_usd for spend/provision)
- `401`: Invalid API key

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)