---
title: "Simulate gateway evaluation against the protection card"
method: POST
path: "/protection/agent/{agent_id}/simulate"
tags: ["Protection"]
---

# Simulate gateway evaluation against the protection card

`POST /protection/agent/{agent_id}/simulate`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/protection/agent/{agent_id}/simulate`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

**Phase-5 deferred stub — does not evaluate anything.** Protection simulation depends on the dedicated protection-policy evaluator, which is not built yet. This endpoint returns a fixed shape: `allowed: "conditional"` with `protection_evaluator_pending_phase_5` in `conditions` and `warn` sub-verdicts, for ANY request body. It never calls the policy engine, so the caller-supplied-tool union and the fail-closed empty-union behaviour documented on `/v1/alignment/agent/{agent_id}/simulate` (MNE-5820) do NOT apply here. Use the alignment simulate endpoint for real governance signals.

## Path parameters

- `agent_id` string, required

## Request body

- object
  - `candidate_input` object: Hypothetical conversation snippet. Any `messages[].toolUses[].name` here is a caller-supplied tool identifier and IS evaluated — unioned with `candidate_tool_call.tool_name` (MNE-5820).
    - `messages` object[]
  - `candidate_tool_call` object: Hypothetical tool invocation. Synthesized into an assistant message with a toolUses block when `candidate_input.messages` is absent.
    - `tool_name` string: A TOOL IDENTIFIER — the name a runtime invokes (`Read`, `Grep`, `Bash`), matched against `capabilities.<name>.tools[]`. NOT a card action (`code_read`, `inference`); those live in `autonomy.bounded_actions` and never match here (MNE-5820). Optional when `candidate_input.messages[].toolUses[]` names a tool instead; if NEITHER does, the response is still 200 but fails closed with `allowed: "false"`.
    - `tool_args` object

## Response `200`

Simulation result.

- object
  - `ok` true, required
  - `resource` 'protection', required
  - `allowed` 'true' | 'false' | 'conditional', required
  - `conditions` string[], required
  - `suggestions` string[], required
  - `gateway_decision` object, required
    - `verdict` 'pass' | 'warn' | 'fail'
    - `violations` object[]
    - `warnings` object[]
    - `missing_receipts` string[]
  - `observer_assessment` object, required
    - `verdict` 'pass' | 'warn' | 'fail'
    - `violations` object[]
    - `warnings` object[]
  - `evaluated_at` string, date-time, required

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)