---
title: "Judge an action before it happens"
method: POST
path: "/inspect"
---

# Judge an action before it happens

`POST /inspect`

## Request

- Base URL: `https://secureai.one/v1`
- URL: `https://secureai.one/v1/inspect`
- Auth: HTTP bearer

Send the tool call the agent was about to make. Returns whether it may proceed, and when the answer is redact, the same arguments with the sensitive values swapped for stand-ins.

Charged as one request against the same allowance as /redact.

## Request body

- InspectRequest
  - `tool` string, required: The action about to be taken.
  - `input` unknown, required
  - `direction` 'outbound' | 'inbound'
  - `agent` string: Names this agent or run so its actions group together in the trail.
  - `approvalId` string: Set when coming back after a person has decided. The action's shape is re-checked, so a yes cannot be spent on a different action.

## Response `200`

A decision.

- Inspection
  - `decision` 'allow' | 'redact' | 'approve' | 'block', required: The most severe decision across every finding. "approve" means a person must decide before this can happen.
  - `input` unknown
  - `map` object, required: {standIn: real}. The only way to restore the reply; not stored here.
  - `findings` Finding[], required
    - `kind` 'secret' | 'card' | 'iban' | 'ssn' | 'govid' | 'email' | 'phone' | 'address' | 'postcode' | 'name' | 'host', required
    - `path` string, required: Dotted path into the action, e.g. "body.customer.email". Empty when the input was a bare string.
    - `decision` 'allow' | 'redact' | 'approve' | 'block', required
  - `toolDenied` boolean, required: True when the tool itself was refused, in which case nothing was inspected.
  - `policySource` 'account' | 'default' | 'unreadable', required
  - `auditId` string, required
  - `approvalId` string: Set when the decision is "approve". Poll /approvals/{id}, then re-submit the same input with this id.
  - `expiresAt` integer: When waiting stops being worth it. Milliseconds since epoch.

## Other responses

- `400`: The request named no tool, carried no input, or gave a direction that is not outbound or inbound.
- `401`: Missing or invalid API key.
- `402`: No API access on this account, or the allowance is spent.
- `413`: The action is larger than 128 KB serialised.
- `429`: This key has reached its monthly spending cap.

---

[API](https://skmtc.dev/secureai/apis/secure-ai.md) · [All operations](https://skmtc.dev/secureai/apis/secure-ai/llms.txt) · [OpenAPI document](https://skmtc.dev/secureai/apis/secure-ai/revisions/6eefd7f53f8b?raw)