---
title: "Gateway decide — Authorization Receipt (ALLOW|DENY|REQUIRE_APPROVAL)"
method: POST
path: "/v1/gateway/decide"
tags: ["gateway", "decide", "authorization-receipt", "denial-exchange"]
---

# Gateway decide — Authorization Receipt (ALLOW|DENY|REQUIRE_APPROVAL)

`POST /v1/gateway/decide`

## Request

- Base URL: `https://sqlguard.io`
- URL: `https://sqlguard.io/v1/gateway/decide`
- Auth: none required

Free CI/production change-control magnet. POST sql (+ optional agent_id, source). DENY mints signed denial_receipt with deny_id (source=ci from GitHub Action). Claim via POST /v1/denials/claim. Not a substitute for paid Workday/Session PASS + verify.

## Request body

- object
  - `sql` string, required: Mutating SQL to evaluate
  - `agent_id` string: Agent or CI identity
  - `source` 'ci' | 'api' | 'mcp': Provenance — CI gates send source=ci
  - `purpose` string
  - `scope` string

## Response `200`

ALLOW — optional next.verify/execute links

## Other responses

- `403`: DENY — includes denial_receipt.deny_id + denial_exchange.claim (/v1/denials/claim)
- `409`: REQUIRE_APPROVAL — human override or fail-closed

---

[API](https://skmtc.dev/sqlguard/apis/sqlguard-permission-before-production-writes.md) · [All operations](https://skmtc.dev/sqlguard/apis/sqlguard-permission-before-production-writes/llms.txt) · [OpenAPI document](https://skmtc.dev/sqlguard/apis/sqlguard-permission-before-production-writes/revisions/d164204b4aea?raw)