Sign in
InOrbit
Docs

API reference

Check an action

Have a token? Manage tokens in the console
POST
/v1/guardrails/check

Check an action an agent is about to take against the account's policies (and a space's): the answer is allow, warn, ask or deny, with each policy that had something to say, why, and where its rule comes from. A policy only ever restricts: a check never grants anything. Nothing is stored. Send the action's shape (the tool, the command, the working directory, the file), never a file's content, a command's output or a secret.

Needs scope decisions:write.

Authorization

bearer
headerAuthorizationBearer <token>

An access token from the identity provider: a person's, or a customer's from the client credentials grant with an API key (developers.inorbit.hr). The gateway verifies it; the audience is iohr-api.

Request Body

iohr.guardrails.v1.CheckRequest; path variables override their fields

application/json
  1. body

iohr.guardrails.v1.CheckRequest

account_id?string
action?

iohr.guardrails.v1.Action

agent?string
space_id?string

Response Body

iohr.guardrails.v1.CheckResponse

application/json
  1. response

iohr.guardrails.v1.CheckResponse

decision*string
evaluated*integer
Formatint32
findings*array<>
import { ApiError, Public } from "@inorbithr/sdk";// Reads INORBIT_TOKEN, or INORBIT_KEY_ID and INORBIT_KEY_SECRET.const api = Public.fromEnv();try {  const { value } = await api.guardrails.check({ agent: "<agent>" });  console.log(value);} catch (e) {  if (!(e instanceof ApiError)) throw e;  console.error(`${e.code}: ${e.problem} (request id ${e.raw.requestId})`);}

npm install @inorbithr/sdk. Calls the package's public surface; an operation newer than your package needs the next release or a client generated for your account. The SDKs.

{  "decision": "string",  "evaluated": 0,  "findings": [    {      "effect": "string",      "outcome": "string",      "policy": "string",      "reason": "string",      "source_kind": "string",      "source_ref": "string"    }  ]}

Get a publisher GET

A publisher's namespace, name, proved domain and whether it is InOrbit, with how many of its listings the account may see. Needs scope `extensions:read`.

List policies GET

The account's guardrail policies, by name: effect, rule, reason and source. Needs scope `decisions:read`.