Skip to main content
Use evaluate-action when your agent has its own HTTP client and you want Sentrail to make the policy decision, but you handle the actual API call yourself. This is useful for custom pipelines, internal APIs, or tools not yet natively proxied. Base URL: https://<project-ref>.supabase.co/functions/v1/evaluate-action Required scope: evaluate

​
Request

POST /functions/v1/evaluate-action
Authorization: Bearer agk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

​
Body

FieldTypeRequiredDescription
toolstringYesOne of: github, linear, slack, notion, internal_api, mcp
actionstringYesAction string, e.g. pull_request.create
riskLevelstringYeslow, medium, high, or critical
agentIdstringNoAgent identifier
agentNamestringNoHuman-readable agent name
resourceTypestringNoResource type, e.g. pull_request
resourceIdstringNoResource identifier, e.g. owner/repo#42
payloadobjectNoAction payload (truncated in audit log)
requestedBystringNoWho initiated the action
curl -X POST \
  "https://<project-ref>.supabase.co/functions/v1/evaluate-action" \
  -H "Authorization: Bearer agk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "github",
    "action": "pull_request.create",
    "riskLevel": "high",
    "agentId": "my-coding-agent",
    "resourceType": "pull_request",
    "resourceId": "owner/repo",
    "payload": {
      "title": "Add feature X",
      "head": "feature-x",
      "base": "main"
    }
  }'

​
Response

// HTTP 200
{
  "ok": true,
  "decision": "require_approval",
  "reason": "Policy 'Require approval for PRs' matched",
  "matchedPolicyId": "b3c4d5e6-f7a8-9012-bcde-f01234567890",
  "approvalRequestId": "550e8400-e29b-41d4-a716-446655440000",
  "auditLogId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}
FieldTypeDescription
okbooleanAlways true on 200
decisionstringallow, block, or require_approval
reasonstringHuman-readable explanation
matchedPolicyIdstring | nullUUID of the matched policy
approvalRequestIdstring | nullPresent when decision = require_approval
auditLogIdstringUUID of the audit log entry
correlationIdstringUUID linking this to the full request lifecycle

​
Error responses

// HTTP 400 — invalid tool
{ "ok": false, "error": "tool must be one of github, linear, slack, notion, internal_api, mcp" }

// HTTP 400 — invalid riskLevel
{ "ok": false, "error": "riskLevel must be one of low, medium, high, critical" }

// HTTP 400 — missing action
{ "ok": false, "error": "action must be a non-empty string" }

// HTTP 401 — bad key
{ "ok": false, "error": "Invalid or expired API key" }

​
Status codes

CodeMeaning
200Evaluation completed (check decision field)
400Invalid request body
401Invalid or expired API key, or missing evaluate scope
405Method not allowed (only POST is accepted)
500Unexpected server error