Decisions

Get decision evidence

Retrieve, for every rule of the ruleset version pinned to the decision, its outcome and — for each rule that fired — the evidence: the resolved operands of a comparison, the count / window / threshold of a velocity rule, the entry a blacklist rule matched. The trace uses the same entry shape as simulate.

Evidence is replayed where the input is frozen — the pinned ruleset re-evaluated against the stored payload, deterministically — and captured at decision time where it is not (velocity counters, blacklist matches). Each entry states evidence_source and replay_fidelity. Replay reproduces only what retention preserved: a field whose scope was not retained, or stored in reduced form, is absent to the replayer and the rule abstains on replay (reduced). HMAC outputs and the credential fingerprint do reproduce. Backend rules are never re-invoked. A replayed_verdict that differs from decision is therefore an expected artifact of partial retention, not an error; it is null whenever any entry is reduced or a backend rule participated.

Availability follows the stored payload’s opt-in retention: 200 with retained: false when nothing was kept, 404 for an unknown id.

GET

api

decisions

{id}

evidence

Get decision evidence

curl --request GET \
  --url https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "decision_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "decision": "REVIEW",
  "retained": true,
  "ruleset_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "ruleset_version": 3,
  "schema": {
    "name": "transaction"
  },
  "replayed_at": "2026-08-19T10:16:02Z",
  "replayed_verdict": "REVIEW",
  "trace": [
    {
      "rule_id": "r_amount",
      "name": "High amount",
      "action": "REVIEW",
      "type": "condition",
      "outcome": "fired",
      "evidence_source": "replayed",
      "replay_fidelity": "full",
      "fields": [
        {
          "path": "$.transaction.amount",
          "value": 4900
        }
      ],
      "derivations": {
        "comparison": {
          "operator": "gt",
          "left": {
            "path": "$.transaction.amount",
            "value": 4900
          },
          "right": {
            "path": null,
            "value": 1000
          }
        }
      }
    }
  ]
}

{
  "classifier": "UNAUTHORIZED",
  "code": 401,
  "message": "No valid means of authentication was provided"
}

{
  "classifier": "FORBIDDEN",
  "code": 403,
  "message": "Not allowed to access this resource or feature"
}

{
  "classifier": "NOT_FOUND",
  "code": 404,
  "message": "The requested resource does not exist"
}

Authorizations

Authorization

string

header

required

HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication).

Path Parameters

string

required

Decision ID

Response

Evidence and replay trace, or an explicit not-retained result

Per-rule evidence for a recorded decision, with the replay trace that produced it. The trace uses the same entry vocabulary as the simulation endpoint.

decision

enum<string>

required

The verdict as originally recorded on the decision.

Available options:

ALLOW,

BLOCK,

REVIEW,

PROVISIONAL

decision_id

string<uuid>

required

retained

boolean

required

False when no evidence was kept for this decision. A successful response, not an error.

replayed_at

string<date-time> | null

When this replay ran. Replay is deterministic — repeated calls agree.

replayed_verdict

enum<string> | null

The verdict reconstructed by replaying the pinned ruleset against the frozen payload. Non-null only when every entry in trace replayed at full fidelity and no backend rule participated in the original decision — in that case it equals decision. Null when retained is false, when any referenced field was absent to the replayer (see replay_fidelity), or when the recorded verdict arose through a backend rule, which replay never re-invokes. A null here means "not reconstructible", not "reconstruction failed".

Available options:

ALLOW,

BLOCK,

REVIEW

ruleset_id

string<uuid> | null

The ruleset pinned to the decision and resolved for replay.

ruleset_version

integer | null

The exact version pinned to the decision — not the context's current ACTIVE version.

schema

SchemaBinding · object | null

The (schema, version) the decision was evaluated against. Null when nothing was retained.

Show child attributes

trace

EvidenceTraceEntry · object[] | null

One entry per rule of the pinned ruleset, in published evaluation order. Null when retained is false — replay needs the frozen payload and does not fall back to live inputs. Also null when the decision pinned no ruleset (the block-all safeguard), even though retained is true.

Show child attributes

⌘I

Get decision evidence

curl --request GET \
  --url https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/evidence")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "decision_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "decision": "REVIEW",
  "retained": true,
  "ruleset_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "ruleset_version": 3,
  "schema": {
    "name": "transaction"
  },
  "replayed_at": "2026-08-19T10:16:02Z",
  "replayed_verdict": "REVIEW",
  "trace": [
    {
      "rule_id": "r_amount",
      "name": "High amount",
      "action": "REVIEW",
      "type": "condition",
      "outcome": "fired",
      "evidence_source": "replayed",
      "replay_fidelity": "full",
      "fields": [
        {
          "path": "$.transaction.amount",
          "value": 4900
        }
      ],
      "derivations": {
        "comparison": {
          "operator": "gt",
          "left": {
            "path": "$.transaction.amount",
            "value": 4900
          },
          "right": {
            "path": null,
            "value": 1000
          }
        }
      }
    }
  ]
}

{
  "classifier": "UNAUTHORIZED",
  "code": 401,
  "message": "No valid means of authentication was provided"
}

{
  "classifier": "FORBIDDEN",
  "code": 403,
  "message": "Not allowed to access this resource or feature"
}

{
  "classifier": "NOT_FOUND",
  "code": 404,
  "message": "The requested resource does not exist"
}

Getting Started

Decisions

Lifecycle Events

Admin

Get decision evidence

Authorizations

Path Parameters

Response