Decisions

Get decision payload

Retrieve the request payload as it stood when the decision was evaluated, redacted per classification marker at write time: any fields keep their value, pii fields keep their path with a [REDACTED] sentinel, pci-pan values are stored as the credential fingerprint, pci-sad is never stored. The store therefore holds no raw PAN or SAD and is available below SAQ_D.

Storage is opt-in per scope and off by default. Your instance configures a retention window per scope (any, pii, pci-pan); the pii and pci-pan windows cannot exceed the instance’s general retention window for that scope. Nothing stored is a normal state: the response is 200 with retained: false. 404 means the decision id is unknown. Storage is asynchronous, so a read immediately after the decision may briefly report retained: false.

GET

api

decisions

{id}

payload

Get decision payload

curl --request GET \
  --url https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "decision_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "retained": true,
  "retained_scopes": [
    "any",
    "pii",
    "pci-pan"
  ],
  "retention_expires_at": "2026-09-18T10:15:30Z",
  "stored_at": "2026-08-19T10:15:30Z",
  "payload": {
    "context": "checkout",
    "credential": {
      "type": "pan",
      "pan": {
        "value": "crd_9f2c1a7e4b3d4f6a8c1e2b3d4f5a6b7c",
        "expiry_month": 7,
        "expiry_year": 2029
      }
    },
    "customer": {
      "id": "[REDACTED]",
      "email": "[REDACTED]"
    },
    "transaction": {
      "amount": 4900,
      "currency": "EUR",
      "reference": "ord_001"
    }
  }
}

{
  "classifier": "UNAUTHORIZED",
  "code": 401,
  "message": "No valid means of authentication was provided"
}

{
  "classifier": "FORBIDDEN",
  "code": 403,
  "message": "Not allowed to access this resource or feature"
}

{
  "classifier": "NOT_FOUND",
  "code": 404,
  "message": "The requested resource does not exist"
}

Authorizations

Authorization

string

header

required

HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication).

Path Parameters

string

required

Decision ID

Response

Stored payload, or an explicit not-retained result

The decision's request payload as stored, with per-scope redactions applied at write time. Retention is opt-in per scope and defaults to zero, so retained is false for most decisions.

decision_id

string<uuid>

required

retained

boolean

required

False when no payload was kept for this decision — the normal state under the default-zero retention. A false result is a successful response, not an error; an unknown decision id returns 404 instead.

payload

object | null

The stored payload, redacted per field scope marker. Null exactly when retained is false. Fields whose scope was not opted into retention are absent entirely, as are pci-sad fields, which are never stored at any retention setting. any fields keep their value; pii fields keep the path with the [REDACTED] sentinel; a pci-pan value is stored as the platform credential fingerprint (crd_…), the same value the decision's credential_fingerprint carries.

retained_scopes

enum<string>[]

The scope markers whose values were retained for this decision, as configured at the time it was evaluated. Empty when retained is false. Enabling retention later does not backfill an earlier decision.

Available options:

any,

pii,

pci-pan

retention_expires_at

string<date-time> | null

When the stored payload is swept. Bounded by the retention ceiling of the narrowest retained scope — an evidence window can never outlive the retention promise made for its own scope. Null when retained is false.

stored_at

string<date-time> | null

⌘I

Get decision payload

curl --request GET \
  --url https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/decisions/{id}/payload")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "decision_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "retained": true,
  "retained_scopes": [
    "any",
    "pii",
    "pci-pan"
  ],
  "retention_expires_at": "2026-09-18T10:15:30Z",
  "stored_at": "2026-08-19T10:15:30Z",
  "payload": {
    "context": "checkout",
    "credential": {
      "type": "pan",
      "pan": {
        "value": "crd_9f2c1a7e4b3d4f6a8c1e2b3d4f5a6b7c",
        "expiry_month": 7,
        "expiry_year": 2029
      }
    },
    "customer": {
      "id": "[REDACTED]",
      "email": "[REDACTED]"
    },
    "transaction": {
      "amount": 4900,
      "currency": "EUR",
      "reference": "ord_001"
    }
  }
}

{
  "classifier": "UNAUTHORIZED",
  "code": 401,
  "message": "No valid means of authentication was provided"
}

{
  "classifier": "FORBIDDEN",
  "code": 403,
  "message": "Not allowed to access this resource or feature"
}

{
  "classifier": "NOT_FOUND",
  "code": 404,
  "message": "The requested resource does not exist"
}

Getting Started

Decisions

Lifecycle Events

Admin

Get decision payload

Authorizations

Path Parameters

Response