> ## Documentation Index > Fetch the complete documentation index at: https://developer.hellgate.io/llms.txt > Use this file to discover all available pages before exploring further. # Get decision payload > Retrieve the request payload as it stood when the decision was evaluated, redacted per classification marker at write time: `any` fields keep their value, `pii` fields keep their path with a `[REDACTED]` sentinel, `pci-pan` values are stored as the credential fingerprint, `pci-sad` is never stored. The store therefore holds no raw PAN or SAD and is available below `SAQ_D`. Storage is opt-in per scope and off by default. Your instance configures a retention window per scope (`any`, `pii`, `pci-pan`); the `pii` and `pci-pan` windows cannot exceed the instance's general retention window for that scope. Nothing stored is a normal state: the response is `200` with `retained: false`. `404` means the decision id is unknown. Storage is asynchronous, so a read immediately after the decision may briefly report `retained: false`. ## OpenAPI ````yaml /products/specter/openapi.yaml get /api/decisions/{id}/payload openapi: 3.1.0 info: contact: email: support@hellgate.io name: Starfish GmbH & Co. KG url: https://hellgate.io/cpa/specter description: Composable decision engine and fraud prevention service. license: name: Hellgate API Terms url: https://hellgate.io/terms-and-conditions title: Specter API version: '1.0' servers: - description: Managed instance of Specter url: https://{instance}.{env}.on-hellgate.cloud variables: instance: default: my-instance description: Your unique instance slug, provided during onboarding. env: default: eu1 description: Deployment environment (currently eu1). security: [] tags: - description: Evaluate transactions and retrieve decision results. name: Decisions - description: Close decisions that were flagged for manual review. name: Resolutions - description: Report payment lifecycle events for a prior decision. name: Lifecycle Events - description: Manage rulesets and their activation lifecycle. name: Rulesets - description: Register and version custom decision-payload schemas. name: Schemas - description: Configure interceptors and intercept live payment requests. name: Interceptors - description: Subscribe to decision and event notifications. name: Webhooks - description: Manage blocked field values. name: Blacklist paths: /api/decisions/{id}/payload: get: tags: - Decisions summary: Get decision payload description: > Retrieve the request payload as it stood when the decision was evaluated, redacted per classification marker at write time: `any` fields keep their value, `pii` fields keep their path with a `[REDACTED]` sentinel, `pci-pan` values are stored as the credential fingerprint, `pci-sad` is never stored. The store therefore holds no raw PAN or SAD and is available below `SAQ_D`. Storage is opt-in per scope and off by default. Your instance configures a retention window per scope (`any`, `pii`, `pci-pan`); the `pii` and `pci-pan` windows cannot exceed the instance's general retention window for that scope. Nothing stored is a normal state: the response is `200` with `retained: false`. `404` means the decision id is unknown. Storage is asynchronous, so a read immediately after the decision may briefly report `retained: false`. operationId: decisions_payload parameters: - description: Decision ID in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/DecisionPayload' description: Stored payload, or an explicit not-retained result '401': content: application/json: schema: $ref: '#/components/schemas/Unauthorized' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/Forbidden' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/NotFound' description: Not found callbacks: {} security: - bearerAuth: [] components: schemas: DecisionPayload: description: >- The decision's request payload as stored, with per-scope redactions applied at write time. Retention is opt-in per scope and defaults to zero, so `retained` is false for most decisions. example: decision_id: 3fa85f64-5717-4562-b3fc-2c963f66afa6 retained: true retained_scopes: - any - pii - pci-pan retention_expires_at: '2026-09-18T10:15:30Z' stored_at: '2026-08-19T10:15:30Z' payload: context: checkout credential: type: pan pan: value: crd_9f2c1a7e4b3d4f6a8c1e2b3d4f5a6b7c expiry_month: 7 expiry_year: 2029 customer: id: '[REDACTED]' email: '[REDACTED]' transaction: amount: 4900 currency: EUR reference: ord_001 properties: decision_id: format: uuid type: string payload: description: >- The stored payload, redacted per field scope marker. Null exactly when `retained` is false. Fields whose scope was not opted into retention are absent entirely, as are `pci-sad` fields, which are never stored at any retention setting. `any` fields keep their value; `pii` fields keep the path with the `[REDACTED]` sentinel; a `pci-pan` value is stored as the platform credential fingerprint (`crd_…`), the same value the decision's `credential_fingerprint` carries. type: - object - 'null' retained: description: >- False when no payload was kept for this decision — the normal state under the default-zero retention. A false result is a successful response, not an error; an unknown decision id returns 404 instead. type: boolean retained_scopes: description: >- The scope markers whose values were retained for this decision, as configured at the time it was evaluated. Empty when `retained` is false. Enabling retention later does not backfill an earlier decision. items: enum: - any - pii - pci-pan type: string type: array retention_expires_at: description: >- When the stored payload is swept. Bounded by the retention ceiling of the narrowest retained scope — an evidence window can never outlive the retention promise made for its own scope. Null when `retained` is false. format: date-time type: - string - 'null' stored_at: format: date-time type: - string - 'null' required: - decision_id - retained title: DecisionPayload type: object Unauthorized: description: No valid authentication was provided. example: classifier: UNAUTHORIZED code: 401 message: No valid means of authentication was provided properties: classifier: enum: - UNAUTHORIZED type: string code: enum: - 401 type: integer message: type: string required: - classifier - code - message title: Unauthorized type: object Forbidden: description: The token lacks the scope required for this operation. example: classifier: FORBIDDEN code: 403 message: Not allowed to access this resource or feature properties: classifier: enum: - FORBIDDEN type: string code: enum: - 403 type: integer message: type: string required: - classifier - code - message title: Forbidden type: object NotFound: description: The requested resource does not exist. example: classifier: NOT_FOUND code: 404 message: The requested resource does not exist properties: classifier: enum: - NOT_FOUND type: string code: enum: - 404 type: integer message: type: string required: - classifier - code - message title: NotFound type: object securitySchemes: bearerAuth: bearerFormat: JWT description: >- HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication). scheme: bearer type: http ````