Decide one protected action
curl --request POST \
--url https://api.mudraid.ai/api/v1/adapter/enforcement/decide \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"schema": "<string>",
"decision_id": "<string>",
"requested_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"correlation_id": "<string>",
"presented_authorization": "<string>",
"surface": {
"platform_id": "<string>",
"environment": "<string>",
"canonical_resource_uri": "<string>"
},
"request": {
"transport": "<string>",
"http_method": "<string>",
"path": "<string>"
},
"action": {},
"protected_action": {},
"adapter": {},
"bundle": {},
"evaluation": {},
"evidence": {},
"trace": {},
"token_context": {}
}
'import requests
url = "https://api.mudraid.ai/api/v1/adapter/enforcement/decide"
payload = {
"schema": "<string>",
"decision_id": "<string>",
"requested_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"correlation_id": "<string>",
"presented_authorization": "<string>",
"surface": {
"platform_id": "<string>",
"environment": "<string>",
"canonical_resource_uri": "<string>"
},
"request": {
"transport": "<string>",
"http_method": "<string>",
"path": "<string>"
},
"action": {},
"protected_action": {},
"adapter": {},
"bundle": {},
"evaluation": {},
"evidence": {},
"trace": {},
"token_context": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
schema: '<string>',
decision_id: '<string>',
requested_at: '2023-11-07T05:31:56Z',
deadline_at: '2023-11-07T05:31:56Z',
environment: '<string>',
correlation_id: '<string>',
presented_authorization: '<string>',
surface: {
platform_id: '<string>',
environment: '<string>',
canonical_resource_uri: '<string>'
},
request: {transport: '<string>', http_method: '<string>', path: '<string>'},
action: {},
protected_action: {},
adapter: {},
bundle: {},
evaluation: {},
evidence: {},
trace: {},
token_context: {}
})
};
fetch('https://api.mudraid.ai/api/v1/adapter/enforcement/decide', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.mudraid.ai/api/v1/adapter/enforcement/decide",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'schema' => '<string>',
'decision_id' => '<string>',
'requested_at' => '2023-11-07T05:31:56Z',
'deadline_at' => '2023-11-07T05:31:56Z',
'environment' => '<string>',
'correlation_id' => '<string>',
'presented_authorization' => '<string>',
'surface' => [
'platform_id' => '<string>',
'environment' => '<string>',
'canonical_resource_uri' => '<string>'
],
'request' => [
'transport' => '<string>',
'http_method' => '<string>',
'path' => '<string>'
],
'action' => [
],
'protected_action' => [
],
'adapter' => [
],
'bundle' => [
],
'evaluation' => [
],
'evidence' => [
],
'trace' => [
],
'token_context' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.mudraid.ai/api/v1/adapter/enforcement/decide"
payload := strings.NewReader("{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.mudraid.ai/api/v1/adapter/enforcement/decide")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.mudraid.ai/api/v1/adapter/enforcement/decide")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}"
response = http.request(request)
puts response.read_body{
"schema_version": "2.0",
"decision_id": "<string>",
"outcome": "allow",
"directive": "forward_once",
"reason": {
"primary": "<string>",
"contributing": [
"<string>"
],
"category": "<string>"
},
"decision": "allow",
"evaluation": {},
"effective_authority": {},
"evaluated_policies": [
{
"policy_set_id": "<string>",
"policy_set_version": 123,
"policy_digest": "<string>"
}
],
"decided_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"timings_ms": {},
"telemetry": {},
"correlation_id": "<string>",
"action_executed": false,
"proof_context": {},
"signature": {}
}enforcement
Decide one protected action
Called by an enforcement adapter — the V2 middleware’s
HttpDecideClient, the Node adapter or sidecar, or the Kong plugin —
once per protected action, before the action is forwarded. The adapter
authenticates with its own per-adapter bearer (issued at adapter
registration). The caller’s access token travels separately, inside
the body as presented_authorization; identity, tenant and scopes are
derived only from that verified token, never from other body fields.
The request’s surface claims (surface.canonical_resource_uri,
platform, environment, bundle version and digest) are compared with
what MudraID has registered for the authenticated adapter. Any
authentication or binding failure answers one neutral 401.
The decision runs a fixed gate order: contract → identity/tenant →
authority/delegation → containment → risk → entitlement → governance.
It is deny-closed: an authoritative negative is deny; a missing,
stale, conflicting or unavailable required fact, or a breached
deadline, is not_safely_decided; only a decision where every gate
passes on fresh facts is allow. An allow authorizes one forward
(directive: forward_once); every other outcome carries
directive: block. Adapters treat any non-200 as “could not consult
the authority” and deny.
When the adapter sends an execution snapshot, the decision is bound
to the digest of the exact request bytes it will forward. Decision
responses can carry an RS256 signature; signing is a deployment
setting and is off by default, so do not assume a response is signed.
POST
/
api
/
v1
/
adapter
/
enforcement
/
decide
Decide one protected action
curl --request POST \
--url https://api.mudraid.ai/api/v1/adapter/enforcement/decide \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"schema": "<string>",
"decision_id": "<string>",
"requested_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"correlation_id": "<string>",
"presented_authorization": "<string>",
"surface": {
"platform_id": "<string>",
"environment": "<string>",
"canonical_resource_uri": "<string>"
},
"request": {
"transport": "<string>",
"http_method": "<string>",
"path": "<string>"
},
"action": {},
"protected_action": {},
"adapter": {},
"bundle": {},
"evaluation": {},
"evidence": {},
"trace": {},
"token_context": {}
}
'import requests
url = "https://api.mudraid.ai/api/v1/adapter/enforcement/decide"
payload = {
"schema": "<string>",
"decision_id": "<string>",
"requested_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"environment": "<string>",
"correlation_id": "<string>",
"presented_authorization": "<string>",
"surface": {
"platform_id": "<string>",
"environment": "<string>",
"canonical_resource_uri": "<string>"
},
"request": {
"transport": "<string>",
"http_method": "<string>",
"path": "<string>"
},
"action": {},
"protected_action": {},
"adapter": {},
"bundle": {},
"evaluation": {},
"evidence": {},
"trace": {},
"token_context": {}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
schema: '<string>',
decision_id: '<string>',
requested_at: '2023-11-07T05:31:56Z',
deadline_at: '2023-11-07T05:31:56Z',
environment: '<string>',
correlation_id: '<string>',
presented_authorization: '<string>',
surface: {
platform_id: '<string>',
environment: '<string>',
canonical_resource_uri: '<string>'
},
request: {transport: '<string>', http_method: '<string>', path: '<string>'},
action: {},
protected_action: {},
adapter: {},
bundle: {},
evaluation: {},
evidence: {},
trace: {},
token_context: {}
})
};
fetch('https://api.mudraid.ai/api/v1/adapter/enforcement/decide', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.mudraid.ai/api/v1/adapter/enforcement/decide",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'schema' => '<string>',
'decision_id' => '<string>',
'requested_at' => '2023-11-07T05:31:56Z',
'deadline_at' => '2023-11-07T05:31:56Z',
'environment' => '<string>',
'correlation_id' => '<string>',
'presented_authorization' => '<string>',
'surface' => [
'platform_id' => '<string>',
'environment' => '<string>',
'canonical_resource_uri' => '<string>'
],
'request' => [
'transport' => '<string>',
'http_method' => '<string>',
'path' => '<string>'
],
'action' => [
],
'protected_action' => [
],
'adapter' => [
],
'bundle' => [
],
'evaluation' => [
],
'evidence' => [
],
'trace' => [
],
'token_context' => [
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.mudraid.ai/api/v1/adapter/enforcement/decide"
payload := strings.NewReader("{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.mudraid.ai/api/v1/adapter/enforcement/decide")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.mudraid.ai/api/v1/adapter/enforcement/decide")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"schema\": \"<string>\",\n \"decision_id\": \"<string>\",\n \"requested_at\": \"2023-11-07T05:31:56Z\",\n \"deadline_at\": \"2023-11-07T05:31:56Z\",\n \"environment\": \"<string>\",\n \"correlation_id\": \"<string>\",\n \"presented_authorization\": \"<string>\",\n \"surface\": {\n \"platform_id\": \"<string>\",\n \"environment\": \"<string>\",\n \"canonical_resource_uri\": \"<string>\"\n },\n \"request\": {\n \"transport\": \"<string>\",\n \"http_method\": \"<string>\",\n \"path\": \"<string>\"\n },\n \"action\": {},\n \"protected_action\": {},\n \"adapter\": {},\n \"bundle\": {},\n \"evaluation\": {},\n \"evidence\": {},\n \"trace\": {},\n \"token_context\": {}\n}"
response = http.request(request)
puts response.read_body{
"schema_version": "2.0",
"decision_id": "<string>",
"outcome": "allow",
"directive": "forward_once",
"reason": {
"primary": "<string>",
"contributing": [
"<string>"
],
"category": "<string>"
},
"decision": "allow",
"evaluation": {},
"effective_authority": {},
"evaluated_policies": [
{
"policy_set_id": "<string>",
"policy_set_version": 123,
"policy_digest": "<string>"
}
],
"decided_at": "2023-11-07T05:31:56Z",
"deadline_at": "2023-11-07T05:31:56Z",
"timings_ms": {},
"telemetry": {},
"correlation_id": "<string>",
"action_executed": false,
"proof_context": {},
"signature": {}
}Authorizations
The per-adapter bearer issued when the enforcement adapter is registered.
Body
application/json
Strict, bounded envelope; unknown top-level fields are refused with
422. One of schema_version or schema must name a supported
request contract.
Available options:
mudraid.enforce.decide-request/1, 2.0 Older spelling of schema_version, still read.
Caller-chosen request identity; one durable decision per id.
Clamped to a server ceiling; the server receive time is the decision clock.
The protected request's Authorization header (Bearer <access token>). Without it the decision is deny (credential_missing).
Maximum string length:
8192Show child attributes
Show child attributes
How the protected request arrived (evidence only).
Show child attributes
Show child attributes
The exact bytes the adapter will forward if allowed.
Show child attributes
Show child attributes
The canonical action resolved from the signed bundle:
action_id, action_version, mapping_id, mapping_version,
required_scopes. (protected_action is accepted as an alias.)
Adapter type and version.
Active bundle version and lowercase SHA-256 payload_digest.
Evaluation mode (default live_required).
Evidence fields such as idempotency_key.
Trace fields such as correlation_id.
Accepted for compatibility; its identity fields are ignored.
Response
Decision produced (which may be deny or not_safely_decided)
Available options:
2.0 Available options:
allow, deny, not_safely_decided Available options:
forward_once, block Show child attributes
Show child attributes
Compatibility projection of outcome; not_safely_decided projects to deny.
Available options:
allow, deny Source, versions and per-fact freshness notes behind the decision.
Show child attributes
Show child attributes
Always false — an allow authorizes; it does not execute anything.
Available options:
false The authenticated adapter/action/bundle binding, when the action binding was verified.
RS256 decision signature. Present only when decision signing is enabled.