Check your rule (Control › Rules) for a protected API route before the handler runs

View as Markdown

POST /api/v1/api-calls/decide · operationId decideApiCall

For developers: your server sends this request with a server key; it is not a button in the dashboard.

The branch of the call's verdict decides: AI agent (any agent evidence) or Unknown; there is no Human branch on this channel. With no saved rule the defaults apply (AI agent: hold for review; Unknown: allow). A Declared name is medium confidence: a Deny becomes a hold unless the site blocks medium confidence. A valid agent token issued with apiRoutes for this route turns a hold into allow; a held call approved in the dashboard or by the step-up endpoint is allowed once within 15 minutes with approvedDecisionId. A hold is returned as decision "review" with a decisionId and a stepUp hint: the dashboard shows it as Held for review; poll GET /api/v1/api-calls/decisions/{decisionId} or settle it with your own step-up. Not authorization.

Authentication

Send Authorization: Bearer YOUR_SERVER_KEY (siteServerKey: Site server key in Authorization: Bearer <key> (the scheme is case-insensitive and required; a bare key is 401). Shown once on creation or rotation. Publishable keys cannot authenticate). Keep the server key in server-only configuration; never send it to a browser.

Request body

Content-Type: application/json (required)

JSON
{
  "method": "POST",
  "route": "/v1/invoices",
  "actionId": "create_invoice",
  "accountId": "acct_456",
  "userId": "usr_123"
}

Responses

Success body fields

Failures are not verdicts. Error bodies follow the Error schema: code is one of bad_request, unauthorized, session_reinit_required, forbidden, not_found, conflict, identity_required, payload_too_large, rate_limited, internal_error, service_unavailable, request_failed, approval_invalid, approval_used, approval_expired, approval_mismatch, step_up_not_held, step_up_mismatch, step_up_settled, step_up_expired, step_up_superseded, agent_tokens_disabled, tool_not_approved, tool_not_read_only. Errors and retries explains each code and what to do.

Example

curl
curl -sS -X POST 'https://app.trytelltale.dev/api/v1/api-calls/decide' \
  -H "Authorization: Bearer $TELLTALE_SERVER_KEY" \
  -H 'Content-Type: application/json' \
  --data '{"method":"POST","route":"/v1/invoices","actionId":"create_invoice","accountId":"acct_456","userId":"usr_123"}'
fetch
const response = await fetch("https://app.trytelltale.dev/api/v1/api-calls/decide", {
  method: "POST",
  headers: {
    Authorization: 'Bearer ' + process.env.TELLTALE_SERVER_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    "method": "POST",
    "route": "/v1/invoices",
    "actionId": "create_invoice",
    "accountId": "acct_456",
    "userId": "usr_123"
  }),
  signal: AbortSignal.timeout(5000)
});
const result = await response.json();

Machine-readable contract: openapi.json. Request builder: the API explorer shows every operation as curl; it sends requests only on a local dashboard.