Skip to main content
GET
List your application's decisions

Authorizations

X-API-Key
string
header
required

Query Parameters

limit
integer
default:10

Maximum number of records to return in a single page. Must be between 1 and 1000.

Required range: 1 <= x <= 1000
offset
integer | null

Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor.

Required range: x >= 0
cursor
string | null

Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset.

sort
enum<string> | null

decided_at: when it was decided; ties break on the decision's id. Defaults to decided_at desc. The field a list of decisions sorts on.

Available options:
decided_at
sort_direction
enum<string> | null

asc or desc, for every key of the sort. Defaults to the field's own: decided_at desc.

Available options:
asc,
desc
visitor_type
enum<string>[] | null

Only this visitor type. Repeat for several.

What automated visitor is behind a request at a merchant: an AI agent, a crawler, or not yet known.

Available options:
agent,
crawler,
unknown
trust_level
enum<string>[] | null

Only this trust level. Repeat for several.

How strongly the evidence backs a request's identity, strongest first: credentialed (a Baselayer credential), signed (a verified signature such as Web Bot Auth), declared (a User-Agent corroborated by the platform's published IP range), undeclared (nothing backs it).

Available options:
credentialed,
signed,
declared,
undeclared
visit_id
string<uuid>[] | null

Only decisions of this visit; an unknown visit matches none. Repeat for several.

step
string[] | null

Only decisions at this step. Repeat for several.

Maximum string length: 32
Pattern: ^[a-z0-9_]+$
outcome
enum<string>[] | null

Only decisions with this recommendation. Repeat for several.

What a decision recommends for a request: let it through, ask for a stronger credential, or refuse it.

Available options:
allow,
step_up,
block
start_date
string<date> | null

Filter records created on or after this date (format: YYYY-MM-DD).

end_date
string<date> | null

Filter records created on or before this date (format: YYYY-MM-DD).

tz
string
default:UTC

IANA timezone identifier used to interpret start_date and end_date (defaults to UTC).

Examples:

"UTC"

"America/Los_Angeles"

"Europe/London"

Response

Decisions in the requested order.

decision_id
string<uuid>
required

The decision's id.

decided_at
string<date-time>
required

When it was decided.

transport
enum<string>
required

How the visitor reached the merchant.

Available options:
browser,
api,
mcp,
ucp
step
string
required

The step the request mapped to.

Maximum string length: 32
Pattern: ^[a-z0-9_]+$
outcome
enum<string>
required

What the policy recommended.

Available options:
allow,
step_up,
block
enforcement_mode
enum<string>
required

Whether the step enforced it.

Available options:
monitor,
enforce
reasons
enum<string>[]
required

Why it came out as it did.

Why a decision came out as it did.

rule_unsupported means the SDK met a rule it cannot read: the rule never matches and the whole step runs in monitor mode. The browser check answers allow with monitor for a step in monitor mode, and with no_automated_visitor for a person. Values may be added.

Available options:
baselayer_verified,
baselayer_invalid,
web_bot_auth_verified,
web_bot_auth_invalid,
visa_tap_verified,
visa_tap_invalid,
ip_range_match,
rdns_match,
detection_scored,
detection_unavailable,
identity_conflict,
identity_spoofed,
fallback,
no_evidence,
rule_unsupported,
monitor,
no_automated_visitor
policy
AcceptanceDecisionPolicy (v1) · object
required

The policy that decided.

identity
DecisionIdentity (v1) · object
required

Who the visitor was when the policy ran.

evidence
Evidence (v1) · object[]
required

One entry per reader that contributed, raw.

missing_keys
enum<string>[]
required

The keys an enforced step_up found missing from the credential; empty otherwise.

Attestation-primitive keys for an individual.

Values are the KYA spec's wire form (lowercase snake_case); they appear verbatim in minted credentials and on identity snapshots.

Available options:
phone_possession,
email_possession,
dob_identity_match,
ssn_identity_match,
watchlist_clear
merchant_outcome
enum<string> | null

What the merchant did; null when the SDK did not see it, and for a browser check.

Available options:
allow,
step_up,
block
detection
DecisionDetection (v1) · object | null

Null when detection was unavailable.

requirement
DecisionRequirement (v1) · object | null

What a step_up asked for, or what an allow met; null otherwise.

expires_at
string<date-time> | null

When the decision stops applying.

sdk
Sdk (v1) · object | null

The server SDK that decided; null for a browser check, which the KYA service decided.