API base
All routes below are rooted at the public API base.
https://api.decionis.com/v1Loading…
API documentation
API overview
Decionis exposes a governed API surface for canonical decision evaluation, signal intake, policy encoding, execution handoff, downloadable validation packs, and Decision Dossier verification. Most integrations start with OTP-based onboarding, issue a mapping deployment bundle, persist the returned org API key, and then call /v1/protocol/evaluate-decision. /v1/action-gate/evaluate remains available as a higher-level wrapper when a surface needs a pre-modeled response envelope.
Base URLs
Use the API base for programmatic requests and the docs surface for reference material.
Reference base
Share this docs surface with partner engineering teams.
/docs/apiProduction ingress
Zero-config onboarding starts with public account verification, which returns the onboarding grant and org ID. Then a mapping session is created, and the deployment bundle returns the org API key, connector ID, webhook secret, webhook URL, and current policy version. The first governed partner call should then use POST /v1/protocol/evaluate-decision with that org API key. Live provider traffic can continue through the Decionis-issued webhook, while outbound decision callbacks use the first-class WEBHOOK integration provider.
Packages
Every Decionis package that resolves on npm today, and which one to reach for. Nothing is listed until it installs.
| Package | Purpose | Get it | Status |
|---|---|---|---|
| @decionis/sdkAsk | Ask the hosted protocol for a verdict from your application. | npm install @decionis/sdk | Current |
| @decionis/verifyVerify | Verify a signed Decision Dossier independently, offline. | npx @decionis/verify <proof-bundle url> | Current |
| decionis/governGate CI/CD | Require a verdict before a GitHub workflow step executes. | uses: decionis/govern@v1 | Current |
| @decionis/mcpConnect agents | Gate an agent's tool calls, egress and spending. | npx @decionis/mcp | Current |
| @decionis/surface | Embed the policy and inline guard engine directly. | npm install @decionis/surface | Current |
| @decionis/iso8583 | Gate ISO 8583 payment messages before they settle. | npm install @decionis/iso8583 @decionis/sdk | Current |
| @decionis/aws-lambda-guard | Gate an AWS Lambda or EventBridge Pipes invocation. | npm install @decionis/aws-lambda-guard | Current |
| @decionis/aws-securityhub | Stream signed dossiers into AWS Security Hub. | npm install @decionis/aws-securityhub | Current |
| @decionis/bedrock-guard | Gate an Amazon Bedrock agent action group. | npm install @decionis/bedrock-guard | Current |
| @decionis/langchain | Gate a LangChain tool or LangGraph node. | npm install @decionis/langchain | Current |
| n8n-nodes-decionis | Gate an n8n workflow step. | npm install n8n-nodes-decionis | Current |
| @decionis/sdk-node | The previous name for the application SDK.Use @decionis/sdk instead. | npm install @decionis/sdk | Legacy |
| @decionis/dossier-verify | The previous name for the dossier verifier.Use @decionis/verify instead. | npx @decionis/verify <proof-bundle url> | Legacy |
| @decionis/iso8583-interceptor | The previous name for the ISO 8583 interceptor.Use @decionis/iso8583 instead. | npm install @decionis/iso8583 | Legacy |
Make OAuth and instant webhooks
The Decionis app for Make uses a first-party OAuth flow instead of asking users to copy an org API key. These endpoints are intended and supported specifically for the Make connector.
Zero-config connection
GET /v1/public/auth/make/authorize reuses the active Decionis account session or sends the user through Decionis sign-in, resolves the workspace, and installs the fixed Shadow-mode Make starter policy. POST /v1/public/auth/make/token exchanges the one-time code for a Make-scoped org credential. GET /v1/make/me validates that credential and returns the resolved workspace. Existing pre-release connections can idempotently install the same starter policy with POST /v1/make/policy/bootstrap.
GET https://api.decionis.com/v1/public/auth/make/authorize
POST https://api.decionis.com/v1/public/auth/make/token
GET https://api.decionis.com/v1/make/me
POST https://api.decionis.com/v1/make/policy/bootstrapInstant-trigger lifecycle
POST /v1/make/webhooks stores the Make webhook URL for the authenticated org. DELETE /v1/make/webhooks/:subscriptionId removes it. Protocol evaluations fan out a signed decision.resolved event to every active Make registration.
POST https://api.decionis.com/v1/make/webhooks
DELETE https://api.decionis.com/v1/make/webhooks/<subscription_id>Delivered event contract
The callback body uses type decision.resolved. Every delivery includes x-decionis-event: decision.resolved and x-decionis-delivery-id; x-decionis-signature is included when callback signing is configured. The payload contains the org, dossier, evaluation, idempotency key, protocol outcome, reconciliation status, and occurred_at timestamp.
Starter policy behavior
The fixed Make starter policy runs in Shadow mode: actions below 1,000 currency units return ALLOW, actions from 1,000 through 9,999.99 return ESCALATE, actions at or above 10,000 return BLOCK, and actions without an amount return ESCALATE. Replace it with an approved workspace policy before enforcement.
Canonical decision evaluation
Use the protocol route as the default decision surface once onboarding and deployment-bundle issuance are complete.
Canonical route
POST /v1/protocol/evaluate-decision is the primary route for new governed decision integrations, including the finance CFD workflow pack added for partner broker flows.
https://api.decionis.com/v1/protocol/evaluate-decisionWrapper route
POST /v1/action-gate/evaluate stays available for adapters that want an action-gate-specific response envelope, but it is not the public canonical path for new finance decision use cases.
https://api.decionis.com/v1/action-gate/evaluateRecommended rollout order
OTP verify -> signal mapping session -> deployment bundle -> store the org API key -> call POST /v1/protocol/evaluate-decision. The Decision Evaluation page includes the full Geminix Capital CFD request and response examples.
Resources
These are the primary reference areas for partner integrations.
Auth
API key posture, public routes, and webhook trust requirements.
Decision Evaluation
Canonical /v1/protocol/evaluate-decision payloads, response fields, and wrapper route guidance.
Quickstart
Implementation order for teams adopting Decionis for the first time.
Signal Mapping
Sample-driven zero-config mapping sessions, required fields, and dry-run validation.
Webhooks
Inbound signal ingress plus outbound WEBHOOK callback configuration, trust headers, and retry posture.
Policy Encoding
Versioned policy bundles and execution dispatch artifact submission.
Decision Dossier
Org-scoped dossier retrieval, share-safe public verification, and portable artifacts.
Validation Packs
Org-level evidence exports, manifest hashes, and downloadable regulator-facing bundles.
Evidence Index
One-screen map of supported integrations, enforcement patterns, proof artifacts, and outcome proof pages.
Vertex AI
Shareable OpenAPI import path and verify route for Google Cloud and Vertex AI agent workflows.
| Area | Primary docs path |
|---|---|
| Auth | /docs/auth |
| Decision Evaluation | /docs/decision-evaluation |
| Quickstart | /docs/quickstart |
| Signal Mapping | /docs/signal-mapping |
| Webhooks | /docs/webhooks |
| Policy Encoding | /docs/policy-encoding |
| Decision Dossier | /docs/decision-dossier |
| Validation Packs | /docs/validation-packs |
| Evidence Index | https://decionis.com/evidence |
| Vertex AI | /docs/vertex-ai-extension |
| Vertex Go-Live | /docs/vertex-go-live |
Vertex OpenAPI spec
Use this file as the shareable import artifact for Vertex AI Extension or mirror it into your Google Cloud-controlled storage path.
https://decionis.com/openapi/decionis-vertex-extension-v1.yamlVertex quickstart
This page keeps the current auth model and request flow explicit so partners do not assume Google-specific auth is already required in phase 1.
/docs/vertex-ai-extensionVertex go-live checklist
Use this page once the adapter call is working and you want a production-ready rollout checklist for proof, telemetry, metering, and rollback.
/docs/vertex-go-liveCore endpoints
This is the smallest useful route set for a partner integrating Decionis as a governed decision surface.
POST
/v1/public/auth/register/startPublicRequest the sponsor email OTP that starts self-serve onboarding.
POST
/v1/public/auth/register/verifyPublicVerify the OTP and receive the onboarding grant plus resolved org ID.
POST
/v1/public/pilot/signal-mapping/sessionsOnboarding grant or org API keyCreate a sample-driven mapping session after OTP verify returns the onboarding grant.
curl -X POST https://api.decionis.com/v1/public/pilot/signal-mapping/sessions \
-H "Authorization: Bearer <onboarding_grant>" \
-H "Content-Type: application/json" \
-d '{
"org_id": "<org_uuid>"
}'POST
/v1/public/pilot/signal-mapping/sessions/:sessionId/deployment-bundleOnboarding grant or org API keyIssue the org API key, connector ID, webhook secret, webhook URL, and policy version once the mapping baseline is ready.
curl -X POST https://api.decionis.com/v1/public/pilot/signal-mapping/sessions/<session_id>/deployment-bundle \
-H "Authorization: Bearer <onboarding_grant>" \
-H "Content-Type: application/json" \
-d '{
"provider_key": "partner_webhook",
"workflow_key": "decision_intake",
"source_label": "primary_stream"
}'POST
/v1/orgs/:orgId/integrations/WEBHOOK/connectAPI keyCreate or update the standard outbound decision callback destination for a partner or internal receiver.
curl -X POST https://api.decionis.com/v1/orgs/<org_id>/integrations/WEBHOOK/connect \
-H "Authorization: Bearer dcy_org_xxx" \
-H "Content-Type: application/json" \
-d '{
"config": {
"endpoint_url": "https://partner.example.com/decionis/webhook",
"provider_name": "partner-webhook",
"workflow_id": "decision_intake"
},
"credentials": {
"webhook_secret": "whsec_partner_xxx"
},
"subscriptions": [
{
"event_name": "decisioning.v2.ran",
"is_enabled": true,
"filter": {}
}
]
}'POST
/v1/protocol/evaluate-decisionAPI keyCanonical governed decision route. An org-scoped credential, including a Make OAuth credential, resolves org_id from the bearer token; an explicit matching org_id remains accepted.
curl -X POST https://api.decionis.com/v1/protocol/evaluate-decision -H "Authorization: Bearer dcy_org_xxx" -H "Idempotency-Key: cfd-order-${ORDER_ID}" -H "Content-Type: application/json" -d '{
"org_id": "<org_uuid>",
"decision_type": "CFD_TRADE_EXECUTION",
"amount": 18000,
"risk_score": 0.74,
"objective_profile": "risk_conservative",
"mode": "ENFORCEMENT",
"workflow_key": "cfd_trade_execution",
"vertical_pack": "cfd_trade_execution",
"context": {
"broker": "Geminix Capital",
"instrument": "EURUSD",
"side": "BUY",
"order_type": "MARKET",
"notional": 18000,
"leverage": 12,
"margin_available": 5400,
"stop_loss": 1.0715,
"take_profit": 1.094,
"time_in_force": "GTC",
"approval_path": ["desk_risk", "finance_control"],
"policy_version": "cfd_trade_execution-v1"
}
}'POST
/v1/action-gate/evaluateAPI keyHigher-level wrapper for surfaces that want an action-gate envelope. Use /v1/protocol/evaluate-decision as the default public route when you are integrating a new decision workflow directly.
POST
/v1/protocol/policies/bundlesAPI keySubmit a versioned policy bundle when the integration participates in policy authoring.
POST
/v1/orgs/:orgId/audit-exportsAPI keyQueue a validation pack or downloadable regulator-evidence bundle once the workspace is live.
POST
/v1/google-cloud/vertex/extensions/verifyAPI keyPhase 1 Vertex AI adapter route that normalizes agent intent, invokes Decionis Protocol, and returns a governed verdict plus Decision Dossier verification links.
curl -X POST https://api.decionis.com/v1/google-cloud/vertex/extensions/verify \
-H "Authorization: Bearer dcy_org_xxx" \
-H "Content-Type: application/json" \
-d '{
"org_id": "<org_uuid>",
"decision_type": "TRANSACTION_ROUTING",
"workflow_key": "finance_transaction_routing",
"system_of_record": "SAP",
"intent": {
"action_type": "CREATE_VENDOR_PAYMENT"
}
}'POST
/v1/reader/verifyAPI keyVerify a Decision Dossier reference with an org-scoped credential and return signature validity, signed outcome, and verification metadata.
GET
/v1/public/decision-dossiers/:dossierId/verify?sig=<signature>PublicVerify a Decision Dossier through a share-safe public route without exposing the full org-scoped artifact.
Errors
The docs surface should make failure posture explicit so integrators can recover without support.
| Status | Meaning | Expected action |
|---|---|---|
| 400 | Payload shape or required field mismatch | Fix request shape and retry. |
| 401 | Missing or invalid API credentials | Rotate or supply a valid API key. |
| 403 | Caller is outside org or route trust boundary | Use the correct org-scoped credential or public route. |
| 409 | Artifact version or connector state conflict | Resolve the latest state, then resubmit. |
| 422 | Mapping, policy, or dossier input is semantically invalid | Correct the payload content, not just the syntax. |