Aggregated proxy decisions for compliance review

GET

/agent-roles/{id}/access-review

const url = 'https://your-org.evershell.ai/v1/agent-roles/example/access-review?decision=allow&policy_type=http';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://your-org.evershell.ai/v1/agent-roles/example/access-review?decision=allow&policy_type=http' \
  --header 'Authorization: Bearer <token>'

Permissions: any signed-in caller.

Pivots the audit log into a “what destinations did this role actually hit, and how often” summary. Groups all policy_decision events for the role by (destination, method, path, decision) and surfaces frequency + recency. Use the decision query param to focus on denies or allows; from / to to bound the time window.

Authorizations

bearerAuth

Parameters

Path Parameters

required

string

Query Parameters

decision

string

Allowed values: allow deny

policy_type

string

Allowed values: http dns

from

string format: date-time

Responses

200

application/json

object

entries

required

Array<object>

Aggregated proxy-decision row produced by GET /agent-roles/{id}/access-review. Groups every policy_decision audit event for a role by (destination, method, path, decision) and surfaces frequency + recency.

object

destination

required

string

method

required

string

path

required

string

decision

required

string

Allowed values: allow deny

reason

string

capability_name

string

count

required

integer format: int64

last_seen

required

string format: date-time

Example

{
  "entries": [
    {
      "decision": "allow"
    }
  ]
}

404

Resource not found in the caller’s org

application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}