POST /v1/mcp-proxy/call

​

Request

POST /v1/mcp-proxy/call
Authorization: Bearer <INVIOLET_API_KEY>
X-Inviolet-Mandate: <mandate JWT>
Content-Type: application/json

{
  "action": {
    "surface": "sdk",
    "operation": "postgres.select",
    "arguments": { "table": "contacts", "id": 42 },
    "target_resource": "postgres:contacts"
  },
  "context": { "on_call": true, "geo": "us-west" },
  "audience": "postgres-prod"
}

​

Response (200 OK)

{
  "decision": { "kind": "allow" },
  "mandate": {
    "cred_id": "01J9X3...",
    "prompt_id": "p_01J9X...",
    "intent_id": "intents:customer_support_lookup"
  }
}

​

Possible decision kinds

• allow — proceed
• allow_with_log_extra — proceed; emit extra audit
• allow_with_redact — proceed; mask listed fields
• allow_with_downgrade — proceed with narrower scope
• allow_with_shadow — proceed; mark as shadow-mode
• defer — proceed; queue for batch review
• negotiate — return a suggested narrower request to the agent
• substitute — swap in a different action; response includes replacement_action
• approval — block; request lands in the approval queue
• step_up — block until step-up auth completes
• deny — block; reason + message included
• deny_with_reroute — block; reroute_card_id tells the agent what to try instead

​

Status codes

• 200 — allow / allow_with_*
• 202 — defer / negotiate / substitute
• 428 — approval / step_up
• 403 — deny / deny_with_reroute