> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inviolet.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Evaluate an agent tool call

> Extracts the intent, matches against published intentions, evaluates
policies, and returns the access decision plus (when allowed) a
short-lived grant.




## OpenAPI

````yaml /openapi.yaml post /v1/intent/evaluate
openapi: 3.1.0
info:
  title: Inviolet Gateway API
  description: |
    Intent-based access control for AI agents. Every endpoint lives under
    `/v1/*` and authenticates via `Authorization: Bearer <api-key>`. Keys
    are provisioned in the UI at `/developer/api-keys`.
  version: 0.6.0
  contact:
    name: Inviolet
    url: https://inviolet.ai
  license:
    name: Proprietary
servers:
  - url: https://gateway.inviolet.ai
    description: Production
  - url: http://localhost:8080
    description: Local development
security:
  - BearerAuth: []
tags:
  - name: Intent
    description: Core evaluation loop.
  - name: Intentions
    description: Declarative intent patterns.
  - name: Approvals
    description: Human-in-the-loop approvals.
  - name: Webhooks
    description: Outbound HMAC-signed event delivery.
paths:
  /v1/intent/evaluate:
    post:
      tags:
        - Intent
      summary: Evaluate an agent tool call
      description: |
        Extracts the intent, matches against published intentions, evaluates
        policies, and returns the access decision plus (when allowed) a
        short-lived grant.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IntentEvaluateRequest'
      responses:
        '200':
          description: Evaluation result.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntentEvaluateResponse'
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing or invalid API key.
components:
  schemas:
    IntentEvaluateRequest:
      type: object
      required:
        - tool_call
      properties:
        user_id:
          type: string
          description: Optional — attributes the evaluation to a user.
        session_id:
          type: string
        conversation_id:
          type: string
        tool_call:
          type: object
          required:
            - name
          properties:
            name:
              type: string
              example: lookup_customer
            arguments:
              type: object
        data_source_id:
          type: string
        shadow_mode:
          type: boolean
          default: false
    IntentEvaluateResponse:
      type: object
      required:
        - outcome
        - intent_label
      properties:
        outcome:
          type: string
          enum:
            - allowed
            - denied
            - pending_approval
            - approved
            - shadow_denied
        intent_event_id:
          type: string
        intent_label:
          type: string
          example: customer_support_lookup
        intent_class:
          type: string
          enum:
            - reporting
            - export
            - admin
            - lookup
            - analysis
            - write
            - other
        confidence:
          type: number
          minimum: 0
          maximum: 1
        data_elements:
          type: array
          items:
            type: string
        shadow_mode:
          type: boolean
        processing_time_ms:
          type: integer
        approval_request_id:
          type: string
          nullable: true
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          example: invalid_request
        message:
          type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: ApiKey
      description: |
        API key minted at /developer/api-keys. Three scopes: `read_only`,
        `policy_write`, `admin`.

````