Docs/API/API Reference
API Reference
Complete REST API reference for the GovernanceAI gateway. All endpoints require Bearer authentication.
The GovernanceAI REST API is served from the gateway on port 8000. All endpoints under /api/v1/ require an Authorization: Bearer <api_key> header.
http://localhost:8000. For cloud deployments use the URL provided in your organization settings.Authentication
All API calls must include your API key as a Bearer token. Keys are scoped to a project and carry the permissions of the role they were issued under.
Authorization: Bearer gov_live_xxxxxxxxxxxx Content-Type: application/json
POST /api/v1/governance/evaluate
The primary evaluation endpoint. Runs a prompt through the full GovernanceAI pipeline — policy check, risk scoring, DLP scan — and optionally forwards the request to the configured LLM provider.
| Property | Type | Default | Description |
|---|---|---|---|
| prompt | string | — | The prompt text to evaluate. Required unless messages is provided. |
| messages | array | — | Multi-turn conversation array. Overrides prompt. |
| provider | string | openai | Target LLM provider. |
| model | string | gpt-4o | Model identifier. |
| security_profile | string | standard | Security profile slug. |
| dry_run | boolean | false | Skip LLM forwarding; return only the evaluation. |
curl -X POST http://localhost:8000/api/v1/governance/evaluate \
-H "Authorization: Bearer gov_live_xxxx" \
-H "Content-Type: application/json" \
-d '{
"prompt": "What are our Q1 revenue figures?",
"provider": "openai",
"model": "gpt-4o",
"security_profile": "strict",
"dry_run": false
}'{
"decision": "allow", // "allow" | "block" | "warn"
"risk_score": 0.04, // 0.0 (safe) – 1.0 (high risk)
"flags": [], // triggered classifier names
"policy_matched": null, // rule that matched (if blocked)
"dlp_redacted": false, // true if content was modified
"trace_id": "trc_8f3a9d2c",
"latency_ms": 17,
"response": {
"content": "Q1 revenue was $142M...",
"model": "gpt-4o",
"usage": { "prompt_tokens": 28, "completion_tokens": 110 }
}
}GET /api/v1/governance/projects
Returns all projects for the authenticated organization.
POST /api/v1/governance/api-keys
Creates a new API key scoped to a project. Requires admin role.
GET /health
Returns gateway health status. No authentication required. Use for uptime monitoring.
{
"status": "healthy",
"version": "2.4.1",
"services": {
"policy": "ok",
"risk": "ok",
"database": "ok",
"redis": "ok"
}
}Rate limits
API keys are subject to per-minute and per-day rate limits configured on the project. Exceeded limits return 429 Too Many Requests with a Retry-After header.
Live API Playground
Execute real requests against the running gateway and inspect the evaluation response.
Configuration
Live Response Payload
Configure parameters on the left and submit.
Verify evaluate decision, score, and pipeline analysis details.