rules_test
const url = 'https://example.com/v1/rules/test';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"id":"example","title":"example","tool":"example","callback_url":"example","summary":"example","source":{"integration":null,"agent":null,"session":null,"session_title":null,"cwd":null,"repo":null,"branch":null,"host":null},"kind":"command","risk":"low","previews":[{"type":"text","title":"example","lang":"example","inline":"example","blob":"example","mime":"example","name":"example","size":1,"files":[{"path":"example","blob":"example","mime":"example","size":1,"lang":"example"}],"entry":"example","command":{"shell":null,"argv":null,"cwd":null,"env_keys":[]},"email":{"from":null,"to":[],"cc":[],"bcc":[],"reply_to":null,"subject":"","date":null,"body":"","body_html":null,"attachments":[],"in_reply_to":null},"before_blob":"example","after_blob":"example"}],"options":[{"id":"example","label":"example","outcome":"approve","style":"example"}],"input":{"feedback":"example","fields":["example"],"questions":[{"id":"example","header":"example","question":"example","multi":true,"recommended":1,"allow_free_text":true,"options":[{"label":"example","description":"example","preview":"example"}]}]},"timeout":"example","on_timeout":"deny","dedupe_key":"example","status":"pending","content_hash":"example","created_at":1,"expires_at":1,"decision":{"option":"example","feedback":"example","fields":{"answers":"example"},"content_hash":"example","decided_by":"example","decided_at":1,"outcome":"approve","rule_id":"example","scope":"example","run_result":{"exit_code":1,"stdout_tail":"example","stderr_tail":"example","duration_ms":1,"truncated":true,"elevated":true,"error":"example"}},"run":{"started_at":1,"lease_until":1,"elevated":true}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://example.com/v1/rules/test \ --header 'Content-Type: application/json' \ --data '{ "id": "example", "title": "example", "tool": "example", "callback_url": "example", "summary": "example", "source": { "integration": null, "agent": null, "session": null, "session_title": null, "cwd": null, "repo": null, "branch": null, "host": null }, "kind": "command", "risk": "low", "previews": [ { "type": "text", "title": "example", "lang": "example", "inline": "example", "blob": "example", "mime": "example", "name": "example", "size": 1, "files": [ { "path": "example", "blob": "example", "mime": "example", "size": 1, "lang": "example" } ], "entry": "example", "command": { "shell": null, "argv": null, "cwd": null, "env_keys": [] }, "email": { "from": null, "to": [], "cc": [], "bcc": [], "reply_to": null, "subject": "", "date": null, "body": "", "body_html": null, "attachments": [], "in_reply_to": null }, "before_blob": "example", "after_blob": "example" } ], "options": [ { "id": "example", "label": "example", "outcome": "approve", "style": "example" } ], "input": { "feedback": "example", "fields": [ "example" ], "questions": [ { "id": "example", "header": "example", "question": "example", "multi": true, "recommended": 1, "allow_free_text": true, "options": [ { "label": "example", "description": "example", "preview": "example" } ] } ] }, "timeout": "example", "on_timeout": "deny", "dedupe_key": "example", "status": "pending", "content_hash": "example", "created_at": 1, "expires_at": 1, "decision": { "option": "example", "feedback": "example", "fields": { "answers": "example" }, "content_hash": "example", "decided_by": "example", "decided_at": 1, "outcome": "approve", "rule_id": "example", "scope": "example", "run_result": { "exit_code": 1, "stdout_tail": "example", "stderr_tail": "example", "duration_ms": 1, "truncated": true, "elevated": true, "error": "example" } }, "run": { "started_at": 1, "lease_until": 1, "elevated": true } }'Request Bodyrequired
Section titled “Request Bodyrequired”object
Terminal-event destination; requires the daemon callbacks.allowlist.
object
Server-verified integration token name; caller values are overwritten.
Display-only session name; scoped rules always use the session ID.
object
object
An email draft for review. handup never sends it: on approval the agent
sends the draft (or the edited decision.fields) with its own mail tool.
object
Date shown in the header, as the agent formats it (e.g. RFC 2822).
Message body as Markdown (plain text renders as-is).
Optional HTML alternative; rendered only in the sandboxed HTML preview frame.
object
Uploaded blob hash (POST /v1/blobs) so the reviewer can open the file.
object
Request input. Only kind: question requests interpret questions;
other keys (for example raw agent tool input) pass through unchanged.
object
optional (default) or required_on_deny.
Generic form fields (text, textarea, select, boolean) for non-question requests.
Structured questions (1..=10) for kind: question; answers arrive in decision.fields.answers.
A question for the human; answered in decision.fields.answers[id].
object
Stable id, unique within the request.
Short topic chip, e.g. “Database”.
The question itself (markdown).
Allow selecting several options.
Index of the suggested option.
Allow a typed answer besides (or instead of) the options.
One selectable answer to a [Question].
object
Answer text; unique within its question and returned in selected.
One-line explanation shown under the label.
Markdown shown while the option is focused (code blocks allowed).
Optional positive duration, at most one year. Absent uses config; null/none disables expiry.
object
The desktop app ran the request’s command for the human: this is how it ended. Present only on approved command requests decided by Run.
object
Process exit status; absent when it never started or a signal ended it.
Last bytes of standard output (at most 64 KiB), credentials redacted.
Last bytes of standard error (at most 64 KiB), credentials redacted.
Wall time from start to exit, in milliseconds.
Earlier output was dropped from either tail.
Ran with administrator rights (pkexec on Linux, osascript on macOS).
Why it did not finish normally: timeout, cancellation, signal, or a start failure (for example pkexec missing or authentication refused).
Present while the desktop app runs the command (daemon-managed).
object
Unix milliseconds when the run was claimed.
Unix milliseconds after which an unreported run no longer holds the request (the app crashed or lost the daemon).
Running with administrator rights.
Responses
Section titled “Responses”First matching rule, or null