Documentation

Guard your first agent action

The REST API is live today. Package publication and public-source distribution remain gated until their namespaces and release artifacts are independently verified.

Quickstart

Create an account in the Ruligent dashboard. Registration returns a dashboard session and a default API key. Store the key securely; it is shown only when created.

# Hosted API base URL for the current production release
export API_BASE_URL="https://agentgate-one.vercel.app"
export RULIGENT_API_KEY="ag_live_..."

curl -X POST "$API_BASE_URL/v1/guard" \
  -H "Authorization: Bearer $RULIGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agentId": "my-agent",
    "tool": "send_email",
    "action": "send",
    "estimatedCostUsd": 0.02
  }'

The response is a structured decision such as allow, block, require_approval, rate_limited, spend_limited, or killed. Do not execute the tool unless allowed is true.

Example decision

{
  "decision": "require_approval",
  "allowed": false,
  "reason": "Human approval required",
  "riskLevel": "high",
  "approvalId": "apr_...",
  "eventId": "evt_..."
}

Fail safely

Keep the tool call behind the decision boundary. Treat denied decisions, invalid responses, timeouts, and unreachable guard services as a stop unless you have explicitly accepted a documented fail-open risk.

Kill switches outrank spend limits and policies. Spend limits outrank normal policy rules. Policy rules run by priority, then the organization default applies.

Core hosted endpoints

The dashboard and API are served from the same production origin for this release.

Method	Path	Purpose	Authentication
GET	`/health`	Service and storage health	Public
POST	`/v1/auth/register`	Create an organization and first admin	Public
POST	`/v1/auth/login`	Create a dashboard session	Public
POST	`/v1/auth/forgot-password`	Request account recovery without account enumeration	Public
GET	`/v1/me`	Read the current user and organization	Dashboard session
POST	`/v1/guard`	Evaluate an agent action before execution	API key or authorized session

Unknown /v1 routes return a structured 404 not_found. Protected routes return structured authorization errors rather than redirecting.

Controls that shape decisions

Policies

Match agent IDs, tools, and actions with priority-ordered rules. A rule can allow, block, require approval, impose a rate limit, or assign a risk level.

Spend limits

Set daily or monthly USD ceilings at organization, agent, or tool scope. Projected overspend is denied before execution.

Approvals

Approval-required calls remain denied until an authorized reviewer approves them. Plans without approvals fall back to block, never allow.

Kill switches

Stop an entire organization, one agent, or one tool. Activation is immediate and outranks every normal rule.

Audit evidence

Each evaluated action produces an event with the decision, reason, risk, cost, actor, and approval relationship.

Idempotency

Use a stable idempotency key when retrying the same action so the original decision can be returned without duplicate evaluation.

Integration guidance

Build a compact guard request from the material facts of the proposed action.
Call POST /v1/guard immediately before the external side effect.
Execute only when the returned decision explicitly allows it.
When approval is required, surface the approval ID and wait for a later approved decision.
Record the event ID beside your own operation ID so the action and Ruligent evidence remain attributable.

Never place a Ruligent API key in browser JavaScript, mobile application bundles, logs, analytics, or source control. Make guard calls from a trusted server or protected agent runtime.

For a private deployment, security review, SDK release access, or a deeper integration guide, contact Ruligent. Private deployment availability is evaluated separately; no public-source repository is represented as available on this site.