Inspect a request without forwarding it

Runs the pre-model plugin checks against a request and answers whether forwarding it upstream is allowed, without calling any provider. Intended for an intercepting proxy that holds the original request and needs a verdict before releasing it.

Plugins that mutate execution or depend on a provider call are skipped.

Unlike the inference routes, this endpoint takes its request context in the body rather than in HTTP headers: entries in metadata are read as the request’s headers, so {"x-bf-project-id": "..."} scopes the inspected request to a governance project exactly as the header would. When called with phase: "response" and log: true, the resolved project is recorded on the log row this endpoint writes.

POST /inspect

Error

A valid request URL is required to generate request examples

200

{
  "allow": true,
  "reason": "<string>",
  "plugin_logs": [
    {
      "plugin_name": "<string>",
      "level": "<string>",
      "message": "<string>",
      "timestamp": 123
    }
  ]
}

This endpoint is available in Bifrost Enterprise only.

Authorizations

Authorization · string · header · required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <API key>. Virtual keys, dashboard/user/session tokens, and x-api-key headers are not supported on management APIs.

Body

application/json

A request to evaluate, plus the context the caller would otherwise have sent as HTTP headers.

phase · enum<string> · required

request evaluates before the upstream call; response reports the outcome afterwards, which is the phase that can write a log row.

Available options: request, response

log · boolean

Write a log row for this call. Honoured on the response phase, where the row carries the resolved governance project.

request_id · string

session_id · string

request · object

The Bifrost request being inspected.

response · object

The upstream response, on the response phase.

error · object

Error response from Bifrost

Show child attributes

metadata · object

Read as the inspected request's headers, lowercased. This is how a caller scopes the inspection to a governance project, with x-bf-project-id or x-bf-project-name.

plugin_logs · object[]

Lines carried over from an earlier phase.

Show child attributes

Response

200

application/json

Verdict returned

allow · boolean

Whether forwarding the original request is permitted.

reason · string

Why it was refused. Absent when allowed.

plugin_logs · object[]

Show child attributes