Rends documentation: SDKs, approval holds and emergency stop

The fastest path from zero to a live compliance decision is a single POST to the Comply engine.

curl -sS -X POST "https://rends.ai/api/v1/compliance/check-action" \
  -H "Authorization: Bearer ac_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "orgId": "org_123",
    "agentId": "agent_456",
    "actionType": "tool_call",
    "actionName": "send_email",
    "resourceType": "external_api",
    "input_summary": "Drafting outbound message to customer"
  }'

The response includes a decision (allow, warn, or block), the triggered rules, and a request ID you can match against the audit trail.

• API keys — Authorization: Bearer ac_live_…. Used for engine routes (agents, governance, compliance). Cannot call gateway-owned routes such as /v1/billing or/v1/api-keys.
• Session JWT — Authorization: Bearer <session_jwt>. Issued by our self-hosted identity service and used by the dashboard; the gateway requires organization context.

All public routes are versioned under /v1. This page documents the API surface; the machine-readable OpenAPI 3.1 spec is not currently published to a public URL. Ask us if you need the spec file.

All plans include a 14-day trial; onboarding is by request.

Agents move through five stages: planned → active → deprecated → retired → archived. Every transition is recorded as an event.

{
  "to_stage": "deprecated",
  "reason": "Superseded by v2 retrieval agent",
  "successor_agent_id": "agent_abc123",
  "metadata": { "ticket": "GOV-481" }
}

Declare upstream/downstream dependencies between agents and the systems they touch, then query the impact graph.

A 16-pattern detector with compound-boost scoring runs before any tool call. Severities arenone, low, medium, high, and critical. When the prompt_injection_detection flag is enabled, requests at high orcritical are blocked.

{
  "decision": "block",
  "severity": "high",
  "score": 0.87,
  "patterns_matched": ["override_instructions", "exfiltrate_secrets"],
  "compound_boost": 0.15,
  "request_id": "req_01HW…"
}

Build context-aware allow/deny policies (IP ranges, time windows, principal claims, resource tags) and evaluate them per call.

Define data-retention rules per resource type, then trigger immediate enforcement or rely on the scheduled run.

The kill switch is available on every tier. Human-in-the-loop approvals and anomaly detection are Professional and Enterprise capabilities. See the dedicated guides for kill switch, HITL, and anomaly detection.

Per-call scan across toxicity, hate, harassment,self_harm, sexual, violence, profanity, andpii. Industry-gated detectors add PHI patterns for healthcare and PCI for financial. Detected PII is auto-redacted in content_preview before persistence.

v1 covers three dimensions — gender, race, and age — using keyword/lexicon analysis on agent outputs. Runs post-evaluation on a BullMQ worker so the synchronous path stays fast.

Z-score detection over daily baselines on latency, error_rate, andcompliance_score. Severities map to standard deviations:

• < 1σ — info
• 1–2σ — warn
• 2–3σ — critical
• > 3σ — emergency

Six dimensions roll up to a single grade: compliance, bias, drift,safety, prompt_injection, governance. Aggregated weekly via a BullMQ cron, with a SHA-512 verification hash for tamper evidence.

Generate audit-ready Markdown documents on demand — system cards, model cards, DPAs, privacy policies, safety cases, and transparency reports. Each artifact ships with a SHA-512 verification hash.

Supported types: system_card, model_card, dpa, privacy_policy, safety_case, transparency_report.

Every meaningful action is recorded as a usage event, on every tier — including Starter.

• compliance_check — every real-time check-action call
• compliance_violation — rule failures
• compliance_block — blocked outcomes
• prompt_injection — F7 detections
• content_safety — F4 scans
• bias_detection — F2 results
• drift_detection — F3 alerts
• risk_scorecard — F5 weekly aggregates
• agent_lifecycle — F10 transitions
• compliance_artifact — F6 generations

The same detection logic backs the public, no-account-required scanner at /scanner. Submit a free-text description of your AI usage and get a structured exposure summary in under 10 seconds. Per-IP rate-limited and under a global daily LLM budget cap.

For org-scoped scans across all eight detection channels, see the discovery routes:

Author org-private regulations alongside the public ones — internal AI policies, contractual requirements, board mandates. Create + content-changing updates auto-enqueue a translation job through the same pipeline as Radar-sourced regulations.

9 agent frameworks across the two published SDKs (2.0.0): Node — LangChain, OpenAI Agents and Google ADK; Python — LangChain, LangGraph, CrewAI, AutoGen, OpenAI Agents, Google ADK, Haystack, LlamaIndex and PydanticAI. Both SDKs also ship an OpenTelemetry adapter. Each adapter forwards chain_id, metadata.task_id, and per-call risk hints to the gateway automatically.