REST API

Every MCP capability is also available as plain HTTP, for tooling that does not speak MCP.

https://policycodex-mcp.thoughtlabs.workers.dev

Authentication

A bearer API key on every request. The key scopes the response to your organisation.

curl -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  https://policycodex-mcp.thoughtlabs.workers.dev/v1/domains

A missing or invalid key returns 401.

Endpoints

Method	Path	Purpose
`GET`	`/v1/domains`	Domains with RFC counts
`GET`	`/v1/statements`	Statements, filterable
`GET`	`/v1/rfcs/:slug`	One RFC’s body and metadata
`GET`	`/v1/compile/agents-md`	Compiled `AGENTS.md`
`GET`	`/v1/audit/export`	Full audit log
`POST`	`/v1/check`	Evaluate a diff against enforced statements
`POST`	`/v1/violations`	Record violations

GET / returns this index unauthenticated, which is a quick way to confirm the worker is reachable.

Statements

curl -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  "https://policycodex-mcp.thoughtlabs.workers.dev/v1/statements?domain=api-design&level=MUST"

Query parameters: domain, level, sdlc_stage, status.

status defaults to enforced. Pass status=approved to include advisory statements.

One RFC

curl -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  https://policycodex-mcp.thoughtlabs.workers.dev/v1/rfcs/api-design-guidelines

Returns 404 with {"error":"not found"} for an unknown slug.

Compile AGENTS.md

curl -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  "https://policycodex-mcp.thoughtlabs.workers.dev/v1/compile/agents-md?domain=api-design" \
  -o AGENTS.md

Returns Markdown, not JSON. See AGENTS.md.

Compliance check

curl -X POST \
  -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "diff": "diff --git a/src/api.ts ...",
        "domain": "api-design",
        "tree": ["src/api.ts", "openapi.yaml", "README.md"]
      }' \
  https://policycodex-mcp.thoughtlabs.workers.dev/v1/check

Returns findings citing statement slugs, with MUST-level findings marked blocking.

Include tree. Requirements of the form “every service MUST have an OpenAPI spec” are only checkable against a file listing — a diff cannot show what is absent.

Passing repo records the run against Coverage, which is how the GitHub Action populates that page.

Record violations

curl -X POST \
  -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "repo": "demo/sample-service", "pr_number": 1, "violations": [ ... ] }' \
  https://policycodex-mcp.thoughtlabs.workers.dev/v1/violations

Violations must cite known statement slugs; a payload where none match returns 400. Recorded violations appear on the dashboard.

Audit export

curl -H "Authorization: Bearer $POLICYCODEX_API_KEY" \
  "https://policycodex-mcp.thoughtlabs.workers.dev/v1/audit/export?format=csv" \
  -o audit.csv

Omit format for JSON. The JSON form carries the complete hash chain, so an external system can verify it independently — see Audit trail. This is the endpoint to point a scheduled evidence-collection job at.

Errors

Status	Meaning
`400`	Invalid body. The response names the first failing field.
`401`	Missing or invalid API key
`404`	No such RFC
`500`	Server error

Errors are JSON: {"error": "..."}.

For agents

For CI

Authentication

Endpoints

Statements

One RFC

Compile AGENTS.md

Compliance check

Record violations

Audit export

Errors

​Authentication

​Endpoints

​Statements

​One RFC

​Compile AGENTS.md

​Compliance check

​Record violations

​Audit export

​Errors

Authentication

Endpoints

Statements

One RFC

Compile AGENTS.md

Compliance check

Record violations

Audit export

Errors