Developers · Quickstart

Your first Action Assessment

Six steps from sandbox access to an assessed action. The whole integration is one authenticated POST to a single endpoint.

Endpoint

POST https://asyrx.com/api/v1/actions/assess

1. Request Enterprise Sandbox access

Sandbox access is approval-only — Asyrx does not offer public self-service signup. Submit the sandbox request form and your organization is provisioned with a test-mode API key scoped to the assess endpoint.

Request sandbox access

2. Set your environment variables

Test keys assess and store traffic in test mode; they never touch live tenant data. Keep keys server-side — never ship one to a browser or mobile client.

Shell

export ASYRX_API_URL="https://asyrx.com"
export ASYRX_API_KEY="asyrx_test_…"   # server-side only

3. Describe the proposed action

Only action_type and environment are required. Every additional field the agent already knows — volume, financial value, destination, data classification, reversibility — sharpens the assessment.

Fields that matter most

action_type          required  e.g. "crm.records.export"
environment          required  production | staging | sandbox | development
entities_affected    optional  how many records/entities are in scope
financial_value      optional  monetary exposure, with currency
destination          optional  where data or value is going
data_classification  optional  public → regulated
reversibility        optional  fully_reversible → irreversible
privilege_change     optional  true when permissions change

4. Send the assessment request

One POST, before the action executes. Add an Idempotency-Key so a network retry cannot create a duplicate assessment.

curl -X POST "$ASYRX_API_URL/api/v1/actions/assess" \
  -H "Authorization: Bearer $ASYRX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: demo-assessment-001" \
  -d '{
    "agent_id": "agt_customer_operations_01",
    "target_system": "salesforce",
    "action_type": "crm.records.export",
    "environment": "production",
    "records_affected": 84000,
    "entities_affected": 84000,
    "data_classification": "confidential",
    "destination": "external_analytics",
    "reversibility": "partially_reversible"
  }'

5. Read the assessment

The response is deterministic for the same input and engine version. action_risk grades the action itself, blast_radius grades the consequence surface, risk_factors explain the drivers, and recommended_control plus recommendations are decision support only.

200 OK

{
  "api_version": "v1",
  "risk_engine_version": "1.0",
  "policy_version": "1.0",
  "assessment_id": "1f3c9b7a-6d24-4a8e-9c51-77b0f2a4e1d9",
  "action_id": "8b2e5d41-90c7-4f6a-b3ae-0c19d7f45a62",
  "request_id": "req_01j9x8k2j3n4m5p6q7r8s9t0u1",
  "status": "completed",
  "environment_mode": "test",
  "normalized_action_type": "crm.records.export",
  "action_category": "data",
  "action_risk": { "score": 60, "level": "moderate", "confidence": 0.77 },
  "blast_radius": {
    "score": 97,
    "level": "critical",
    "dimensions": {
      "financial_impact": 0,
      "entity_impact": 95,
      "data_impact": 97,
      "operational_impact": 45,
      "privilege_impact": 0,
      "reversibility": 48
    }
  },
  "risk_factors": [
    {
      "code": "NOVEL_DESTINATION",
      "category": "destination",
      "severity": "high",
      "message": "Destination \"external_analytics\" has not been used by this organization before."
    },
    {
      "code": "HIGH_ENTITY_COUNT",
      "category": "volume",
      "severity": "critical",
      "message": "84,000 records in scope for a single action."
    },
    {
      "code": "SENSITIVE_DATA_EXPORT",
      "category": "data",
      "severity": "critical",
      "message": "84,000 confidential records would leave the system of record."
    },
    {
      "code": "PRODUCTION_ENVIRONMENT",
      "category": "environment",
      "severity": "moderate",
      "message": "The action targets a live production environment."
    }
  ],
  "recommended_control": {
    "type": "SECONDARY_APPROVAL_RECOMMENDED",
    "priority": "critical",
    "because": ["Novel destination", "High entity count", "Sensitive data export"]
  },
  "recommendations": ["VERIFY_DESTINATION", "VERIFY_SCOPE", "CONFIRM_PRODUCTION_ENVIRONMENT"],
  "behavioral_context": {
    "historical_comparison_available": false,
    "baseline_scope": "organization",
    "sample_size": 0,
    "window_days": 30,
    "entity_volume_multiplier": null,
    "financial_value_multiplier": null,
    "velocity_multiplier": null,
    "destination_seen_before": false,
    "action_type_seen_before": false
  },
  "policy_context": [],
  "summary": "Action Risk 60 with a Blast Radius of 97. Primary drivers: novel destination and high entity count. Secondary Approval Recommended. Asyrx does not authorize, execute or block this action.",
  "processing_time_ms": 41,
  "created_at": "2026-09-01T16:12:04.118Z",
  "disclaimer": "Asyrx provides risk intelligence and decision-support recommendations for proposed AI-agent actions. Customers remain responsible for authorization, execution and final operational decisions."
}

6. Apply your own control, then subscribe to events

Your systems decide what happens: proceed, require secondary approval, reduce scope or decline. Then subscribe to webhooks so high-risk and critical assessments reach your reviewers and SIEM.

Webhook events Error handling

Before you go to production

A short checklist for moving from a test key to live traffic.

Rotate to a live key with the narrowest scope your integration needs, and store it in your secret manager — not in source control.
Handle 429 RATE_LIMITED with the returned retry_after_seconds, and treat 503 ASSESSMENT_UNAVAILABLE as fail-safe: escalate to a human rather than assuming low risk.
Log the request_id and assessment_id alongside your own action record so an audit can reconstruct what was known before execution.
Verify webhook signatures before trusting any event payload.