Documentation
StraxisWall is a permission checkpoint for your AI agents. Before your agent does something sensitive — it asks StraxisWall if it's allowed. StraxisWall checks your rules, responds in milliseconds, and logs what happened.
Quickstart
From zero to your first permission check in 5 minutes.
1
Create a workflow and write your rules
Go to the Rules engine page. Name your workflow — e.g. refund-pipeline. Write your rules in JavaScript. Click Deploy.
2
Generate an API key
Go to API keys. Select your workflow. Click Generate key. Copy it — you'll add it to your agent's code.
3
Add the check to your agent
Before any sensitive action your agent wants to take, call POST /check. If allowed: true — proceed. If allowed: false — stop.
4
See your logs
Every check appears in your Activity logs in real time — which agent, what action, allowed or blocked, and why.
How it works
StraxisWall is a permission checkpoint — not a proxy. Your agent keeps calling its own APIs directly. You just add one call to StraxisWall before any sensitive action to ask: am I allowed to do this?
StraxisWall checks the rules you wrote for that workflow, logs the request, and replies yes or no. Your agent acts on the answer. That is the entire flow.
💡 StraxisWall never sees what your agents say to OpenAI or any other service. It never reads prompts or responses. It only knows what action your agent is about to take — because you tell it in the request body.
Workflows
A workflow is a named set of rules tied to one API key. Each workflow governs one type of agent or process in your system.
Example — a company has three workflows:
refund-pipeline → rules: max refund $500
email-automation → rules: approved domains only
data-fetcher → rules: no bulk queries above 1000 records
Each workflow has its own API key. When your agent calls /check with that key, StraxisWall loads and enforces that workflow's rules automatically.
POST /check
The only endpoint you need. Call this before any sensitive action.
endpoint
POST https://gateway.StraxisWall.io/check
Request body
Send a JSON body describing what your agent wants to do. action is the only required field. Add any other fields your rules need to make a decision.
json
{
"action": "issue_refund", // required
"amount": 250, // any field your rules need
"customer_id": "cus_123", // optional context
"destination": "stripe" // optional context
}
💡 You control what goes in the body. Your rules receive it as request.body — so you can check any field you send.
Responses
Allowed — 200
{ "allowed": true, "logged": true, "workflow": "refund-pipeline", "agent": "refund-bot" }
Blocked — 403
{ "allowed": false, "reason": "Refund of $250 exceeds your $100 limit", "logged": true }
Invalid key — 401
{ "allowed": false, "error": "Invalid API key" }
⚠️ Always check the HTTP status code. If StraxisWall is unreachable, your agent should have a fallback — either block by default or allow and flag for review.
Writing rules
Rules are JavaScript functions written in the Rules engine page. Each function receives a request object and returns either { block: true, reason: "..." } to block the action or { block: false } to allow it.
Rules run top to bottom. The first rule that blocks wins — the rest are skipped.
javascript
const rules = [
function myRule(request) {
// check something
if (someCondition) {
return { block: true, reason: 'Why it was blocked' };
}
return { block: false };
}
];
module.exports = rules;
Request object
Every rule function receives this object:
request.action // what the agent wants to do
request.agent // agent ID from x-agent-id header
request.workflow // which workflow
request.body // full request body you sent
request.method // HTTP method
request.headers // all request headers
Rule examples
Block large refunds
javascript
function blockLargeRefunds(request) {
const amount = request.body?.amount || 0;
if (request.action === 'issue_refund' && amount > 500) {
return { block: true, reason: `Refund of $${amount} exceeds $500 limit` };
}
return { block: false };
}
Restrict a specific agent
javascript
function restrictAgent(request) {
if (request.agent === 'data-bot' && request.action === 'delete_record') {
return { block: true, reason: 'data-bot cannot delete records' };
}
return { block: false };
}
Block outside business hours
javascript
function offHoursLockdown(request) {
const hour = new Date().getHours();
if (hour < 6 || hour >= 23) {
return { block: true, reason: 'Agent activity blocked outside 6am–11pm' };
}
return { block: false };
}
Python
python
import requests
def sentra_check(action, **kwargs):
res = requests.post(
'https://gateway.StraxisWall.io/check',
headers={
'x-api-key': 'sk-your-key',
'x-agent-id': 'refund-bot',
'Content-Type': 'application/json'
},
json={'action': action, **kwargs}
)
return res.json()
# Before any sensitive action
result = sentra_check('issue_refund', amount=250)
if result['allowed']:
issue_refund(250)
else:
print(f"Blocked: {result['reason']}")
JavaScript / Node.js
javascript
async function sentraCheck(action, context = {}) {
const res = await fetch('https://gateway.StraxisWall.io/check', {
method: 'POST',
headers: {
'x-api-key': 'sk-your-key',
'x-agent-id': 'refund-bot',
'Content-Type': 'application/json'
},
body: JSON.stringify({ action, ...context })
});
return res.json();
}
// Before any sensitive action
const result = await sentraCheck('issue_refund', { amount: 250 });
if (result.allowed) {
await issueRefund(250);
} else {
console.log(`Blocked: ${result.reason}`);
}
Go
go
func sentraCheck(action string, body map[string]interface{}) (bool, string) {
body["action"] = action
data, _ := json.Marshal(body)
req, _ := http.NewRequest("POST", "https://gateway.StraxisWall.io/check", bytes.NewBuffer(data))
req.Header.Set("x-api-key", "sk-your-key")
req.Header.Set("x-agent-id", "refund-bot")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
var result map[string]interface{}
json.NewDecoder(resp.Body).Decode(&result)
allowed := result["allowed"].(bool)
reason, _ := result["reason"].(string)
return allowed, reason
}