Tasks

​

POST /tasks

POST /api/v1/tasks
Authorization: Bearer <api-key>
Content-Type: application/json

{
  "task": "Summarize the discharge note. Redact direct identifiers. Apply minimum-necessary.",
  "compliance_policy": "hipaa",
  "budget_cents": 2000
}

{
  "execution_id": "exec_8c5e...",
  "status":       "queued",
  "websocket_url":"ws://.../ws/executions/exec_8c5e..."
}

​

Error responses

{
  "detail": {
    "message": "No effective permissions after applying 'hipaa' compliance policy",
    "denied": [
      {
        "permission": "network:http:read",
        "reason": "exceeds_policy_ceiling",
        "detail": "Permission is not within the HIPAA policy allowed set"
      }
    ]
  }
}

​

What happens server-side

1. The request is validated against the active compliance policy’s max_permissions ceiling.
2. An execution record is created and the task is enqueued.
3. The agentic executor (LLM + tool dispatcher) starts running. Every tool call passes through Guard.verify(...) before execution. Allowed calls produce a VerifiedCertificate recorded in the execution; blocked calls are recorded with their violations.
4. The execution moves through queued → planning → executing → verifying and finishes with completed, failed, or cancelled.

​

See also

• Executions - fetching the result by id.
• Workflows - multi-stage orchestrations.
• Compliance - exporting the audit package for a finished execution.