Preview the policy decision for a package/version
const url = 'https://api.pkgplease.com/api/v1/policy/example/check';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"package_name":"example","version":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.pkgplease.com/api/v1/policy/example/check \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "package_name": "example", "version": "example" }'Backs the MCP check_package tool. Resolves the decision through the shared evaluator (evaluatePackage), the same code path the registry install uses, so a pre-flight check and the install it predicts cannot disagree. Read-only and scoped to the caller's org. On a block, searches for a remediation (a compliant version, or a cohort peer); when none exists, records an audit event and raises an org alert through the notification fan-out. The response is rendered by token type — a session (human) token gets the full render including override_eligibility and its ceremony flags; every other token type (agent, service, developer, provisioner) gets the agent-safe render, which never includes override_eligibility or any override vocabulary.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”One of the org's configured registry types (npm is the one in active use).
Request Bodyrequired
Section titled “Request Bodyrequired”object
Examplegenerated
{ "package_name": "example", "version": "example"}Responses
Section titled “Responses”Either an unscored placeholder (enqueues scoring) or a full decision
object
"not yet scored" when scoring was enqueued (jobId is then present), otherwise why the package could not be evaluated at all — non-registry-spec, no-satisfying-version, package-not-found or upstream-unavailable.
Present only with reason "not yet scored".
object
Present only on a block.
The pack id that produced the decision
Present on a block when a compliant alternative was found, and on a steer, where it names the org's endorsed cohort peer.
object
Present only for a cohort-peer remediation.
Session-token responses only.
Session-token responses only — never present in an agent/service/developer/provisioner response.
object
One scoring-rule contribution to a package's trust or threat score.
object
Example
{ "decision": "unknown"}Missing package_name or version
object
Examplegenerated
{ "error": "example"}