Read the Decision Event of a Blocked Request

When a policy control blocks a request, the gateway records a decision event. The event tells you which policy or routing rule blocked the request and why. This article explains the event and the next actions. Investigate a Blocked Request gives the full procedure.

Find the event

Sign in with a role that has events:read. Then list the blocked decisions of the last 30 minutes in the region of the gateway:

verdictan events tail --since 30m --event-type decision --verdict block --json

Find the matching request_id in the events array. An event request_id always has 32 lowercase hexadecimal characters. The X-Request-Id of the response can have a different format, so convert it first.

Some errors occur before the gateway records a decision. If no event matches, keep the original HTTP status and the error body. Then examine the gateway connection and authentication.

Read the fields

Field	Tells you
request_id, event_id	How to find the same request again
verdict, reason_code	The result and its reason
details	The policy results and the redaction markers
config_id, config_version	The configuration that made the decision

Many policy controls return HTTP 400 with the error code content_policy_violation for a block. The body has a verdictan.decision object with the verdict and the reason code.

Find more context

• History shows the retained prompt and response. Blocked requests show there only when capture is on and history.capture.include_blocked is true. This value is not the default.
• Trail shows who changed a configuration and when. Compare the config_version of the event with Configurations.
• Inbox shows a review item, if the request also created one.

A missing History session does not make the decision event wrong.

Select the next action

Finding	Next action
The policy blocked the request correctly	Tell the application owner the reason, and keep the request ID.
The policy needs a small change	Add a test for this request. Then follow Managing Policy Changes.
A rollout caused the failures	Speak to the rollback owner, and examine the applied configuration in Gateways.
The evidence is not sufficient	Write down the missing items, and give them to the responsible reviewer.

Do not change a policy only to stop an error. Test the intended allow and block behavior before a rollout.

Next steps

• Investigate a Blocked Request: the full procedure and the ID conversion.
• verdictan events: filter and export decision events.
• Resolve an Escalation: record a human decision for a request that a person must review.