> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List policy allow, deny, capture, release, and reset decisions



## OpenAPI

````yaml /api-reference/openapi.json get /credits/end-users/{externalUserId}/policy/events
openapi: 3.1.0
info:
  title: Locus Pro API
  description: >-
    Access paid tools, manage prepaid balances, and build usage billing. Send
    money as exact decimal strings and reuse Idempotency-Key on retries.
    Management routes require a scoped server key or authorized dashboard
    session. Sensitive workspace changes require an owner or admin with recent
    MFA or passkey verification, except where an operation documents a stricter
    boundary. Interactive agents use MCP OAuth; unattended agents use scoped
    Agent Connections. Browser widgets use end-user tokens.
  version: 0.7.0
servers:
  - url: https://api.paywithlocus.com/api
    description: Production
  - url: https://api.stage.paywithlocus.com/api
    description: Stage — evaluation and integration testing
security:
  - secretKey: []
tags:
  - name: Authentication
    description: Email-verified self-serve account creation and dashboard identity
  - name: Tenants
    description: Tenant profile, keys, and settings (dashboard session or secret key)
  - name: Workspace members
    description: Invite-only human workspace membership and role administration
  - name: Catalog
    description: Enable/disable APIs and set markups
  - name: Custom APIs
    description: Feature-gated enterprise BYOK providers and schema-backed custom actions
  - name: End users
    description: End-user accounts, tokens, and allocations
  - name: Top-ups
    description: Locus-hosted checkout top-ups and quotes
  - name: Ledger
    description: Burn/top-up history and earnings
  - name: Webhooks
    description: Signed events, delivery inspection, and replay
  - name: Burn
    description: Metered pay-per-use calls
  - name: MCP
    description: Stateless Streamable HTTP transport and MCP tool-result contracts
  - name: Okibi Identity
    description: >-
      Feature-gated Okibi identity verification and scoped native CLI credential
      bootstrap
  - name: Widget
    description: End-user JWT surface; a matching publishable key is optional
  - name: Agent-native onboarding
    description: >-
      Self-registration, human Stripe funding handoff, and restricted account
      setup for headless agents
  - name: Hosted Workflows
    description: >-
      Tenant-private TypeScript Workflow definitions, immutable versions,
      bounded runs, artifacts, and recovery
  - name: Agent connections
    description: Scoped, expiring, revocable credentials for agent execution
  - name: Recipes
    description: >-
      Search, research, extraction, enrichment, and travel outcomes across
      providers
paths:
  /credits/end-users/{externalUserId}/policy/events:
    get:
      tags:
        - End users
      summary: List policy allow, deny, capture, release, and reset decisions
      parameters:
        - name: externalUserId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/ExternalUserId'
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 250
            default: 100
      responses:
        '200':
          description: Newest policy decisions first
          content:
            application/json:
              schema:
                type: object
                required:
                  - success
                  - externalUserId
                  - events
                properties:
                  success:
                    const: true
                  externalUserId:
                    $ref: '#/components/schemas/ExternalUserId'
                  events:
                    type: array
                    items:
                      $ref: '#/components/schemas/EndUserPolicyEvent'
      security:
        - dashboardSession: []
        - secretKey: []
components:
  schemas:
    ExternalUserId:
      type: string
      minLength: 1
      maxLength: 200
      pattern: ^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$
      description: >-
        Case-sensitive immutable ID in the tenant namespace. Prefer an
        identity-provider subject, not an email address.
    EndUserPolicyEvent:
      type: object
      required:
        - id
        - policyId
        - accountId
        - action
        - reasonCode
        - createdAt
      properties:
        id:
          type: string
          format: uuid
        policyId:
          type: string
          format: uuid
        accountId:
          type: string
          format: uuid
        reservationId:
          type:
            - string
            - 'null'
          format: uuid
        action:
          type: string
          enum:
            - ALLOW
            - DENY
            - CAPTURE
            - RELEASE
        reasonCode:
          type: string
          description: Stable POLICY_* denial code or lifecycle reason.
        amountUsdc:
          type:
            - string
            - 'null'
        amountCredits:
          type:
            - string
            - 'null'
        idempotencyKey:
          type:
            - string
            - 'null'
        metadata:
          type:
            - object
            - 'null'
          additionalProperties: true
        createdAt:
          type: string
          format: date-time
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: Tenant secret key (lcr_…). Server-side only.
    dashboardSession:
      type: http
      scheme: bearer
      description: >-
        Locus Pro dashboard session (Cognito). High-risk workspace
        administration requires an owner or admin role and fresh MFA/passkey
        step-up.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.