> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visceralai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Apply Tool Result

> The stored result for one matched rule. The SDK sends the decision_id
it matched from its snapshot — no server-side tie-break; the server
validates the request against that rule and looks up the newest fresh
execution. Every refusal is a plain 404: to the SDK a miss and a gate-out
are the same thing — run the real tool.

Two rule kinds serve here. ``reuse_identity`` (input-identity claim):
the newest execution of exactly (tool_name, input_hash), so ``input_hash``
is required and must match the rule. ``suppress_dead`` (inertness claim —
the gate proved the consuming calls don't read the content): the newest
real execution of the tool regardless of input, so ``input_hash`` is
ignored. Either way the lookup is EVENTS-side (deliberately not
graph-side, so serving never waits on builder lag), non-error, customer-
attested, inside the freshness window. Served calls can never be selected
— a served span omits its input hash (design D3), so a stored payload's
age is always measured from a real execution.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/apply/tool-result
openapi: 3.1.0
info:
  title: Visceral Backend
  version: 0.2.0
  description: >-
    The Visceral backend HTTP API. SDK and ingestion endpoints authenticate with
    a workspace API key; dashboard endpoints authenticate with a user session
    token. Both are sent as `Authorization: Bearer <token>`.
servers:
  - url: https://api.visceralai.dev
security: []
paths:
  /v1/apply/tool-result:
    get:
      tags:
        - apply
      summary: Apply Tool Result
      description: >-
        The stored result for one matched rule. The SDK sends the decision_id

        it matched from its snapshot — no server-side tie-break; the server

        validates the request against that rule and looks up the newest fresh

        execution. Every refusal is a plain 404: to the SDK a miss and a
        gate-out

        are the same thing — run the real tool.


        Two rule kinds serve here. ``reuse_identity`` (input-identity claim):

        the newest execution of exactly (tool_name, input_hash), so
        ``input_hash``

        is required and must match the rule. ``suppress_dead`` (inertness claim
        —

        the gate proved the consuming calls don't read the content): the newest

        real execution of the tool regardless of input, so ``input_hash`` is

        ignored. Either way the lookup is EVENTS-side (deliberately not

        graph-side, so serving never waits on builder lag), non-error, customer-

        attested, inside the freshness window. Served calls can never be
        selected

        — a served span omits its input hash (design D3), so a stored payload's

        age is always measured from a real execution.
      operationId: apply_tool_result_v1_apply_tool_result_get
      parameters:
        - name: decision_id
          in: query
          required: true
          schema:
            type: string
            format: uuid
            title: Decision Id
        - name: input_hash
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Input Hash
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ToolResultResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - workspaceApiKey: []
components:
  schemas:
    ToolResultResponse:
      properties:
        content_hash:
          type: string
          title: Content Hash
        ciphertext_b64:
          type: string
          title: Ciphertext B64
        iv_b64:
          type: string
          title: Iv B64
        tag_b64:
          type: string
          title: Tag B64
        key_id:
          type: string
          title: Key Id
        cached_at:
          type: string
          format: date-time
          title: Cached At
        expires_at:
          type: string
          format: date-time
          title: Expires At
        decision_id:
          type: string
          format: uuid
          title: Decision Id
      type: object
      required:
        - content_hash
        - ciphertext_b64
        - iv_b64
        - tag_b64
        - key_id
        - cached_at
        - expires_at
        - decision_id
      title: ToolResultResponse
      description: |-
        The encrypted stored result for a matched reuse_identity rule (design
        D4): the AES-GCM triple base64-encoded, plus the validator hash the SDK
        checks after decrypting and the window bounds it may serve within.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    workspaceApiKey:
      type: http
      scheme: bearer
      description: >-
        Workspace API key (`vsc_live_...`), minted from the dashboard.
        Identifies the SDK/proxy as a workspace.

````