API documentation

Vertex go-live checklist

Use this page when a partner is moving from a successful Vertex adapter test into a live governed workflow. The goal is simple: keep Vertex as the distribution and reasoning surface while Decionis Protocol remains the execution-time decision boundary.

Readiness

These are the minimum conditions to consider a Vertex integration ready for controlled production traffic.

Area	Requirement	Go-live signal
Credentials	A Decionis org API key with decision:write, decision:, or org: scope is issued for the target workspace.	The adapter route returns 200 for a valid direct verification call.
Policy boundary	The intended policy version and workflow key are already active in Decionis.	The response shows the expected policy_version and execution_guidance.
Proof	Decision Dossier verification is enabled and reachable.	verification.verification_url resolves for the returned dossier.
Identity	Google edge identity verification is either intentionally disabled or correctly configured.	google_identity_mode and google_identity_verified match the expected deployment posture.
Region	Allowed locations and serving region are explicitly configured when locality matters.	regional_posture shows location_accepted=true for valid requests.
Observability	Log metrics, dashboard, and baseline alerts exist in Google Cloud.	Cloud Monitoring resources are present and begin receiving live data.

Go-live boundary

Do not treat a green tool import alone as production readiness. The real go-live signal is a successful adapter call that produces a dossier, metering record, and downstream behavior that obeys execution_guidance.

Runtime config

Use these settings to make the adapter posture explicit before live traffic begins.

Vertex adapter env

These settings control Google edge identity, location posture, and usage export.

GOOGLE_CLOUD_VERTEX_OIDC_AUDIENCES=
GOOGLE_CLOUD_VERTEX_OIDC_ISSUERS=
GOOGLE_CLOUD_VERTEX_OIDC_HEADER_NAME=x-google-identity-token
GOOGLE_CLOUD_VERTEX_ALLOWED_LOCATIONS=
GOOGLE_CLOUD_VERTEX_LOCATION_REQUIRED=0
GOOGLE_CLOUD_VERTEX_SERVING_REGION=
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_ENABLED=0
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_SERVICE_NAME=
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_METRIC_NAME=decionis.googleapis.com/verified_decision
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_OPERATION_NAME=decionis.vertex.extensions.verify

Reference docs

Keep the implementation page and the API contract close at hand during rollout.

Need	Path
Vertex implementation	/docs/vertex-ai-extension
API overview	/docs/api
Decision Dossier	/docs/decision-dossier
Validation Packs	/docs/validation-packs

Execution checks

Run these checks in order so failures stay isolated and easy to diagnose.

# 1. Direct adapter check
curl -X POST https://api.decionis.com/v1/google-cloud/vertex/extensions/verify \
  -H "Authorization: Bearer dcy_org_xxx" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: vertex-go-live-1" \
  -d '{
    "org_id": "<org_uuid>",
    "decision_type": "TRANSACTION_ROUTING",
    "workflow_key": "finance_transaction_routing",
    "system_of_record": "SAP",
    "intent": {
      "action_type": "CREATE_VENDOR_PAYMENT",
      "target_entity": "invoice",
      "target_id": "INV-2048",
      "payload": {
        "invoice_id": "INV-2048",
        "currency": "EUR"
      }
    },
    "google_context": {
      "project_id": "your-gcp-project",
      "location": "europe-west1",
      "agent_id": "vertex-agent-1"
    }
  }'

# 2. Inspect the response for:
#    status
#    policy_version
#    verification
#    google_identity_verified
#    regional_posture
#    metering
#    metering_export
#    execution_guidance

# 3. Replay the same request with the same Idempotency-Key
#    Expect stable governed output, not a second uncontrolled action

# 4. List recorded Vertex metering events
curl -H "Authorization: Bearer dcy_org_xxx" \
  https://api.decionis.com/v1/orgs/<org_id>/google-cloud/vertex/metering

# 5. If Service Control export is enabled and a prior export failed,
#    replay the export without rerunning the business decision
curl -X POST -H "Authorization: Bearer dcy_org_xxx" \
  https://api.decionis.com/v1/orgs/<org_id>/google-cloud/vertex/metering/<event_id>/replay-service-control

Check	Expected result
Direct adapter call	HTTP 200 with a governed verdict and dossier proof.
Idempotent replay	Same outcome with replay-safe behavior.
Dossier verification	Public verification URL resolves cleanly.
Execution gating	Downstream step only runs when execution_guidance.allowed is true.
Metering ledger	A verified_decision event exists for the call.

Google-native checks

These checks prove the Google-facing posture is working, not just the core Decionis decision route.

Surface	Validation	Healthy signal
Identity validation	Send one valid request and one invalid or missing-token request when OIDC is required.	Valid request returns google_identity_verified=true. Invalid request returns 401.
Regional enforcement	Call once with an allowed location and once with a disallowed one when allowlisting is active.	Allowed request succeeds. Disallowed request returns 400.
Cloud Logging	Inspect adapter logs after a live verification call.	Logs include project, location, subject or service account, verdict, trace data, and metering labels.
Cloud Monitoring metrics	Check the Vertex log metrics after traffic reaches the adapter.	Verified, blocked, hold, and invalid-identity/location metrics exist and receive data.
Dashboard	Open the Decionis Vertex Extension dashboard in Cloud Monitoring.	The dashboard loads and shows the live metric series.
Alerts	Review the baseline alert policies for invalid identity/location, blocked surge, and hold surge.	Policies exist and are attached to the expected project.

Rollback

A controlled rollback should reduce risk without removing evidence or breaking downstream verification.

Situation	Rollback action	Keep in place
Identity verification causes false negatives	Switch from required to optional while investigating token audience or issuer problems.	Decision Dossiers, metering ledger, and execution_guidance enforcement.
Regional posture rejects valid traffic	Widen the allowlist or temporarily disable required location checks.	Serving region reporting and verification proof.
Service Control export fails	Disable export or leave it best-effort and use replay later.	The governed decision path and the Decionis metering ledger.
Vertex tool behavior is unstable	Fall back to direct adapter invocation from the calling service or queue.	The Decionis adapter contract and Protocol decision authority.

Reference assets

Use these files as the starting point for implementation and rollout.

OpenAPI spec

Import or mirror this artifact into the Google-controlled environment you use for Vertex tooling.

https://decionis.com/openapi/decionis-vertex-extension-v1.yaml

Tool bundle

Use this metadata wrapper when a partner needs the operation list, docs links, scope expectations, and downstream authority posture in one file.

https://decionis.com/google-cloud/vertex/decionis-vertex-authority-tool-bundle.json

Reference flow

Use this compact JSON flow to validate authorize, token verification, override, and drift behavior without adding policy logic to Vertex.

https://decionis.com/examples/decionis-vertex-reference-flow.json

Agent Card

Upload this standalone Agent Card JSON to Cloud Storage in the marketplace project and validate it in Producer Portal.

https://decionis.com/google-cloud/vertex/decionis-vertex-agent-card.json

A2A discovery profile

Use this profile when agent-discovery catalogs need a clear Decionis authority card before a full integration run.

https://decionis.com/google-cloud/vertex/decionis-vertex-a2a-discovery-profile.json

Identity claims map

Use this map to validate which Google token claims become Decionis actor context, traceability fields, and audit evidence.

https://decionis.com/google-cloud/vertex/decionis-vertex-identity-claims-map.json

Marketplace readiness

Use this reviewer packet to distinguish shipped runtime controls from optional enterprise hardening and non-claims.

https://decionis.com/google-cloud/vertex/decionis-vertex-marketplace-readiness.json

PSC consumer handoff

Use this packet when a regulated customer needs private endpoint setup, project allow-listing, validation, and rollback posture.

https://decionis.com/google-cloud/vertex/decionis-vertex-psc-consumer-handoff.json

Trace SRE runbook

Use this packet to correlate Google trace headers, Decionis logs, dossiers, metering, token verification, overrides, and drift events during incident response.

https://decionis.com/google-cloud/vertex/decionis-vertex-trace-sre-runbook.json

Billing readiness

Use this packet to validate verified_decision billing, ledger-first reconciliation, optional Service Control export, and replay behavior.

https://decionis.com/google-cloud/vertex/decionis-vertex-billing-service-control-readiness.json

Client wrapper example

This TypeScript example is safe to wrap inside an ADK tool handler or any service that needs a thin Decionis verification call.

https://decionis.com/examples/decionis-vertex-verify-client.ts

Loading…

Decionis Docs

Base URL: https://api.decionis.com/v1

Quickstart Main site Contact