# AgentGuard gate webhook examples

Two single-file handlers that put the hosted gate in front of any agent platform that can call
an HTTPS URL on each tool call. No dependencies. Copy one, set `AGENTGUARD_VENDOR_KEY`, run it,
point your platform's tool-call hook at `POST /gate`.

- `handler.js`: Node 18 or newer, `node handler.js`
- `handler.py`: Python 3.9 or newer, `python3 handler.py`. If Python reports CERTIFICATE_VERIFY_FAILED (common with python.org builds on macOS), run the Install Certificates command that ships with Python or set `SSL_CERT_FILE` to your system bundle.

Without a key both run in sandbox: decisions and signed receipts are real, nothing is stored,
receipts are marked `sandbox: true`.

## The three shapes

Event your platform sends to the handler (metadata only, never names, numbers, transcripts or card data):

    {"tool": "waive_fee", "arguments": {"amount_cents": 5000, "currency": "USD", "target_system": "property_management"},
     "tenant_id": "acme-storage", "agent_id": "storage-bot"}

For a call or a text:

    {"tool": "place_call", "arguments": {"recipient_ref": "rcp_7f3a9c", "recipient_tz": "America/New_York", "consent_ref": "cns_01HZX"},
     "tenant_id": "acme-storage", "agent_id": "collections-bot"}

What the handler answers:

    {"proceed": true, "receipt_id": "rcpt_...", "text": "permitted under the policy"}
    {"proceed": false, "approval_id": "apr_...", "status_url": "...", "text": "held for a person under the policy"}
    {"proceed": false, "reason": "outside the calling window set in the policy", "receipt_id": "rcpt_..."}

When the gate does not answer in 2 seconds, the handler reads the policy's `on_unavailable` entry for
that action type (`proceed` or `stop`, default `stop`), answers accordingly, writes a note to stderr and
marks the answer `"gap": true` so your own log shows the receipt chain has a hole there.

Map your platform's tool names to gate action types in `TOOL_TO_ACTION`. Replace `POLICY` with the
operator's policy from the order form. Full contract: https://agentguard.run/vendors