# simulate Agent Inbox Policy

Account-scoped HTTP v1 agent operation within the credential's fixed workspace and current owner/source authority. Workspace selection never changes browser preferences. Policies cannot be activated b

Canonical: https://commentary.dev/docs/reference/api/simulate-agent-inbox-policy

`POST /api/v1/inbox/policies/simulate`

Account-scoped HTTP v1 agent operation within the credential's fixed workspace and current owner/source authority. Workspace selection never changes browser preferences. Policies cannot be activated by an agent. Insights require a 20-observation cohort; delivery history omits titles and app paths.

## Access

Use a credential with `commentary.inbox.read`.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Parameters

| Name | Location | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Commentary-Workspace-Id` | header | string | No | Must match the credential workspace. This header cannot widen grant authority. |
| `X-Correlation-Id` | header | string | No |  |

## Request body

Required. Supported content types: `application/json`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `definition` | [InboxAttentionPolicyDefinition](/docs/reference/schemas/inbox-attention-policy-definition) | Yes |  |
| `entryId` | string | Yes |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request POST \
  'https://commentary.dev/api/v1/inbox/policies/simulate' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/json' \
  --data-binary @request.json
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `200` | Authorized response. Reads never mark recipient state or apply policy effects. Proposals are disabled and pending human approval. | object |
| `400` | Invalid input. | [InteractionApiError](/docs/reference/schemas/interaction-api-error) |
| `401` | A valid bearer token is required. | See response headers or body contract |
| `403` | The grant, workspace, membership, scope, feature, or source authority does not authorize this action. | See response headers or body contract |
| `404` | Authorized resource or item was not found. | See response headers or body contract |
| `409` | The version, retry key, or proposal limit conflicts. | See response headers or body contract |
| `500` | The request could not be completed. | See response headers or body contract |
| `503` | Source access or projection is temporarily unavailable. | See response headers or body contract |

### Successful response fields

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | object | Yes |  |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `simulateAgentInboxPolicy`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).