# OS protection gate (/docs/api/gateway/os-gate)

Effective org policy for overriding failing OS protection checks, and the audit event clients send when an override is granted or revoked.

Two endpoints back the [OS protection gate](../../agents/os-protection-gate.mdx). Both take a `codai_` API key as a Bearer token.

`GET /v1/policy` returns `{ "os_gate": { "allow_override": boolean } }`, folded over every organization you belong to: if **any** of them forbids overrides the answer is `false`. The response is `Cache-Control: private, max-age=300`; clients cache it and keep the last value offline. A database outage is a `503 policy_unavailable` — keep the cached value, never assume a permissive default.

`POST /v1/os-gate/events` records a grant or revoke in your account audit log (`os_gate.override`). The strict body carries only `action`, `checks` (1 to 16 known check ids), `surface`, `app_version` and `at`; no detection details. It answers `202 { "ok": true }`.

The same operations are in the SDKs: `client.osGate.policy()` / `client.osGate.recordEvent(event)` in TypeScript and `client.os_gate.policy()` / `client.os_gate.record_event(...)` in Python. The MCP server exposes the policy as the read-only `os_gate_policy` tool (`account` toolset); the audit event is device telemetry and has no MCP tool.

<OpenAPIPage
  document="./openapi/en/gateway.yaml"
  operations={[
    { path: '/v1/policy', method: 'get' },
    { path: '/v1/os-gate/events', method: 'post' },
  ]}
/>