Simulate policies

curl --request POST \
  --url https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "operation": "signEvmTransaction",
  "address": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
  "transaction": "0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0"
}
'

import requests

url = "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate"

payload = {
    "operation": "signEvmTransaction",
    "address": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
    "transaction": "0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    operation: 'signEvmTransaction',
    address: '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
    transaction: '0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0'
  })
};

fetch('https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'operation' => 'signEvmTransaction',
    'address' => '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
    'transaction' => '0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate"

	payload := strings.NewReader("{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}"

response = http.request(request)
puts response.read_body

{
  "action": "reject",
  "reason": "rule_rejected",
  "matchedRule": {
    "policy": {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "scope": "project",
      "updatedAt": "2026-09-01T12:00:00Z"
    },
    "ruleIndex": 1,
    "rule": {
      "action": "reject",
      "operation": "signEvmTransaction",
      "criteria": [
        {
          "type": "ethValue",
          "ethValue": "1000000000000000000",
          "operator": ">"
        }
      ]
    },
    "observations": [
      {
        "type": "ethValue",
        "ethValue": "2500000000000000000"
      }
    ]
  },
  "unmatchedRules": [
    {
      "policy": {
        "id": "123e4567-e89b-12d3-a456-426614174000",
        "scope": "project",
        "updatedAt": "2026-09-01T12:00:00Z"
      },
      "ruleIndex": 0,
      "criterionIndex": 1,
      "criterion": {
        "type": "evmAddress",
        "addresses": [
          "0x000000000000000000000000000000000000dEaD"
        ],
        "operator": "in"
      },
      "observed": {
        "type": "evmAddress",
        "address": "0x1234567890123456789012345678901234567890"
      }
    }
  ],
  "evaluatedPolicies": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "scope": "project",
      "updatedAt": "2026-09-01T12:00:00Z"
    }
  ]
}

Policy Engine

Simulate policies

Simulates policy evaluation for one operation against the project’s current policies and returns the action the real operation would take, the rule that decided it, and the first unmet criterion of every rule that did not match. Nothing is signed, broadcast, or persisted, and gas and nonce are not populated: the transaction is evaluated as submitted. Each unmet criterion (observed) and each matched-rule criterion (observations) can include the value observed in the request, with messages and decoded arguments returned up to their documented size limits. Rate-limiting criteria are read but not consumed. netUSDChange criteria run transaction simulation, and pass successfully on testnets, as in the real operation. The result is a snapshot: policies, rate-limit counters, or chain state may change before a real call. A policy rejection returns 200 with action: reject; this endpoint never returns policy_violation. A criterion that cannot be evaluated for this input returns 422.

POST

policy-engine

simulate

Simulate policies

curl --request POST \
  --url https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "operation": "signEvmTransaction",
  "address": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
  "transaction": "0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0"
}
'

import requests

url = "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate"

payload = {
    "operation": "signEvmTransaction",
    "address": "0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
    "transaction": "0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    operation: 'signEvmTransaction',
    address: '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
    transaction: '0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0'
  })
};

fetch('https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'operation' => 'signEvmTransaction',
    'address' => '0x742d35Cc6634C0532925a3b844Bc454e4438f44e',
    'transaction' => '0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate"

	payload := strings.NewReader("{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.cdp.coinbase.com/platform/v2/policy-engine/simulate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"operation\": \"signEvmTransaction\",\n  \"address\": \"0x742d35Cc6634C0532925a3b844Bc454e4438f44e\",\n  \"transaction\": \"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0\"\n}"

response = http.request(request)
puts response.read_body

{
  "action": "reject",
  "reason": "rule_rejected",
  "matchedRule": {
    "policy": {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "scope": "project",
      "updatedAt": "2026-09-01T12:00:00Z"
    },
    "ruleIndex": 1,
    "rule": {
      "action": "reject",
      "operation": "signEvmTransaction",
      "criteria": [
        {
          "type": "ethValue",
          "ethValue": "1000000000000000000",
          "operator": ">"
        }
      ]
    },
    "observations": [
      {
        "type": "ethValue",
        "ethValue": "2500000000000000000"
      }
    ]
  },
  "unmatchedRules": [
    {
      "policy": {
        "id": "123e4567-e89b-12d3-a456-426614174000",
        "scope": "project",
        "updatedAt": "2026-09-01T12:00:00Z"
      },
      "ruleIndex": 0,
      "criterionIndex": 1,
      "criterion": {
        "type": "evmAddress",
        "addresses": [
          "0x000000000000000000000000000000000000dEaD"
        ],
        "operator": "in"
      },
      "observed": {
        "type": "evmAddress",
        "address": "0x1234567890123456789012345678901234567890"
      }
    }
  ],
  "evaluatedPolicies": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "scope": "project",
      "updatedAt": "2026-09-01T12:00:00Z"
    }
  ]
}

Authorizations

Authorization

string

header

required

A JWT signed using your CDP API Key Secret, encoded in base64. Refer to the Generate Bearer Token section of our Authentication docs for information on how to generate your Bearer Token.

Body

application/json

SignEvmTransactionSimulationInput
SendEvmTransactionSimulationInput
SignEvmHashSimulationInput
SignEvmMessageSimulationInput
SignEvmTypedDataSimulationInput
PrepareUserOperationSimulationInput
SendUserOperationSimulationInput
SignSolTransactionSimulationInput
SendSolTransactionSimulationInput
SignSolMessageSimulationInput
SignEndUserEvmHashSimulationInput
SignEndUserEvmTransactionSimulationInput
SendEndUserEvmTransactionSimulationInput
SignEndUserEvmMessageSimulationInput
SignEndUserEvmTypedDataSimulationInput
SendEndUserOperationSimulationInput
SignEndUserSolTransactionSimulationInput
SendEndUserSolTransactionSimulationInput
SignEndUserSolMessageSimulationInput
SendEndUserEvmAssetSimulationInput
SendEndUserSolAssetSimulationInput
CreateEndUserEvmSwapSimulationInput

Inputs for one operation, without signing credentials. operation is the policy rule operation name (for example signSolTransaction), not the HTTP operation ID (signSolanaTransaction).

operation

enum<string>

required

Rule operation to simulate.

Available options:

signEvmTransaction

address

string

required

The 0x-prefixed address of the EVM account.

Pattern: ^0x[0-9a-fA-F]{40}$

transaction

string

required

The RLP-encoded transaction to evaluate, as a 0x-prefixed hex string.

Example:

"0x02f082210580843b9aca00847735940082520894123456789012345678901234567890123456789087038d7ea4c6800080c0"

Response

Policy simulation result.

The action the real operation would take and why. matchedRule is present exactly when reason is rule_accepted or rule_rejected.

action

enum<string>

required

Whether the real operation would be accepted or rejected.

Available options:

accept,

reject

Example:

"reject"

reason

enum<string>

required

Why the operation got its action. Each value implies exactly one action. Within a policy, a matching reject rule overrides any matching accept rule, regardless of rule order. With accept: rule_accepted means matchedRule matched all of its criteria, its action is accept, and no reject rule in the same policy matched. no_rule_for_operation means no rule targeted the operation, so it was accepted by default. With reject: rule_rejected means matchedRule matched all of its criteria and its action is reject, so the rejection is caused by the entire rule. no_rule_matched means at least one rule targeted the operation but none matched, so it was rejected by default; unmatchedRules shows the criterion that disqualified each one.

Available options:

rule_accepted,

rule_rejected,

no_rule_matched,

no_rule_for_operation

Example:

"no_rule_matched"

unmatchedRules

object[]

required

Rules targeting the operation that were evaluated and did not match. Within a policy, reject rules are evaluated before accept rules, and evaluation stops at matchedRule. Rules that were not evaluated are omitted. When there is no matchedRule, every rule that targeted the operation appears here. Among matching rules with the same action, the first in policy order is matchedRule.

Show child attributes

evaluatedPolicies

object[]

required

Policies iterated, in order: the project policy, then the account policy. Evaluation stops at the policy containing matchedRule. End-user operations consult only the project policy.

Show child attributes

matchedRule

object

The rule whose action decided the evaluation.

Show child attributes

Example:

{
  "policy": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "scope": "project",
    "updatedAt": "2026-09-01T12:00:00Z"
  },
  "ruleIndex": 1,
  "rule": {
    "action": "reject",
    "operation": "signEvmTransaction",
    "criteria": [
      {
        "type": "ethValue",
        "ethValue": "1000000000000000000",
        "operator": ">"
      }
    ]
  },
  "observations": [
    {
      "type": "ethValue",
      "ethValue": "2500000000000000000"
    }
  ]
}

evaluatedUnit

EvaluatedUnit · object

The unit this result describes. Present only when the operation was evaluated as more than one unit: one unit per call for user operations, and one unit per signing account for Solana transactions. Each unit is evaluated against the policies separately, and matchedRule, unmatchedRules, evaluatedPolicies, and every observed value describe this unit only. When action is reject, this is the first unit that was rejected. When action is accept, every unit was accepted and this is the last one.

Show child attributes

Example:

{ "index": 2, "count": 3 }