Gate
Protect execution with deterministic parameter hashing and single-use execution permits.
When to use it
Compute tamper-evident parameter bindings in your server before committing financial mutations.
Supported Operations & Data Contracts
Call this module with a key scoped to 'gate'. Provide the operation name and matching input dictionary.
hash · Compute Canonical Parameter HashPOST /api/v1/modules/gate
Produces a deterministic SHA-256 hash across normalized request parameters for permit binding and audit integrity.
Input Parameters
| Field | Type | Requirement | Description |
|---|---|---|---|
parameters | Record<string, string | number | boolean> | Required | Flat JSON key-value map of mutation arguments (e.g. accountId, payeeId, amount). |
Output Fields
| Field | Type | Description |
|---|---|---|
parametersHash | string (hex SHA-256) | Deterministic digest over ordered JSON representation. |
executionAuthorized | boolean (false) | Always false. Hashing does not authorize mutation without permit minting. |
Example Request Payload
JSON Request BodyContent-Type: application/json
{
"operation": "hash",
"input": {
"accountId": "acc_101",
"payeeId": "acc_202",
"amount": 5000,
"currency": "INR"
}
}Example Response
JSON Response (HTTP 200)Cache-Control: no-store
{
"module": "gate",
"output": {
"parametersHash": "8b7e28a9c3e412f8...",
"executionAuthorized": false
}
}Configuration in Graph Builder
When adding Gate into a visual component or graph workflow, configure its node runtime settings in the builder inspector:
Place Gate immediately prior to Bridge or execution adapters. Bind mutation inputs from upstream verified nodes. Downstream Bridge nodes verify this parameter hash against customer confirmation.
Direct API Code Examples
Invoke this module directly from your backend services without passing through the visual builder:
TypeScript / Node.js (Fetch)index.ts
const response = await fetch("https://api.sherlock.dev/api/v1/modules/gate", {
method: "POST",
headers: {
"Authorization": "Bearer " + process.env.SHERLOCK_API_KEY,
"Content-Type": "application/json",
},
body: JSON.stringify({
operation: "hash",
input: { accountId: "acc_101", payeeId: "acc_202", amount: 5000, currency: "INR" }
}),
});
const { output } = await response.json();
console.log("Canonical Parameter Hash:", output.parametersHash);cURL / Bashterminal
curl -X POST "$SHERLOCK_BASE_URL/api/v1/modules/gate" \
-H "Authorization: Bearer $SHERLOCK_API_KEY" \
-H "Content-Type: application/json" \
-d '{"operation":"hash","input":{"accountId":"acc_1","amount":1000}}'Current Boundaries & Guarantees
Public standalone API hashes parameters deterministically. Execution permits are minted internally by server engines during confirmed workflows. An advisory result or hash is not an execution permit.