One call immediately before the consequential action.

curl https://api.tekcapitol.com/v1/check-write \
  -H "Authorization: Bearer $TEKCAPITOL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "system": "Salesforce",
    "objectType": "Opportunity",
    "objectRef": "006ABC123",
    "field": "StageName",
    "agentValue": "Closed Won",
    "authoritySource": "sales_ops",
    "authorityFound": true,
    "metadata": {
      "agent": "renewal-agent",
      "context": { "contract_signed": true }
    }
  }'

import os, requests

r = requests.post(
    "https://api.tekcapitol.com/v1/check-write",
    headers={"Authorization": f"Bearer {os.environ['TEKCAPITOL_API_KEY']}"},
    json={
        "system": "Salesforce",
        "objectType": "Opportunity",
        "objectRef": "006ABC123",
        "field": "StageName",
        "agentValue": "Closed Won",
        "authoritySource": "sales_ops",
        "authorityFound": True,
        "metadata": {
            "agent": "renewal-agent",
            "context": {"contract_signed": True},
        },
    },
    timeout=15,
)
print(r.json())

const res = await fetch("https://api.tekcapitol.com/v1/check-write", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${process.env.TEKCAPITOL_API_KEY}`,
  },
  body: JSON.stringify({
    system: "Salesforce",
    objectType: "Opportunity",
    objectRef: "006ABC123",
    field: "StageName",
    agentValue: "Closed Won",
    authoritySource: "sales_ops",
    authorityFound: true,
    metadata: {
      agent: "renewal-agent",
      context: { contract_signed: true },
    },
  }),
});
console.log(await res.json());

Export TEKCAPITOL_API_KEY and call the branded host: POST https://api.tekcapitol.com/v1/check-write (legacy apex path https://tekcapitol.com/api/v1/check-write remains compatible).

For protected production actions, no valid Check Write™ decision means do not execute the write. The @tekcapitol/tc-protect-sdk includes timeout and invalid-response fail-closed handling. Source and runnable examples: GitHub.

{
  "decision": "pause",
  "reason_code": "authority_unverified",
  "reason": "Current authority could not be confirmed",
  "decision_id": "cw_…",
  "timestamp": "2026-08-20T…"
}

API values are lowercase allow | pause | block. Treat them as Allow, Pause, Block in product UX.

# Pseudocode: only call Salesforce after decision == allow
# if decision != allow: exit / route to human review

decision = r.json()
if str(decision.get("decision", "")).lower() == "allow":
    update_salesforce_opportunity()  # your write
elif str(decision.get("decision", "")).lower() == "pause":
    surface_review_state(decision)   # do not write
else:
    stop_action(decision)            # BLOCK: do not write

const decision = await res.json();
if (String(decision.decision).toLowerCase() === "allow") {
  await updateSalesforceOpportunity(); // your write
} else if (String(decision.decision).toLowerCase() === "pause") {
  await surfaceReviewState(decision);  // do not write
} else {
  throw new Error(decision.reason || "blocked"); // do not write
}