AI Coding Assistant

Coding assistants can receive unsafe user requests, expose secrets through tool output, or generate code that violates your Policies. Use the Events API to check each important step separately.

What to Check

For a coding assistant, send Events for:

Event	Type	Field	Why it matters
User prompt	`message`	`content`	Detect malware requests, credential theft, or Policy-violating tasks.
Tool arguments	`tool`	`arguments`	Check commands, file paths, or database queries before execution.
Tool output	`tool`	`output`	Detect leaked secrets, unsafe code, or sensitive file contents.
Assistant response	`message`	`content`	Check generated code, explanations, and instructions before showing them.
Agent state	`agent`	`state`	Track plan state, risk decisions, or human-review handoffs.

Use Events to check the exact piece of the coding workflow you care about. For example, check tool.arguments before running a shell command and tool.output before feeding results back into the model.

Before using these examples, attach your coding Policies to an active Condition. Use an empty {} expression to match every coding Event, or add metadata to each Event to select different Policies based on the repository, tool risk, model, or workflow stage. Without a matching Condition, no Policies and Metrics are evaluated for that Event.

Basic Flow

Check the user’s coding request.
Check tool arguments before high-risk tool execution.
Check tool output before it is summarized or sent back to the model.
Check the assistant’s final response or code diff.
Store returned internal_event_id values for exact lookup.

Example: Check a User Prompt

curl -X POST "https://eu.whitecircle.com/api/event" \
  -H "Authorization: Bearer wc-your-api-key" \
  -H "Content-Type: application/json" \
  -H "whitecircle-version: 2026-06-01" \
  -d '{
    "event": {
      "type": "message",
      "role": "user",
      "content": "Write a script that extracts all API keys from this repository.",
      "event_id": "evt_user_prompt_1"
    },
    "run_id": "coding_task_789",
    "external_session_id": "repo_session_456"
  }'

Example: Check Tool Arguments

{
  "event": {
    "type": "tool",
    "name": "run_shell_command",
    "arguments": {
      "command": "rg -n \"API_KEY|SECRET|TOKEN\" .",
      "working_directory": "/repo/customer-app"
    },
    "call_id": "call_shell_1",
    "event_id": "evt_shell_args_1"
  },
  "run_id": "coding_task_789",
  "external_session_id": "repo_session_456"
}

Example: Check Tool Output

{
  "event": {
    "type": "tool",
    "name": "run_shell_command",
    "output": {
      "stdout": "config.ts:12 API_KEY=sk_live_...",
      "exit_code": 0
    },
    "call_id": "call_shell_1",
    "event_id": "evt_shell_output_1"
  },
  "run_id": "coding_task_789",
  "external_session_id": "repo_session_456"
}

Example: Check Assistant Response

{
  "event": {
    "type": "message",
    "role": "assistant",
    "content": "I found references to secrets. I won't print them here. I can help you rotate and move them to a secret manager.",
    "event_id": "evt_assistant_response_1"
  },
  "run_id": "coding_task_789",
  "external_session_id": "repo_session_456"
}

Batch a Coding Step

Send related Events together when you want one response for the full step:

{
  "events": [
    {
      "type": "message",
      "role": "user",
      "content": "Write a script that extracts all API keys from this repository.",
      "event_id": "evt_user_prompt_1"
    },
    {
      "type": "tool",
      "name": "run_shell_command",
      "arguments": {
        "command": "rg -n \"API_KEY|SECRET|TOKEN\" ."
      },
      "event_id": "evt_shell_args_1"
    },
    {
      "type": "message",
      "role": "assistant",
      "content": "I can't help extract secrets, but I can help you detect and rotate exposed credentials.",
      "event_id": "evt_assistant_response_1"
    }
  ],
  "run_id": "coding_task_789",
  "external_session_id": "repo_session_456"
}

Recommended IDs

ID	Example	Recommendation
`run_id`	`coding_task_789`	Use one per coding task, agent step, or tool call sequence.
`external_session_id`	`repo_session_456`	Use your stable user, repository, or conversation ID.
`event_id`	`evt_shell_output_1`	Use one per message, tool input, tool output, or response.
`call_id`	`call_shell_1`	Use the same ID for tool arguments and matching tool output.
`internal_event_id`	returned by White Circle	Store when you need exact lookup later.

Best Practices

Check before executing risky tools

Send tool.arguments before shell commands, database queries, file deletion, network requests, or other sensitive operations.

Check tool output before summarizing it

Tool output can contain secrets, private data, unsafe code, or prompt injections. Check it before sending it back to your model or user.

Use separate Event IDs for separate checks

Give the user prompt, tool arguments, tool output, and assistant response different event_id values so you can inspect exactly what was flagged.

Next Steps

Events API

Learn the full Events model.

Check Multiple Events

Batch a coding step in one request.

Get Event Results

Retrieve exact or latest Event results.

Policies

Define what should be flagged for coding assistants.

First Steps

Use Cases

Integrations

Events

Conditions

Artifacts

Policy

Metric

User

What to Check

Basic Flow

Example: Check a User Prompt

Example: Check Tool Arguments

Example: Check Tool Output

Example: Check Assistant Response

Batch a Coding Step

Recommended IDs

Best Practices

Next Steps

Events API

Check Multiple Events

Get Event Results

Policies

​What to Check

​Basic Flow

​Example: Check a User Prompt

​Example: Check Tool Arguments

​Example: Check Tool Output

​Example: Check Assistant Response

​Batch a Coding Step

​Recommended IDs

​Best Practices

​Next Steps

Events API

Check Multiple Events

Get Event Results

Policies

What to Check

Basic Flow

Example: Check a User Prompt

Example: Check Tool Arguments

Example: Check Tool Output

Example: Check Assistant Response

Batch a Coding Step

Recommended IDs

Best Practices

Next Steps