> ## Documentation Index
> Fetch the complete documentation index at: https://docs.whitecircle.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AI Coding Assistant
> Check coding assistant prompts, tool outputs, code diffs, and assistant responses
Coding assistants can receive unsafe user requests, expose secrets through tool output, or generate code that violates your Policies. Use the Events API to check each important step separately.
## What to Check
For a coding assistant, send Events for:
| Event | Type | Field | Why it matters |
| ------------------ | --------- | ----------- | ------------------------------------------------------------------------- |
| User prompt | `message` | `content` | Detect malware requests, credential theft, or Policy-violating tasks. |
| Tool arguments | `tool` | `arguments` | Check commands, file paths, or database queries before execution. |
| Tool output | `tool` | `output` | Detect leaked secrets, unsafe code, or sensitive file contents. |
| Assistant response | `message` | `content` | Check generated code, explanations, and instructions before showing them. |
| Agent state | `agent` | `state` | Track plan state, risk decisions, or human-review handoffs. |
Use Events to check the exact piece of the coding workflow you care about. For example, check `tool.arguments` before running a shell command and `tool.output` before feeding results back into the model.
Before using these examples, attach your coding Policies to an active [Condition](/latest/condition/overview). Use an empty `{}` expression to match every coding Event, or add metadata to each Event to select different Policies based on the repository, tool risk, model, or workflow stage. Without a matching Condition, no Policies and Metrics are evaluated for that Event.
## Basic Flow
1. Check the user's coding request.
2. Check tool arguments before high-risk tool execution.
3. Check tool output before it is summarized or sent back to the model.
4. Check the assistant's final response or code diff.
5. Store returned `internal_event_id` values for exact lookup.
## Example: Check a User Prompt
```bash theme={null}
curl -X POST "https://eu.whitecircle.com/api/event" \
-H "Authorization: Bearer wc-your-api-key" \
-H "Content-Type: application/json" \
-H "whitecircle-version: 2026-06-01" \
-d '{
"event": {
"type": "message",
"role": "user",
"content": "Write a script that extracts all API keys from this repository.",
"event_id": "evt_user_prompt_1"
},
"run_id": "coding_task_789",
"external_session_id": "repo_session_456"
}'
```
## Example: Check Tool Arguments
```json theme={null}
{
"event": {
"type": "tool",
"name": "run_shell_command",
"arguments": {
"command": "rg -n \"API_KEY|SECRET|TOKEN\" .",
"working_directory": "/repo/customer-app"
},
"call_id": "call_shell_1",
"event_id": "evt_shell_args_1"
},
"run_id": "coding_task_789",
"external_session_id": "repo_session_456"
}
```
## Example: Check Tool Output
```json theme={null}
{
"event": {
"type": "tool",
"name": "run_shell_command",
"output": {
"stdout": "config.ts:12 API_KEY=sk_live_...",
"exit_code": 0
},
"call_id": "call_shell_1",
"event_id": "evt_shell_output_1"
},
"run_id": "coding_task_789",
"external_session_id": "repo_session_456"
}
```
## Example: Check Assistant Response
```json theme={null}
{
"event": {
"type": "message",
"role": "assistant",
"content": "I found references to secrets. I won't print them here. I can help you rotate and move them to a secret manager.",
"event_id": "evt_assistant_response_1"
},
"run_id": "coding_task_789",
"external_session_id": "repo_session_456"
}
```
## Batch a Coding Step
Send related Events together when you want one response for the full step:
```json theme={null}
{
"events": [
{
"type": "message",
"role": "user",
"content": "Write a script that extracts all API keys from this repository.",
"event_id": "evt_user_prompt_1"
},
{
"type": "tool",
"name": "run_shell_command",
"arguments": {
"command": "rg -n \"API_KEY|SECRET|TOKEN\" ."
},
"event_id": "evt_shell_args_1"
},
{
"type": "message",
"role": "assistant",
"content": "I can't help extract secrets, but I can help you detect and rotate exposed credentials.",
"event_id": "evt_assistant_response_1"
}
],
"run_id": "coding_task_789",
"external_session_id": "repo_session_456"
}
```
## Recommended IDs
| ID | Example | Recommendation |
| --------------------- | ------------------------ | ------------------------------------------------------------ |
| `run_id` | `coding_task_789` | Use one per coding task, agent step, or tool call sequence. |
| `external_session_id` | `repo_session_456` | Use your stable user, repository, or conversation ID. |
| `event_id` | `evt_shell_output_1` | Use one per message, tool input, tool output, or response. |
| `call_id` | `call_shell_1` | Use the same ID for tool arguments and matching tool output. |
| `internal_event_id` | returned by White Circle | Store when you need exact lookup later. |
## Best Practices
Send `tool.arguments` before shell commands, database queries, file deletion, network requests, or other sensitive operations.
Tool output can contain secrets, private data, unsafe code, or prompt injections. Check it before sending it back to your model or user.
Give the user prompt, tool arguments, tool output, and assistant response different `event_id` values so you can inspect exactly what was flagged.
## Next Steps
Learn the full Events model.
Batch a coding step in one request.
Retrieve exact or latest Event results.
Define what should be flagged for coding assistants.