# Historical beta1 curl example

Hosted Evaluate is in controlled free soak (2026-09-16.beta2), with restricted
access, x402 off, and no GA. Selection is not execution.

The command below remains the pinned beta1 teaching shape. Its version header
is historical; use the separately approved beta2 contract and configuration
for hosted soak requests. The kit does not issue credentials. Its `.invalid`
authorization URL remains a historical non-routable placeholder.

First, use the offline fixture and conformance commands from `../README.md`.
Only after DeltaX separately issues an HTTPS base URL and scoped machine token,
set all three values below in a protected shell environment:

```sh
export DELTAX_BASE_URL="https://SEPARATELY_ISSUED_HOST"
export DELTAX_ACCESS_TOKEN="SEPARATELY_ISSUED_TOKEN"
export DELTAX_IDEMPOTENCY_KEY="client-generated-key-0001"
```

Before sending anything, confirm the values are for the intended authorized
environment. The command makes one request, follows no redirects, performs no
retry, and times out after five seconds:

```sh
: "${DELTAX_BASE_URL:?DeltaX has not issued a base URL}"
: "${DELTAX_ACCESS_TOKEN:?DeltaX has not issued an access token}"
: "${DELTAX_IDEMPOTENCY_KEY:?Generate a unique 16-128 character key}"

case "${DELTAX_BASE_URL}" in
  https://*) ;;
  *)
    echo "Refusing a non-HTTPS DeltaX base URL" >&2
    exit 2
    ;;
esac

DELTAX_ORIGIN_REMAINDER="${DELTAX_BASE_URL#https://}"
DELTAX_ORIGIN_REMAINDER="${DELTAX_ORIGIN_REMAINDER%/}"
case "${DELTAX_ORIGIN_REMAINDER}" in
  ""|*/*|*\?*|*\#*|*@*)
    echo "Refusing a base URL that is not an HTTPS origin" >&2
    exit 2
    ;;
  *.[iI][nN][vV][aA][lL][iI][dD]|*.[iI][nN][vV][aA][lL][iI][dD]:*)
    echo "Refusing the non-routable design placeholder" >&2
    exit 2
    ;;
esac

curl --fail-with-body --silent --show-error \
  --proto '=https' \
  --max-time 5 \
  --request POST \
  --url "${DELTAX_BASE_URL%/}/v1/evaluations" \
  --header "Authorization: Bearer ${DELTAX_ACCESS_TOKEN}" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json, application/problem+json" \
  --header "X-DeltaX-API-Version: 2026-09-16.beta1" \
  --header "Idempotency-Key: ${DELTAX_IDEMPOTENCY_KEY}" \
  --data-binary @- <<'JSON'
{
  "profile_id": "deltax-hosted-bounded-review-evaluation-v1",
  "objective": "Choose the next bounded review step for a synthetic evidence packet.",
  "context": {
    "fixture_id": "synthetic-evidence-review-001",
    "evidence_state": "operator_reported",
    "desired_effect": "none"
  },
  "candidates": [
    {
      "candidate_id": "analyze-completeness",
      "semantic_class": "analyze",
      "description": "Analyze the packet for missing bounded evidence labels.",
      "operator_reported_support": 0.91
    },
    {
      "candidate_id": "external-publish",
      "semantic_class": "external",
      "description": "Publish the packet outside the review boundary.",
      "operator_reported_support": 0.99
    }
  ]
}
JSON
```

Treat `selected_candidate_id` only as a bounded evaluation result. Never
execute it from this response. Verify that every `trace` effect flag and every
`authority` flag is exactly `false`; the Python reference client demonstrates
that fail-closed check.

Only `408`, `429`, and `503` are retryable. This example intentionally leaves
retry policy to the caller so that a separately reviewed attempt ceiling,
jitter, and end-to-end deadline remain explicit.