---
title: "POST /workspaces/{workspace}/policies/validate/"
method: POST
path: "/workspaces/{workspace}/policies/validate/"
tags: ["workspaces"]
---

# POST /workspaces/{workspace}/policies/validate/

`POST /workspaces/{workspace}/policies/validate/`

## Request

- Base URL: `https://api.cloudsmith.io/v2`
- URL: `https://api.cloudsmith.io/v2/workspaces/{workspace}/policies/validate/`
- Auth: one of:
  - API key in header `X-Api-Key`
  - HTTP basic

Check that a Rego policy compiles, without creating or updating anything. Use this to catch syntax and type errors while authoring a policy, before submitting it to the create or update endpoints, which apply the same check.

Returns `is_valid`, plus a `findings` list describing each problem with a code, a message and, where known, the line it occurs on. A policy is valid when `findings` contains nothing of severity `error`. The submitted Rego is not stored.

## Path parameters

- `workspace` string, required

## Request body

- PolicyValidateRequest: Request body for POST .../policies/validate/.
  - `rego` string, required: The Rego policy source to validate. Maximum 256 KB. Not persisted.

## Response `200`

- PolicyValidateResponse: Response body for POST .../policies/validate/.
  - `is_valid` boolean, required: True when no finding has severity 'error'.
  - `findings` PolicyValidateFinding[], required
    - `severity` string, required: Finding severity. Currently always 'error'.
    - `code` string, required: Machine-readable finding code (e.g. 'rego_type_error', 'policy_compile_error').
    - `message` string, required: Human-readable finding message.
    - `line` integer, nullable, required: 1-indexed line number in the source, if known.
  - `raw` string, required: Full raw OPA output; empty when the policy is valid.

## Other responses

- `422`
- `429`

## Changes

- **2026-10-13** `287eea61ef65`: 3 info
  - api operation id `workspaces_policies_validate_create` removed and replaced with `workspaces_policies_validate`
  - added the optional property `code` to the response with the `422` status
  - added the optional property `code` to the response with the `429` status
- **2026-09-28** `5a2bbb526f12`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cloudsmith/apis/cloudsmith-api/changes/workspaces/:workspace/policies/validate/post.md)

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api.md) - [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cloudsmith/apis/cloudsmith-api/revisions/1166a51a1a72?raw)