---
title: "Validate App Manifest"
method: POST
path: "/apps/manifest/validate"
tags: ["Apps"]
---

# Validate App Manifest

`POST /apps/manifest/validate`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/apps/manifest/validate`
- Auth: HTTP bearer

Validate a `graph8.app.yaml` without applying it. No app id needed.

Answers 200 whether or not the manifest is valid: the question "is this
valid" was served correctly even when the answer is no, and a 422 would make
a builder's linter treat a working call as a transport failure. `valid` is
the answer; `issues` carries every problem at once, each with a path pointer,
so a whole file is fixed in one round trip.

Requires an allowlisted builder org but no app, because linting a manifest
in CI should not require naming an app or holding a credential scoped to one.

## Headers

- `Authorization` string, nullable
- `X-Org-Id` string, nullable

## Request body

- ManifestRequest: A `graph8.app.yaml` document, verbatim.
  - `manifest` string, required: The full graph8.app.yaml document as text. Sent verbatim, including newlines. Rejected above 256 KiB by the parser.

## Response `200`

Successful Response

- ApiResponseValidateManifestResponse
  - `data` ValidateManifestResponse, required: A dry run. `valid` is the answer; `issues` is why not. 200 either way. A syntactically well-formed request that asks "is this manifest valid" and gets the answer "no" has been served correctly, and a 422 would make a builder's linter treat a working call as a transport failure.
    - `valid` boolean, required
    - `summary` ManifestSummary: What a valid manifest declares. The echo of a successful parse. Deliberately a summary and not the parsed document: a builder who wants the document already has it, and echoing it back would make this response the second place the shape is defined.
      - `version` integer, required
      - `app_slug` string, nullable
      - `app_name` string, nullable
      - `object_slugs` string[]
      - `attribute_count` integer
      - `has_frontend` boolean
      - `has_backend` boolean
    - `issues` ManifestIssueResponse[]
      - `path` string, required: Pointer into the document, e.g. objects[0].attributes[1].type
      - `code` string, required: Machine-readable cause. Stable; safe to branch on.
      - `message` string, required
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)