---
title: "Check a custom-deploy manifest before deploying it"
method: POST
path: "/platform/manifest/validate"
tags: ["Platform"]
---

# Check a custom-deploy manifest before deploying it

`POST /platform/manifest/validate`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/platform/manifest/validate`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

Returns two kinds of finding.

`errors` are the exact reasons the create endpoint would reject the
manifest — checked by calling the same validator, not a copy, so
`valid: true` means it will not be turned away for a reason we
already know about.

`warnings` are footguns that deploy fine and then hurt: an unpinned
image, no restart policy, a published port that bypasses the reverse
proxy, `privileged`, host networking — plus the privacy findings
that matter on this product: third-party CDN/font/analytics origins,
public DNS resolvers, hardcoded timezones, literal secrets, outbound
mail, and a Tor mirror published alongside multiple clearnet routes.

Every finding carries a `fix`.

A POST that changes nothing: a manifest does not fit in a query
string. The route is pinned to the `read` scope for that reason.

## Request body

- object
  - `manifest` object, required: The manifest you would POST to /platform/deployments/custom.

## Response `200`

The inspection result

## Other responses

- `400`: No manifest supplied

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)