---
title: "Validate provider connection"
method: POST
path: "/zones/{zoneId}/providers/{id}/validate"
tags: ["Providers"]
---

# Validate provider connection

`POST /zones/{zoneId}/providers/{id}/validate`

## Request

- Base URL: `https://docs.keycard.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.keycard.ai/zones/{zoneId}/providers/{id}/validate`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Client credentials
    - Token URL: `/service-account-token`

Runs on-demand OIDC connection checks (issuer reachability, metadata retrieval, endpoint consistency, authorization endpoint reachability, and a demonstration client_credentials exchange) against the provider and returns a per-check result. Results are not persisted.

## Path parameters

- `zoneId` string, required
- `id` string, required

## Response `200`

Result of running the provider OIDC connection checks on demand. Not persisted.

- IamProviderValidationResult: Result of running the provider OIDC connection checks on demand. Not persisted.
  - `provider_id` string, required: Provider that was validated
  - `status` 'pass' | 'fail', required: Overall outcome. `fail` when any individual check failed; skipped checks do not fail the run.
  - `checks` IamProviderValidationCheck[], required: Per-check results, in execution order
    - `check` 'issuer_reachability' | 'metadata_retrieval' | 'endpoint_consistency' | 'authorization_endpoint_reachability' | 'credential_exchange', required: Identifier of an individual provider validation check
    - `status` 'pass' | 'fail' | 'skipped_with_reason' | 'not_applicable', required: Outcome of a single check. `pass`/`fail` mean the check ran. `skipped_with_reason` means it could not run because a prerequisite is missing on our side (e.g. no credential stored). `not_applicable` means the check does not apply to this provider class (e.g. a login-flow-only provider that does not advertise the `client_credentials` grant) — render as a neutral state, distinct from a failure. Neither `skipped_with_reason` nor `not_applicable` fails the overall run.
    - `detail` string: Human-readable explanation, present on `fail`, `skipped_with_reason`, and `not_applicable`.
  - `validated_at` string, date-time, required: When the validation run completed

## Other responses

- `404`: Error response
- `502`: Error response
- `504`: Error response
- `default`: Error response

## Changes

- **2026-08-26** `d65d51379d93`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/changes/zones/:zoneId/providers/:id/validate/post.md)

---

[API](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api.md) - [All operations](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/llms.txt) - [OpenAPI document](https://skmtc.dev/keycardai/apis/keycard-ai-keycard-api/revisions/0dee67e0a73a?raw)