---
title: "Validate provider connection"
method: POST
path: "/zones/{zoneId}/providers/{id}/validate"
tags: ["Providers"]
---

# Validate provider connection

`POST /zones/{zoneId}/providers/{id}/validate`

Runs on-demand OIDC connection checks (issuer reachability, metadata retrieval, endpoint consistency, authorization endpoint reachability, and a demonstration client_credentials exchange) against the provider and returns a per-check result. Results are not persisted.

## Path parameters

- `zoneId` string, required
- `id` string, required

## Response `200`

Result of running the provider OIDC connection checks on demand. Not persisted.

- IamProviderValidationResult — Result of running the provider OIDC connection checks on demand. Not persisted.
  - `provider_id` string, required — Provider that was validated
  - `status` 'pass' | 'fail', required — Overall outcome. `fail` when any individual check failed; skipped checks do not fail the run.
  - `checks` IamProviderValidationCheck[], required — Per-check results, in execution order
    - `check` 'issuer_reachability' | 'metadata_retrieval' | 'endpoint_consistency' | 'authorization_endpoint_reachability' | 'credential_exchange', required — Identifier of an individual provider validation check
    - `status` 'pass' | 'fail' | 'skipped_with_reason' | 'not_applicable', required — Outcome of a single check. `pass`/`fail` mean the check ran. `skipped_with_reason` means it could not run because a prerequisite is missing on our side (e.g. no credential stored). `not_applicable` means the check does not apply to this provider class (e.g. a login-flow-only provider that does not advertise the `client_credentials` grant) — render as a neutral state, distinct from a failure. Neither `skipped_with_reason` nor `not_applicable` fails the overall run.
    - `detail` string — Human-readable explanation, present on `fail`, `skipped_with_reason`, and `not_applicable`.
  - `validated_at` string, date-time, required — When the validation run completed

## Other responses

- `404` — Error response
- `502` — Error response
- `504` — Error response
- `default` — Error response

## Changes

- **2026-08-26** `d65d51379d93` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/keycardai/apis/untitled-api/changes/zones/:zoneId/providers/:id/validate/post.md)

---

[API](https://skmtc.dev/keycardai/apis/untitled-api.md) · [All operations](https://skmtc.dev/keycardai/apis/untitled-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/keycardai/untitled-api/revisions/d65d51379d93/schema)