---
title: "Validate Papr login or share token for cloud mini-app access"
method: POST
path: "/v1/cloud/apps/access/validate"
tags: ["v1", "Cloud Infrastructure"]
---

# Validate Papr login or share token for cloud mini-app access

`POST /v1/cloud/apps/access/validate`

## Request

- Base URL: `https://memory.papr.ai`
- URL: `https://memory.papr.ai/v1/cloud/apps/access/validate`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

## Request body

- AppAccessValidateRequest
  - `external_user_id` string, nullable: Parse _User.objectId of the acting user (desktop OAuth). Used for ownership-scoped cloud operations instead of the API key user.
  - `namespaceId` string, required
  - `slug` string, required
  - `orgId` string, nullable
  - `userId` string, nullable
  - `appId` string, nullable
  - `paprApiKey` string, nullable
  - `shareToken` string, nullable
  - `callerEmail` string, nullable: Session email for share-audience people allowlists (defense in depth)

## Response `200`

Successful Response

- AppAccessValidateResponse
  - `allowed` boolean
  - `ownerKey` string, nullable
  - `orgId` string, required
  - `namespaceId` string, required
  - `userId` string, required
  - `appId` string, required
  - `mode` string, required
  - `canRead` boolean, required
  - `canWrite` boolean, required
  - `canInstallCode` boolean
  - `role` string, nullable
  - `callerUserId` string, nullable: Acting caller resolved by memory (session user, or API key user / validated external_user_id). Hosts use this, never a raw header claim.

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-29** `6fc381dc78b3`: 2 info
  - added the optional property `allowed` to the response with the `200` status
  - added the optional property `ownerKey` to the response with the `200` status
- **2026-10-17** `85b2953e02c4`: 1 info
  - added the optional property `callerUserId` to the response with the `200` status
- **2026-10-16** `0e7a5c0d125d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/papr-ai/apis/papr-memory-api/changes/v1/cloud/apps/access/validate/post.md)

---

[API](https://skmtc.dev/papr-ai/apis/papr-memory-api.md) - [All operations](https://skmtc.dev/papr-ai/apis/papr-memory-api/llms.txt) - [OpenAPI document](https://skmtc.dev/papr-ai/apis/papr-memory-api/revisions/6fc381dc78b3?raw)