---
title: "Validate Configuration Settings"
method: POST
path: "/configuration/validation"
tags: ["Standard"]
---

# Validate Configuration Settings

`POST /configuration/validation`

Validates the configuration on an instance. This includes checking any API keys to 3rd party APIs. Returning success signals that the configuration values are all correct and valid.
Validation should return groups of related validation errors. If there are values that are out of range, it should return only those fields with appropriate code. Additionally, if other API keys are invalid, those should not be returned along with other invalid fields.
It can be called at any time after the app installation (including also the process of installation, but after the lifetime event has been sent). Also, it can be called even if the app doesn't have any configuration settings declared.

The endpoint is available for descriptor versions 1.1 and above.

## Headers

- `TR_ID` string
- `x-lc-signature` string

## Response `200`

OK

## Other responses

- `400` — Error codes: * invalidConfiguration - signals that the configuration has been validated and at least part of it is invalid. The `details` array will contain an element for each field that failed validation. If a pair of fields is invalid (like accountid/accountkey), each field should be added as a separate item in the array. For `code`, you can have the following values: - invalidValue - for values that do not respect certain formats and are validated directly in code. - invalidKey - for secrets that are validated against another API. The actual `value` will not be included in the error response. - nullValue - the field doesn't have a value set and is not optional. * invalidSetup - the setup of the app is not valid. This is used for when the setup is not a valid one, and can include even hard-coded configurations, environment setup, etc. Used mainly for private apps. The UI will show only the `message` to the user.

## Changes

- **2026-01-27** (v1) `9d9d8922a0ce` — 2 info
  - the endpoint scheme security `LanguageCloudJWSToken` was removed from the API
  - added the new optional `header` request parameter `x-lc-signature`

[Change history](https://skmtc.dev/rws/apis/app-api/changes/configuration/validation/post.md)

---

[API](https://skmtc.dev/rws/apis/app-api.md) · [All operations](https://skmtc.dev/rws/apis/app-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rws/app-api/revisions/a06e1ee1c99b/schema)