Apps

Validate a manifest document or URL (unauthenticated, public tooling)

No workspace credential is read or required: the rules are public by design, and this route reads no database and writes nothing. Rate-limited per caller IP (apps.validate_rate_per_minute), independent of any API key's own rate limit. Supply exactly one of manifest_url (fetched through the SSRF guard; discovery tries /.well-known/talonic-app.json then /manifest.json) or content (posted inline — in this mode the hosted origin rules, allowed_origins/subscriptions_endpoint/surface.url, are NOT checked, since a posted body proves no origin). manifest_url must be a public https URL.

post/v1/apps/manifest/validate

Request

  • Base URL: https://api.talonic.com
  • URL: https://api.talonic.com/v1/apps/manifest/validate
  • Auth: none required

Request body

manifest_urlstring
contentobject

Response

The validation outcome for every case, fetch failures included — an invalid manifest is an answer here, never a 4xx.

validboolean
mode'url' | 'content'

How the document reached the validator. In content mode the hosted origin rules (allowed_origins, subscriptions_endpoint, surface.url) are NOT applied - a posted body has no origin to prove.

normalizedobject

The manifest with defaults applied - surface, subscriptions, identity, requires.

manifest_urlstring

The URL actually fetched

manifest_path'well-known' | 'fallback' | 'explicit'

Which document answered, in url mode: /.well-known/talonic-app.json (tried first), the /manifest.json fallback, or an explicit document URL.

Changes

No recorded changes to this operation across all 1 revision of this API.