---
title: "Validate a manifest document or URL (unauthenticated, public tooling)"
method: POST
path: "/v1/apps/manifest/validate"
tags: ["Apps"]
---

# Validate a manifest document or URL (unauthenticated, public tooling)

`POST /v1/apps/manifest/validate`

## Request

- Base URL: `https://api.talonic.com`
- URL: `https://api.talonic.com/v1/apps/manifest/validate`
- Auth: none required

No workspace credential is read or required: the rules are public by design, and this route reads no database and writes nothing. Rate-limited per caller IP (`apps.validate_rate_per_minute`), independent of any API key's own rate limit. Supply exactly one of `manifest_url` (fetched through the SSRF guard; discovery tries `/.well-known/talonic-app.json` then `/manifest.json`) or `content` (posted inline — in this mode the hosted origin rules, `allowed_origins`/`subscriptions_endpoint`/`surface.url`, are NOT checked, since a posted body proves no origin). `manifest_url` must be a public https URL.

## Request body

- object
  - `manifest_url` string
  - `content` object

## Response `200`

The validation outcome for every case, fetch failures included — an invalid manifest is an answer here, never a 4xx.

- AppManifestValidateResult: Response of `POST /v1/apps/manifest/validate` and the `validation` block of `POST /v1/apps/from-url` - an invalid manifest is an answer, not an error.
  - `valid` boolean
  - `mode` 'url' | 'content': How the document reached the validator. In `content` mode the hosted origin rules (allowed_origins, subscriptions_endpoint, surface.url) are NOT applied - a posted body has no origin to prove.
  - `violations` AppManifestViolation[]
    - `pointer` string: RFC 6901 JSON Pointer into the manifest, e.g. /logic/fallback_cards. A missing property names the property itself, not its parent.
    - `keyword` string
    - `message` string
  - `normalized` object: The manifest with defaults applied - surface, subscriptions, identity, requires.
  - `manifest_url` string: The URL actually fetched
  - `manifest_path` 'well-known' | 'fallback' | 'explicit': Which document answered, in `url` mode: `/.well-known/talonic-app.json` (tried first), the `/manifest.json` fallback, or an explicit document URL.

## Other responses

- `400`: Neither manifest_url nor content was provided.
- `413`: The posted content exceeds apps.hosted_manifest_max_bytes.
- `429`: Too many manifest validations from this IP within the last minute.

---

[API](https://skmtc.dev/talonic/apis/talonic-api.md) · [All operations](https://skmtc.dev/talonic/apis/talonic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/talonic/apis/talonic-api/revisions/678fe5f8c9c3?raw)