---
title: "This will validate a key definition."
method: POST
path: "/tyk/keys/preview"
tags: ["Keys"]
---

# This will validate a key definition.

`POST /tyk/keys/preview`

This will check if the body of a key definition is valid. And return a response with how the key would look like if you were to create it.

## Request body

- SessionState
  - `access_rights` object, nullable
  - `alias` string
  - `allowance` number, double
  - `apply_policies` string[], nullable
  - `apply_policy_id` string — deprecated use apply_policies going forward instead to send a list of policies ids
  - `basic_auth_data` BasicAuthData
    - `hash_type` string
    - `password` string
  - `certificate` string
  - `data_expires` integer
  - `date_created` string, date-time
  - `enable_detail_recording` boolean — deprecated use enable_detailed_recording going forward instead
  - `enable_detailed_recording` boolean
  - `enable_http_signature_validation` boolean
  - `expires` integer
  - `hmac_enabled` boolean
  - `hmac_string` string
  - `id_extractor_deadline` integer
  - `is_inactive` boolean
  - `jwt_data` JWTData
    - `secret` string
  - `last_check` integer
  - `last_updated` string
  - `max_query_depth` integer
  - `meta_data` object, nullable
  - `monitor` Monitor
    - `trigger_limits` number[], nullable
  - `oauth_client_id` string
  - `oauth_keys` object, nullable
  - `org_id` string
  - `per` number, double
  - `post_expiry_action` 'retain' | 'delete' — Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
  - `post_expiry_grace_period` integer — Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
  - `quota_max` integer
  - `quota_remaining` integer
  - `quota_renewal_rate` integer
  - `quota_renews` integer
  - `rate` number, double
  - `rsa_certificate_id` string
  - `session_lifetime` integer
  - `smoothing` RateLimitSmoothing, nullable
    - `delay` integer
    - `enabled` boolean
    - `step` integer
    - `threshold` integer
    - `trigger` number
  - `tags` string[], nullable
  - `throttle_interval` number, double
  - `throttle_retry_limit` integer

## Response `200`

Key definition is valid.

- SessionState
  - `access_rights` object, nullable
  - `alias` string
  - `allowance` number, double
  - `apply_policies` string[], nullable
  - `apply_policy_id` string — deprecated use apply_policies going forward instead to send a list of policies ids
  - `basic_auth_data` BasicAuthData
    - `hash_type` string
    - `password` string
  - `certificate` string
  - `data_expires` integer
  - `date_created` string, date-time
  - `enable_detail_recording` boolean — deprecated use enable_detailed_recording going forward instead
  - `enable_detailed_recording` boolean
  - `enable_http_signature_validation` boolean
  - `expires` integer
  - `hmac_enabled` boolean
  - `hmac_string` string
  - `id_extractor_deadline` integer
  - `is_inactive` boolean
  - `jwt_data` JWTData
    - `secret` string
  - `last_check` integer
  - `last_updated` string
  - `max_query_depth` integer
  - `meta_data` object, nullable
  - `monitor` Monitor
    - `trigger_limits` number[], nullable
  - `oauth_client_id` string
  - `oauth_keys` object, nullable
  - `org_id` string
  - `per` number, double
  - `post_expiry_action` 'retain' | 'delete' — Defines the action to take on a Session in Redis after it expires. Valid values are "retain" and "delete".
  - `post_expiry_grace_period` integer — Duration in seconds to retain a Session in Redis after it expires. Used with post_expiry_action "retain". Set to -1 to retain indefinitely.
  - `quota_max` integer
  - `quota_remaining` integer
  - `quota_renewal_rate` integer
  - `quota_renews` integer
  - `rate` number, double
  - `rsa_certificate_id` string
  - `session_lifetime` integer
  - `smoothing` RateLimitSmoothing, nullable
    - `delay` integer
    - `enabled` boolean
    - `step` integer
    - `threshold` integer
    - `trigger` number
  - `tags` string[], nullable
  - `throttle_interval` number, double
  - `throttle_retry_limit` integer

## Other responses

- `403` — Forbidden
- `500` — Internal server error.

## Changes

- **2026-04-08** `dd3336b65081` — 4 info
  - added the new optional request property `post_expiry_action`
  - added the new optional request property `post_expiry_grace_period`
  - added the optional property `post_expiry_action` to the response with the `200` status
  - added the optional property `post_expiry_grace_period` to the response with the `200` status
- **2025-02-07** `3d8e4f5b3dab` — 3 breaking, 3 info
  - the response property `access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing` became nullable for the status `200`
  - the response property `access_rights/additionalProperties/limit/smoothing` became nullable for the status `200`
  - the response property `smoothing` became nullable for the status `200`
  - the request property `access_rights/additionalProperties/endpoints/items/methods/items/limit/smoothing` became nullable
  - …2 more
- **2024-09-18** `111affa17abe` — 1 info
  - endpoint added
- **2022-05-24** `111d8ca21864` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/changes/tyk/keys/preview/post.md)

---

[API](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api.md) · [All operations](https://skmtc.dev/tyktechnologies/apis/tyk-gateway-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tyktechnologies/tyk-gateway-api/revisions/900d0a33ae1d/schema)