Validate application permission policy¶

Check whether the application permission policy for a role can be saved without modifying the current policy. A successful validation only means that the submitted policy satisfies the current rules.

POST https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/application-policy:validate

Preparation before calling¶

First select a role and confirm that its policy can be modified. Then view the permission schema to choose supported actions, resource types, and grant scopes. Finally, view the role permission view and prepare the change to validate based on the current policy state.

Prepare a personal access token with the required permissions for the target workspace and the target workspace ID.

Request parameters¶

Input example

curl -X POST "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/application-policy:validate" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d "{
    \"schema_version\": \"$SCHEMA_VERSION\",
    \"expected_policy_version\": 1,
    \"expected_role_lifecycle_version\": 1,
    \"request_id\": \"req-001\",
    \"statements\": [
      {
        \"action_id\": \"workflow.read\",
        \"resource_type\": \"workflow\",
        \"scope_mode\": \"all\"
      }
    ]
  }"

Parameter description

Path parameters

Parameter	Type	Required	Description
`workspace_id`	string	Yes	Target workspace ID.
`role_id`	string	Yes	ID of the role whose policy is validated.

Request body

Parameter	Type	Required	Description
`schema_version`	string	Yes	Version of the permission schema used by this policy.
`expected_policy_version`	integer	No	Policy version used for concurrency checks; cannot be less than 0.
`expected_role_lifecycle_version`	integer	Yes	Current role lifecycle version; must be greater than 0.
`request_id`	string	Yes	Caller-generated request ID.
`statements`	object array	Yes	Policy statements to validate. An empty array represents an empty policy.
`statements[].statement_id`	string	No	Statement ID. The service generates one when omitted.
`statements[].action_id`	string	Yes	Action ID in the permission schema.
`statements[].resource_type`	string	Yes	Resource type that matches the action.
`statements[].scope_mode`	string	Yes	Resource scope: `all` or `resources`.
`statements[].resource_id`	string	No	Resource ID used when `scope_mode` is `resources`.
`statements[].condition_hash`	string	No	Hash of the condition expression.
`statements[].target_action_id`	string	No	Target action ID when granting a permission.
`statements[].grant_scope_mode`	string	No	Delegable scope: `all` or `resources`.
`statements[].grant_delegatable`	boolean	No	Whether further delegation is allowed.

Successful response¶

On success, returns whether the policy is valid, the hash of its normalized form, and its statement count. The policy is not written.

Response example

{
  "code": "OK",
  "msg": "OK",
  "data": {
    "valid": true,
    "policy_hash": "sha256:example",
    "statement_count": 1,
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}

Field details

Field	Type	Description
`code`	string	`OK` on success.
`msg`	string	`OK` on success.
`data.valid`	boolean	Whether the policy passes validation.
`data.policy_hash`	string	Hash of the normalized policy.
`data.statement_count`	integer	Number of policy statements.
`data.request_id`	string	Request correlation ID.
`data.trace_id`	string	Trace ID.

Error response¶

Response example

{
  "code": "ErrParamInvalid",
  "msg": "Invalid request parameters",
  "data": null
}

Field details

Field	Type	Description
`code`	string	Error code.
`msg`	string	Error message.
`data`	null	—

Last updated on Sep 3, 2026