# Validate application permission policy

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

Check whether the application permission policy for a role can be saved without modifying the current policy. A successful validation only means that the submitted policy satisfies the current rules.

```text
POST https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/application-policy:validate
```

## Preparation before calling

First [select a role](../roles/list-roles.md#select-a-role) and confirm that its policy can be modified. Then [view the permission schema](get-permission-schema.md#select-policy-inputs) to choose supported actions, resource types, and grant scopes. Finally, [view the role permission view](../roles/get-role-permission-view.md#confirm-the-current-policy-state) and prepare the change to validate based on the current policy state.

Prepare a [personal access token](../../../../../guides/genesis/api-keys.md) with the required permissions for the target workspace and the [target workspace ID](../../../../../guides/ai-studio/resource-center/workspace.md#copy-a-workspace-id).

## Request parameters

:::::::{div} mo-api-tabs
::::::{tab-set}
:::::{tab-item} Input example

```bash
curl -X POST "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/application-policy:validate" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -d "{
    \"schema_version\": \"$SCHEMA_VERSION\",
    \"expected_policy_version\": 1,
    \"expected_role_lifecycle_version\": 1,
    \"request_id\": \"req-001\",
    \"statements\": [
      {
        \"action_id\": \"workflow.read\",
        \"resource_type\": \"workflow\",
        \"scope_mode\": \"all\"
      }
    ]
  }"
```

:::::
:::::{tab-item} Parameter description

### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | string | Yes | Target workspace ID. |
| `role_id` | string | Yes | ID of the role whose policy is validated. |

### Request body

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `schema_version` | string | Yes | Version of the permission schema used by this policy. |
| `expected_policy_version` | integer | No | Policy version used for concurrency checks; cannot be less than 0. |
| `expected_role_lifecycle_version` | integer | Yes | Current role lifecycle version; must be greater than 0. |
| `request_id` | string | Yes | Caller-generated request ID. |
| `statements` | object array | Yes | Policy statements to validate. An empty array represents an empty policy. |
| `statements[].statement_id` | string | No | Statement ID. The service generates one when omitted. |
| `statements[].action_id` | string | Yes | Action ID in the permission schema. |
| `statements[].resource_type` | string | Yes | Resource type that matches the action. |
| `statements[].scope_mode` | string | Yes | Resource scope: `all` or `resources`. |
| `statements[].resource_id` | string | No | Resource ID used when `scope_mode` is `resources`. |
| `statements[].condition_hash` | string | No | Hash of the condition expression. |
| `statements[].target_action_id` | string | No | Target action ID when granting a permission. |
| `statements[].grant_scope_mode` | string | No | Delegable scope: `all` or `resources`. |
| `statements[].grant_delegatable` | boolean | No | Whether further delegation is allowed. |

:::::
::::::
:::::::

## Successful response

On success, returns whether the policy is valid, the hash of its normalized form, and its statement count. The policy is not written.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "OK",
  "msg": "OK",
  "data": {
    "valid": true,
    "policy_hash": "sha256:example",
    "statement_count": 1,
    "request_id": "req-001",
    "trace_id": "trace-001"
  }
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | `OK` on success. |
| `msg` | string | `OK` on success. |
| `data.valid` | boolean | Whether the policy passes validation. |
| `data.policy_hash` | string | Hash of the normalized policy. |
| `data.statement_count` | integer | Number of policy statements. |
| `data.request_id` | string | Request correlation ID. |
| `data.trace_id` | string | Trace ID. |

:::::
::::::
:::::::

## Error response

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{
  "code": "ErrParamInvalid",
  "msg": "Invalid request parameters",
  "data": null
}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | Error code. |
| `msg` | string | Error message. |
| `data` | null | — |

:::::
::::::
:::::::