## Validate

**post** `/zones/{zoneId}/providers/{id}/validate`

Runs on-demand OIDC connection checks (issuer reachability, metadata retrieval, endpoint consistency, authorization endpoint reachability, and a demonstration client_credentials exchange) against the provider and returns a per-check result. Results are not persisted.

### Path Parameters

- `zoneId: string`

- `id: string`

### Returns

- `ValidationResult = object { checks, provider_id, status, validated_at }`

  Result of running the provider OIDC connection checks on demand. Not persisted.

  - `checks: array of object { check, status, detail }`

    Per-check results, in execution order

    - `check: "issuer_reachability" or "metadata_retrieval" or "endpoint_consistency" or 2 more`

      Identifier of an individual provider validation check

      - `"issuer_reachability"`

      - `"metadata_retrieval"`

      - `"endpoint_consistency"`

      - `"authorization_endpoint_reachability"`

      - `"credential_exchange"`

    - `status: "pass" or "fail" or "skipped_with_reason" or "not_applicable"`

      Outcome of a single check. `pass`/`fail` mean the check ran. `skipped_with_reason` means it could not run because a prerequisite is missing on our side (e.g. no credential stored). `not_applicable` means the check does not apply to this provider class (e.g. a login-flow-only provider that does not advertise the `client_credentials` grant) — render as a neutral state, distinct from a failure. Neither `skipped_with_reason` nor `not_applicable` fails the overall run.

      - `"pass"`

      - `"fail"`

      - `"skipped_with_reason"`

      - `"not_applicable"`

    - `detail: optional string`

      Human-readable explanation, present on `fail`, `skipped_with_reason`, and `not_applicable`.

  - `provider_id: string`

    Provider that was validated

  - `status: "pass" or "fail"`

    Overall outcome. `fail` when any individual check failed; skipped checks do not fail the run.

    - `"pass"`

    - `"fail"`

  - `validated_at: string`

    When the validation run completed

### Example

```http
curl https://api.keycard.ai/zones/$ZONE_ID/providers/$ID/validate \
    -X POST \
    -H "Authorization: Bearer $KEYCARD_API_API_KEY"
```