# Validate a .flow source without saving it

`POST /v1/workflows/validate`

- Authentication: required (Bearer token)
- Required scope: `api.workflows.view`

Parses and analyses a `.flow` source against this organization's
segment, template, topic and attribute names, and stores nothing. This
is the cheap authoring loop: every finding comes back with its **line
and column**, so a mistake is a one-shot fix rather than a guess.

Always `200`, including for a source that does not parse — "is this
valid" is the question, and `valid: false` is an answer rather than a
failure. `triggers` says what the definition would enrol on, and
`send_steps` counts its steps that send email or call a webhook at any
depth, which is the number that decides whether activating it forces the
send-approval gate. Both are null when the source did not compile.

Sits on `api.workflows.view` rather than the manage scope: linting a
source the caller already holds changes nothing, and an author drafting
in CI should not need the permission that can arm a live journey.

## Request body

Content type: `application/json`

```json
{
  "source": "string"
}
```

## Example request

```bash
curl -X POST 'https://api.sendops.dev/v1/workflows/validate' \
  -H "Authorization: Bearer $SENDOPS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"source":"string"}'
```

## Responses

### 200 — The validation result — valid or not, with positioned diagnostics

Content type: `application/json`

```json
{
  "valid": true,
  "diagnostics": [
    {
      "line": 0,
      "column": 0,
      "severity": "string",
      "message": "string"
    }
  ],
  "triggers": {
    "segment_keys": [
      "string"
    ],
    "event_names": [
      "string"
    ],
    "activity_names": [
      "string"
    ],
    "date_rel": [
      {
        "attribute": "string",
        "before": true,
        "amount": 0,
        "unit": "string"
      }
    ]
  },
  "send_steps": 0
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 422 — A query parameter, path value or body field failed validation.

The body is a `validation_failed` Problem. When the refusal is about a
reference — a segment key, template slug, topic or attribute name the
organization does not have — it additionally carries `validation_code`,
`field`, `line`/`column`, `missing`, `candidates` and `next_step`, so a
client can correct the call without a second round of guessing. See
`ValidationProblem`.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ],
  "validation_code": "invalid_syntax",
  "field": "string",
  "line": 0,
  "column": 0,
  "missing": [
    {
      "kind": "segment",
      "key": "string"
    }
  ],
  "candidates": {},
  "next_step": "string"
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```