Validate your policy logic with the Cloudsmith API

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit. The Create and Update endpoints run the same compilation check.

Cloudsmith policy as code uses Rego, the declarative policy language from Open Policy Agent (OPA).

The Workspaces Policies Validate request body has one field, rego, which contains the policy source:

curl -X POST \
"https://api.cloudsmith.io/v2/workspaces/$CLOUDSMITH_WORKSPACE/policies/validate/" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: $CLOUDSMITH_API_KEY" \
  -d "$(jq -Rs '{rego: .}' < policy.rego)"

The submitted Rego is not stored.

Requests return:

• is_valid: true when findings contains no entries of severity error
• findings: a list describing each problem, with a severity, code, message and, where known, the line it occurs on
• raw: contains the full output from the Rego compiler and is empty when the policy is valid

A policy that compiles returns no findings:

{
  "is_valid": true,
  "findings": [],
  "raw": ""
}

If the policy doesn't compile, the response lists each problem. For example, if line 5 of the policy refers to malicious_package instead of malicious_packages, the response is:

{
  "is_valid": false,
  "findings": [
    {
      "severity": "error",
      "code": "rego_unsafe_var_error",
      "message": "var malicious_package is unsafe",
      "line": 5
    }
  ],
  "raw": "1 error occurred: policy.rego:5: rego_unsafe_var_error: var malicious_package is unsafe"
}

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

For more details, see Create a policy via the Cloudsmith API in the Cloudsmith documentation.