---
title: "Validate your policy logic with the Cloudsmith API"
description: "A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit."
canonical_url: "https://cloudsmith.com/changelog/validate-your-policy-logic-with-the-cloudsmith-api"
last_updated: "2026-10-12T12:45:53.763Z"
---
# Validate your policy logic with the Cloudsmith API

A new validate endpoint returns syntax and type errors in Rego policy logic without creating or updating anything, so you can fix them before you submit. The Create and Update endpoints run the same compilation check.  
  
Cloudsmith [policy as code](https://docs.cloudsmith.com/supply-chain-security/policy-as-code) uses Rego, the declarative policy language from Open Policy Agent (OPA).  
  
The [Workspaces Policies Validate](https://docs.cloudsmith.com/api/workspaces/policies/validate) request body has one field, `rego`, which contains the policy source:

```json
{
  "_key": "92f43b4e4ca3",
  "_type": "code",
  "code": "curl -X POST \\\n\"https://api.cloudsmith.io/v2/workspaces/$CLOUDSMITH_WORKSPACE/policies/validate/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-Api-Key: $CLOUDSMITH_API_KEY\" \\\n  -d \"$(jq -Rs '{rego: .}' < policy.rego)\"",
  "filename": null,
  "language": null,
  "markDefs": null
}
```

The submitted Rego is not stored.

Requests return:

- `is_valid`: true when `findings` contains no entries of severity `error`
- `findings`: a list describing each problem, with a severity, code, message and, where known, the line it occurs on
- `raw`: contains the full output from the Rego compiler and is empty when the policy is valid

A policy that compiles returns no findings:

```json
{
  "_key": "2c0900cfb9c3",
  "_type": "code",
  "code": "{\n  \"is_valid\": true,\n  \"findings\": [],\n  \"raw\": \"\"\n}",
  "filename": null,
  "language": null,
  "markDefs": null
}
```

If the policy doesn't compile, the response lists each problem. For example, if line 5 of the policy refers to `malicious_package` instead of `malicious_packages`, the response is:

```json
{
  "_key": "418f753c4025",
  "_type": "code",
  "code": "{\n  \"is_valid\": false,\n  \"findings\": [\n    {\n      \"severity\": \"error\",\n      \"code\": \"rego_unsafe_var_error\",\n      \"message\": \"var malicious_package is unsafe\",\n      \"line\": 5\n    }\n  ],\n  \"raw\": \"1 error occurred: policy.rego:5: rego_unsafe_var_error: var malicious_package is unsafe\"\n}",
  "filename": null,
  "language": null,
  "markDefs": null
}
```

This feature is available for Ultra and Enterprise customers using policy management with policy as code.



For more details, see [Create a policy via the Cloudsmith API](https://docs.cloudsmith.com/supply-chain-security/policy-as-code/create-a-policy-as-code#create-a-policy-via-the-cloudsmith-api) in the Cloudsmith documentation.