> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. # Validate Agent configuration source > Compiles one bounded inline Agent configuration project against the final Agent schema and answers one stateless inspection: validity, closed diagnostics with exact file/line/column provenance, server-derived source and canonical-content digests, and bounded configuration counts. The request envelope is measured against the inline transport budget before compilation, and responses never echo source text. The governed `source_revision` variant is refused as inspectable until revision fetching ships; a REST-only read that stores nothing and authorizes nothing. Checkfu support posture: alpha; hosted. Required evidence journey: blueprint-authority. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. ## OpenAPI ````yaml /openapi.json post /v1/organizations/{organization_id}/agent-blueprints/validate-source openapi: 3.1.0 info: title: Checkfu API version: '2026-08-31' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-31); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnesses - name: harnessRuntime - name: computerProfiles - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: dreams - name: modelCredentials - name: modelRoutingProfiles - name: blueprintInstallations - name: toolSources - name: skills - name: skillSources - name: agentSources - name: agentBlueprints - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: support - name: bootstrapRequests - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: fileTrees - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionHandoffs - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/organizations/{organization_id}/agent-blueprints/validate-source: post: tags: - agentBlueprints summary: Validate Agent configuration source description: >- Compiles one bounded inline Agent configuration project against the final Agent schema and answers one stateless inspection: validity, closed diagnostics with exact file/line/column provenance, server-derived source and canonical-content digests, and bounded configuration counts. The request envelope is measured against the inline transport budget before compilation, and responses never echo source text. The governed `source_revision` variant is refused as inspectable until revision fetching ships; a REST-only read that stores nothing and authorizes nothing. Checkfu support posture: alpha; hosted. Required evidence journey: blueprint-authority. Deployment-specific readiness and the latest proven release are available from GET /v1/support/capabilities. operationId: agentBlueprints.validateSource parameters: - name: organization_id in: path schema: $ref: '#/components/schemas/OrganizationId' required: true - name: checkfu-version in: header schema: type: string enum: - '2026-08-31' required: true requestBody: content: application/json: schema: $ref: '#/components/schemas/AgentConfigurationSourceRequest' required: true responses: '200': description: >- Stateless source-validation outcome: validity, diagnostics, digests, and bounded counts. content: application/json: schema: $ref: '#/components/schemas/AgentConfigurationInspection' headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: $ref: '#/components/schemas/ValidationMalformedError' '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '404': description: >- The requested resource does not exist in the resolved deployment boundary. content: application/json: schema: $ref: '#/components/schemas/ValidationNotFoundError' '413': description: The request body exceeded a documented byte ceiling. content: application/json: schema: $ref: '#/components/schemas/ValidationPayloadTooLargeError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' security: - bearerAuth: [] components: schemas: OrganizationId: type: string allOf: - pattern: ^org_[0-9a-f]{32}$ AgentConfigurationSourceRequest: type: object properties: source: $ref: '#/components/schemas/AgentConfigurationSourceInput' required: - source additionalProperties: false description: Request wrapper carrying one closed source input union. AgentConfigurationInspection: type: object properties: valid: type: boolean description: >- True when the source compiled to the canonical final-Agent configuration. source_sha256: anyOf: - type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ - type: 'null' description: >- Versioned digest over the admitted source file set; null when nothing was admitted. content_sha256: anyOf: - type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ - type: 'null' description: >- SHA-256 over the compiled canonical Agent directory files; null when invalid. compiler_version: $ref: '#/components/schemas/BoundedVersionCode' authoring_epoch: $ref: '#/components/schemas/AgentConfigurationAuthoringEpoch' diagnostics: type: array items: $ref: '#/components/schemas/AgentConfigurationInspectionDiagnostic' allOf: - maxItems: 8 description: Bounded refusals; empty exactly when valid. summary: anyOf: - $ref: '#/components/schemas/AgentConfigurationInspectionSummary' - type: 'null' description: Compiled configuration counts; null when the source is invalid. required: - valid - source_sha256 - content_sha256 - compiler_version - authoring_epoch - diagnostics - summary additionalProperties: false description: >- Stateless source-validation outcome: validity, diagnostics, digests, and bounded counts. WorkspaceId: type: string allOf: - pattern: ^wrkspc_[0-9a-f]{32}$ ValidationMalformedError: type: object properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-malformed description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The request could not be decoded or violated a declared input constraint. PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. ValidationNotFoundError: type: object properties: error: type: object properties: type: type: string enum: - validation.not_found message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-not-found description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The requested resource does not exist in the resolved deployment boundary. ValidationPayloadTooLargeError: type: object properties: error: type: object properties: type: type: string enum: - validation.payload_too_large message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#validation-payload-too-large description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: The request body exceeded a documented byte ceiling. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. AgentConfigurationSourceInput: anyOf: - type: object properties: type: type: string enum: - inline_files files: type: array items: $ref: '#/components/schemas/AgentConfigurationSourceFile' allOf: - minItems: 1 - maxItems: 256 required: - type - files additionalProperties: false - type: object properties: type: type: string enum: - source_revision source_repository_id: $ref: '#/components/schemas/SourceRepositoryId' revision: $ref: '#/components/schemas/ExactSourceRevision' root: $ref: '#/components/schemas/SourceRoot' required: - type - source_repository_id - revision - root additionalProperties: false description: Bounded inline entries or one exact governed source revision. BoundedVersionCode: type: string allOf: - pattern: ^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$ description: Server compiler version that produced this inspection. AgentConfigurationAuthoringEpoch: anyOf: - type: string enum: - checkfu.dev/v1alpha1 description: The single admitted authoring epoch. AgentConfigurationInspectionDiagnostic: type: object properties: code: $ref: '#/components/schemas/AgentConfigurationInspectionDiagnosticCode' severity: $ref: '#/components/schemas/AgentConfigurationInspectionSeverity' reason: type: string allOf: - minLength: 1 - maxLength: 512 description: >- Stable repository-authored refusal text; never echoes source bytes. path: type: string description: >- Source path spelling the diagnostic names; empty when no file applies. conflicting_path: anyOf: - type: string - type: 'null' description: >- The second path of a duplicate-representation refusal, when one exists. pointer: anyOf: - type: string - type: 'null' description: >- Canonical field pointer (/model/effort) when the refusal is field-scoped. location: $ref: '#/components/schemas/AgentConfigurationInspectionLocation' required: - code - severity - reason - path - conflicting_path - pointer - location additionalProperties: false description: One bounded source-inspection refusal with exact location provenance. AgentConfigurationInspectionSummary: type: object properties: mcp_servers: type: integer allOf: - minimum: 0 tools_agent_toolsets: type: integer allOf: - minimum: 0 tools_mcp_toolsets: type: integer allOf: - minimum: 0 tools_custom: type: integer allOf: - minimum: 0 skills: type: integer allOf: - minimum: 0 multiagent_agents: anyOf: - type: integer allOf: - minimum: 0 - type: 'null' system_from_instructions: type: boolean required: - mcp_servers - tools_agent_toolsets - tools_mcp_toolsets - tools_custom - skills - multiagent_agents - system_from_instructions additionalProperties: false description: >- Bounded counts of the compiled final-Agent configuration; null fields mean not reached. AgentConfigurationSourceFile: type: object properties: path: $ref: '#/components/schemas/CandidateSourcePath' content: type: string allOf: - pattern: ^(?!\uFEFF)[\0-\uD7FF\uE000-\u{10FFFF}]*$ - maxLength: 1048576 description: >- Write-only source text; validation and publication responses never echo it. required: - path - content additionalProperties: false description: One admitted source entry; content is write-only and never echoed. SourceRepositoryId: type: string allOf: - pattern: ^srepo_[0-9a-f]{32}$ ExactSourceRevision: anyOf: - type: object properties: type: type: string enum: - git_commit_sha1 commit_oid: $ref: '#/components/schemas/GitCommitSha1' required: - type - commit_oid additionalProperties: false - type: object properties: type: type: string enum: - git_commit_sha256 commit_oid: $ref: '#/components/schemas/GitCommitSha256' required: - type - commit_oid additionalProperties: false description: >- Exact governed revision coordinate; the server fetches and verifies the object. SourceRoot: anyOf: - type: string enum: - . - type: string allOf: - minLength: 1 - maxLength: 1024 - pattern: ^(?:[^\0\\/\n\r]+\/)*[^\0\\/\n\r]+$ - pattern: ^(?!.*(?:^|\/)\.\.(?:\/|$)).*$ - pattern: ^(?!.*(?:^|\/)\.(?:\/|$)).*$ description: Repository-confined source root; always a bounded relative path. AgentConfigurationInspectionDiagnosticCode: type: string enum: - source.path_invalid - source.file_invalid - source.parse_invalid - source.schema_invalid - source.authoring_invalid - source.duplicate_representation - source.claimed_file_missing - source.claimed_file_unknown - source.secret_like - configuration.source_unavailable description: Closed source-inspection refusal code; never a free-form string. AgentConfigurationInspectionSeverity: anyOf: - type: string enum: - error description: Closed inspection severity; every current diagnostic blocks validity. AgentConfigurationInspectionLocation: type: object properties: file: type: string start: $ref: '#/components/schemas/AgentConfigurationInspectionPosition' end: $ref: '#/components/schemas/AgentConfigurationInspectionPosition' canonical_path: anyOf: - type: string - type: 'null' derived: type: boolean required: - file - start - end - canonical_path - derived additionalProperties: false description: >- Exact source location; canonical_path is null only for path-admission failures, derived marks nearest-owner context. CandidateSourcePath: type: string allOf: - minLength: 1 - maxLength: 1024 description: >- Candidate path spelling; admission reports invalid paths as typed diagnostics. GitCommitSha1: type: string allOf: - pattern: ^[0-9a-f]{40}$ description: >- Exact lowercase SHA-1 Git commit object id; never a ref or abbreviated hash. GitCommitSha256: type: string allOf: - pattern: ^[0-9a-f]{64}$ description: >- Exact lowercase SHA-256 Git commit object id; never a ref or abbreviated hash. AgentConfigurationInspectionPosition: type: object properties: line: type: integer allOf: - exclusiveMinimum: 0 column: type: integer allOf: - exclusiveMinimum: 0 byte: type: integer allOf: - minimum: 0 required: - line - column - byte additionalProperties: false description: >- Exact 1-based line/column and 0-based UTF-8 byte offset of one diagnostic boundary. securitySchemes: bearerAuth: type: http scheme: bearer ````