Validate Credentials

Test stored credentials against the target API.

POST /api/credentials/{id}/validate

Authorization

• Customer: Can validate their own credentials (resolved from the session; callers without a customer profile receive 403).

Path Parameters

Parameter	Type	Required	Description
id	string	Yes	Credential ID

Implementation status

Live validation against the target API is not yet implemented. The endpoint currently records the attempt and marks the credential valid (placeholder). Treat the valid result as "validation recorded", not a real auth probe.

Response

{
  "id": "cred_abc123",
  "validation_status": "valid",
  "validation_error": null,
  "last_validated_at": "2024-01-15T10:30:00Z"
}

Validation Status Values

Status	Description
not_tested	Never validated
valid	Validation recorded (see implementation note)
invalid	Authentication failed
expired	Token/key has expired

Side Effects

Validation:

1. Updates validationStatus and validationError
2. Updates lastValidatedAt
3. Writes a validate entry to the credential access log

Example Request

curl -X POST "https://api.traces.io/api/credentials/cred_abc123/validate" \
  -H "Authorization: Bearer <token>"

Error Responses

400 Bad Request

Credential has been revoked:

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "Cannot validate a revoked credential"
  }
}

403 Forbidden

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Access denied"
  }
}

404 Not Found

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Credential not found"
  }
}