> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate authored rule source without saving it.

> Canonicalises the public source and compiles the exact worker source in-process against the production YARA-X modules. Compiler diagnostics never expose the private worker rule identifier.



## OpenAPI

````yaml https://api.infrawatch.com/openapi.json?contract=d15375c post /rules/validate
openapi: 3.1.0
info:
  description: >-
    Customer-facing Infrawatch APIs. Authenticate with an API key unless an
    operation documents another supported credential.


    ### Infrawatch Public API


    Public API authenticated exclusively with Infrawatch API keys.


    ### Infrawatch Customer Alerting API


    Project alert rules, destinations, silences, inbox state, and delivery
    history.


    ### Infrawatch Remote Browser API


    Project-scoped interactive browser sessions owned by Platform Core.


    Session admission, lifecycle, RBAC, audit, usage, screenshot history, and

    stream tickets are Platform Core resources. The browser master is private

    infrastructure and its identifiers, proxy routes, process options, and

    credentials are never exposed by this API.


    A session and all of its evidence are private to the credential that created

    it. Project managers may list project session metadata, inspect one
    session's

    metadata, and terminate it, but cannot access its live stream, screenshots,

    or network events.


    Terminal session metadata and screenshots are retained indefinitely. A

    creator can replay a terminal session as a new queued resource while

    preserving a durable link to the source session.


    ### Infrawatch ESI API


    Customer-facing External Surface Intelligence API for project-scoped

    product data authenticated by an Infrawatch API key. API keys

    are constrained to their immutable owner's project ceiling and assigned

    ESI scopes; human project-manager fallback never expands an API key.

    Authorised API-key requests are rate-limited and consume monthly quota.


    ### Infrawatch Reports API


    Threat report discovery API authenticated by an Infrawatch API key.


    ### Infrawatch Public Rules API


    Account-aware rule authoring, taxonomy, catalogue, and runtime observations
    for API clients.


    ### Infrawatch Search API


    Search hosts, services, DNS records, and certificates. Complete
    percent-encoded query strings are limited to 65536 bytes.
  title: Infrawatch Customer API
  version: 1.0.0
servers:
  - description: Infrawatch customer API
    url: https://api.infrawatch.com/api/v1
security: []
tags:
  - name: API Usage
  - name: Projects
  - name: Alert destinations
  - name: Alert rules
  - name: Alert silences
  - name: Alerts
  - name: Browser sessions
  - name: Browser evidence
  - name: Browser streaming
  - name: Access
  - name: Inventory
  - name: Dangling DNS
  - name: Findings
  - name: Secrets
  - name: Typosquatting
  - name: Services
  - name: AI Surface
  - description: Search hosts, services, DNS records, certificates, and open directories.
    name: Search
  - name: Dashboard
  - name: Reports
  - name: Rules
  - name: Rule tags
  - name: Rule observations
paths:
  /rules/validate:
    servers:
      - url: https://api.infrawatch.com/api/v1
    post:
      tags:
        - Rules
      summary: Validate authored rule source without saving it.
      description: >-
        Canonicalises the public source and compiles the exact worker source
        in-process against the production YARA-X modules. Compiler diagnostics
        never expose the private worker rule identifier.
      operationId: validateRuleSource
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/rules_v1_ValidateRuleSourceRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: false
                properties:
                  validation:
                    $ref: '#/components/schemas/rules_v1_RuleSourceValidation'
                required:
                  - validation
                type: object
          description: Validation result.
          headers:
            X-Infrawatch-Protobuf-Commit:
              $ref: '#/components/headers/rules_v1_RuleProtobufCommit'
            X-Infrawatch-YARA-Runtime-Commit:
              $ref: '#/components/headers/rules_v1_RuleYARARuntimeCommit'
        '400':
          $ref: '#/components/responses/rules_v1_BadRequest'
        '403':
          $ref: '#/components/responses/rules_v1_Forbidden'
        '503':
          $ref: '#/components/responses/rules_v1_RuleRuntimeUnavailable'
      security:
        - apiKeyAuth: []
components:
  schemas:
    rules_v1_ValidateRuleSourceRequest:
      additionalProperties: false
      properties:
        input_kind:
          allOf:
            - $ref: '#/components/schemas/rules_v1_RuleInputKind'
          description: Omit to infer the input kind from the parsed rule source.
        name:
          description: >-
            Optional analyst-facing label; the rule identifier in source is used
            when omitted.
          maxLength: 200
          minLength: 1
          type: string
        source:
          maxLength: 1048576
          minLength: 1
          type: string
      required:
        - source
      type: object
    rules_v1_RuleSourceValidation:
      additionalProperties: false
      properties:
        error:
          maxLength: 4000
          type: string
        source:
          maxLength: 1048576
          type: string
        valid:
          type: boolean
        validated_at:
          format: date-time
          type: string
      required:
        - valid
        - validated_at
      type: object
    rules_v1_RuleInputKind:
      enum:
        - scan_result
        - certificate_event
      type: string
  headers:
    rules_v1_RuleProtobufCommit:
      description: Protobuf commit used by the linked rule modules.
      schema:
        pattern: ^[0-9a-f]{12,64}$
        type: string
    rules_v1_RuleYARARuntimeCommit:
      description: >-
        Collection YARA runtime commit or deterministic development build
        identity.
      schema:
        pattern: ^[0-9a-f]{40,64}$
        type: string
  responses:
    rules_v1_BadRequest:
      description: Invalid request.
    rules_v1_Forbidden:
      description: Permission denied.
    rules_v1_RuleRuntimeUnavailable:
      description: >-
        The in-process rule compiler is unavailable or exceeded its request
        deadline.
  securitySchemes:
    apiKeyAuth:
      description: >-
        Infrawatch API key. Supply the complete key directly as the header
        value.
      in: header
      name: X-API-Key
      type: apiKey

````