> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Validate > Parses the SQL query and evaluates it against configured validation rules. Returns `200` if the query passes all rules. Returns `422` with violation details if the query is denied. Does not execute the query. ## OpenAPI ````yaml /developer-docs/api-reference/trustfusion-openapi-schema-1.0.0.yaml post /v1/query/validate openapi: 3.0.3 info: title: TrustFusion Facets API description: > API for all facets exposed by TrustFusion, including: - **Query**: Validate queries against validation rules, execute governed semantic queries - **Schema**: Discover semantic models, datasets, fields, relationships, and metrics - **Threats**: Discover threats and fetch a threat's investigation template or advisory by ID All endpoints require a valid Cognito JWT token. version: 1.0.0 servers: - url: https://devx.{environment}.oleria.io description: Oleria DevX Server variables: environment: default: prod description: Environment name (prod, staging, dev) enum: - prod - staging - dev security: - clientCredentials: [] paths: /v1/query/validate: post: tags: - Query summary: Validate description: > Parses the SQL query and evaluates it against configured validation rules. Returns `200` if the query passes all rules. Returns `422` with violation details if the query is denied. Does not execute the query. operationId: ValidateQuery requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/QueryRequest' examples: simple_query: summary: Simple query with named parameter value: query: >- SELECT account_id, mfa_status FROM oleria_account WHERE mfa_status = :status model: oleria_identity dialect: trino parameters: status: disabled responses: '200': description: Query passes validation rules and may proceed. content: application/json: schema: $ref: '#/components/schemas/QueryValidationResponse' example: result: allowed '400': description: SQL parsing failed or request is malformed content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Missing or invalid authentication token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Valid token but insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: Token lacks required scope for query validation '422': description: > Query denied by validation rules. The query is syntactically valid but violates one or more governance policies. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: POLICY_VIOLATION message: Query denied by validation rules reasons: - code: MUTATION_NOT_ALLOWED message: >- Only SELECT queries are permitted. Mutation statements are not allowed. '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred security: - clientCredentials: - ClientCredentialsResourceServer/client_credentials_base_scope components: schemas: QueryRequest: type: object required: - query properties: query: type: string minLength: 1 maxLength: 100000 description: >- The query string to validate and/or execute. Queries above the maximum length are rejected before parsing; real-world queries sit well below the bound. example: >- SELECT account_id, mfa_status FROM oleria_account WHERE mfa_status = :status model: type: string default: oleria_identity description: > Name of the semantic model to use for query resolution. Defaults to oleria_identity. example: oleria_identity dialect: type: string default: trino description: > The SQL dialect used for parsing. Currently only `trino` is supported. Additional dialects may be added in future versions. enum: - trino example: trino format: type: string default: json enum: - json - csv description: > Result format of the downloadable file, fixed at submission. `json` (default) delivers large results as JSON Lines (NDJSON); best for programmatic and AI consumers. `csv` produces a single comma-separated file with a header row and renders every value as text; best for spreadsheet export and tabular UIs. The inline `rows` preview is JSON either way (scalar values keep their type). Ignored by `/v1/query/validate`, which does not execute. example: csv parameters: type: object additionalProperties: oneOf: - type: string - type: number format: double - type: boolean description: > Named parameter values for query placeholders. Use `:name` syntax in the SQL query (e.g., `:status`, `:created_after`). Parameter names must match exactly (case-sensitive). Type coercion is automatic: strings are quoted, numbers and booleans are used as-is. example: status: disabled created_after: '2026-01-01' limit: 100 include_inactive: true QueryValidationResponse: type: object required: - result description: > Result of evaluating the query against validation rules. `result` indicates whether the query may proceed. Denials return `422` with `ErrorResponse`. properties: result: type: string enum: - allowed description: > Validation outcome. `allowed` = query passes all validation rules and may proceed. ErrorResponse: type: object required: - code - message properties: code: type: string description: Machine-readable error code for programmatic handling. example: QUERY_PARSE_ERROR message: type: string description: Human-readable error description. example: Failed to parse SQL query details: type: object additionalProperties: true description: Additional context for debugging (optional, free-form). example: line: 3 column: 15 hint: Unexpected token near 'SELCT' reasons: type: array description: > Policy violation details. Present when `code` is `POLICY_VIOLATION`. Each entry identifies a governance policy that the query violated. items: $ref: '#/components/schemas/Reason' Reason: type: object required: - code - message description: A single policy violation identified during query validation. properties: code: type: string description: > Stable, machine-readable identifier for the denial reason. SCREAMING_SNAKE_CASE; declared on the violated policy. example: MUTATION_NOT_ALLOWED message: type: string description: Human-readable explanation of the denial. example: >- Only SELECT queries are permitted. Mutation statements are not allowed. securitySchemes: clientCredentials: type: oauth2 description: > OAuth 2.0 Client Credentials flow. The tokenUrl shown is for the production environment. For other environments, replace `prod` with the target environment name (e.g., `auth.staging.oleria.io` for staging). flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: ClientCredentialsResourceServer/client_credentials_base_scope: >- Default scope used for all client credentials (RBAC is controlled via permissions in the bearer token) ````