Test Entra ID credentials without saving
POST/config/entraid-domains/validate
Checks the supplied tenant and app credentials against Microsoft Entra ID.
client_id, tenant_id and client_secret are all needed for a valid result. A failed test still returns HTTP 200, with valid: false and an error object (code and msg). Accepts JSON or application/x-www-form-urlencoded bodies. Required role: admin or superadmin. Missing credentials are not rejected with 400: the response is HTTP 200 {valid: false, error: {code: "MissingCredentials", msg: "All of client_id, tenant_id and client_secret must be specified"}}. Credentials that Entra ID does not accept (or that cannot be checked) give FailedEntraIDValidate (msg Failed to check Entra ID credentials).
Request
Responses
- 200
- 401
- 403
Test result.
No token, or the token is invalid or expired. The body is {message}: No auth token provided when no token is sent, otherwise the token check's message (jwt expired, jwt malformed, invalid signature, invalid token, jwt signature is required). Send Authorization: Bearer <token> exactly: the server drops the first seven characters of the header and reads the rest as the token, so a different scheme or an extra space fails. If Authorization is absent, the server reads a token field in the body, then a token query parameter, then x-access-token. Routes that validate query fields reject ?token= with 400 InvalidQuery.
The token's role is not allowed for this operation, or the token's scopes exclude the route
(Scope not allowed by token).