> ## Documentation Index > Fetch the complete documentation index at: https://docs.lithoblocks.com/llms.txt > Use this file to discover all available pages before exploring further. # Validate blocks without saving > Dry run: fills in block ids, derives `request_format`, and compiles the blocks exactly as a send would — without persisting anything or spending credits. `valid: false` comes with the engine's messages under `errors`. Iterate here until valid, then create the template or version. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/templates/validate openapi: 3.0.0 info: version: 0.0.1 title: LithoBlocks API description: >- # LithoBlocks API Welcome to the LithoBlocks API documentation. This API enables you to manage templates, entities, and organizations with a powerful, scope-based authorization system. ## API versioning Documented operations are under the `/v1` path prefix (for example, `GET /v1/templates`). **Older integrations** may still call the same routes without the `/v1` prefix (for example, `GET /templates`); those URLs remain supported for backward compatibility but are not listed in this OpenAPI document. **New integrations** should use `/v1` URLs. ## JSON and query naming Canonical names in JSON bodies, query strings, and path parameter names documented here are **snake_case** (for example `organization_id`, `template_id`, `include_author`). During a deprecation window, many inputs still accept legacy **camelCase** keys for the same values (for example `templateId` in place of `template_id`). **Responses** use snake_case for multi-word keys. Prefer snake_case for new clients; camelCase on input may be removed in a future version. ## Authentication & Authorization This API uses **LithoBlocks API Keys** for authentication with **scope-based authorization** for granular access control. ### Getting Your API Key 1. **Log into your LithoBlocks organization dashboard** 2. **Navigate to API Keys** in your account settings 3. **Create a new API key** and select the required scopes 4. **Copy your API key** (it will only be shown once for security) ### Using Your API Key Include your API key in the Authorization header: ``` Authorization: Bearer lb_live_sk_example_key_here ``` ### API Key Scopes & Role Requirements Your available scopes depend on your **organization role**. When creating an API key, you can only select scopes your role permits: Every operation below declares the scope it requires, and the API enforces exactly that scope. A key without it receives `403` with `required_scopes` in the body. #### 👥 **All Roles** (Viewer, Member, Admin, Owner) | Scope | Description | |-------|-------------| | `templates:read` | Read templates, search them, and read their versions | | `entities:read` | Read entities and their fields, and search them | | `organizations:read` | Read the organization and its member list | | `usage:read` | Read credit balance and usage | | `sample-data:read` | Read sample data | #### ✏️ **Member+** (Member, Admin, Owner) | Scope | Description | |-------|-------------| | `templates:create` | Create templates | | `templates:update` | Update templates and add versions | | `templates:activate` | Make a template version the active one | | `messages:create` | Compile templates and send messages | | `messages:preview` | Preview messages | | `entities:write` | Update and delete entities and their fields | #### 🔑 **Admin+** (Admin, Owner) | Scope | Description | |-------|-------------| | `templates:delete` | Delete templates | | `organizations:write` | Update the organization and invite members | | `users:read` | Read organization users by id | | `users:write` | Delete organization users | | `queues:write` | Push events to queue policies | `queues:read`, `scheduled:read` and `scheduled:write` exist so keys can be prepared for the scheduled messages and batch digests release; no operation requires them yet. ### API Key Management - **Multiple Keys**: Create multiple API keys with different scopes for different use cases - **Key Rotation**: Regularly rotate your API keys for security - **Scope Limitation**: Only request the minimum scopes needed for your application - **Organization Scoped**: All API keys are scoped to your organization ### Security Best Practices - **Never share API keys** or commit them to version control - **Use environment variables** to store API keys in your applications - **Create separate keys** for development, staging, and production - **Revoke unused keys** from your dashboard regularly ### Multi-Tenant Isolation All API endpoints enforce **organization-level isolation**: - You can only access resources within your organization - API keys are tied to the organization where they were created - Cross-organization access is never permitted ## Role-Based Access Control ### 👀 **Viewer Role** - Can read templates and entities - Can compile templates into messages - **Cannot** create or modify resources - **Cannot** access admin functions ### ✏️ **Member Role** - All Viewer permissions - Can create and update templates - Can create and update entities - **Cannot** access admin functions ### 🔧 **Admin Role** - All Member permissions - Can manage organization settings - Can view and manage users - **Cannot** delete the organization ### 👑 **Owner Role** - All Admin permissions - Full organization control - Can delete the organization - Can transfer ownership contact: name: LithoBlocks url: https://lithoblocks.com email: support@lithoblocks.com servers: - url: https://api.lithoblocks.com description: Production (paths in this spec are rooted at /v1/...) - url: http://localhost:8787 description: Local dev (paths in this spec are rooted at /v1/...) security: [] paths: /v1/templates/validate: post: tags: - Templates summary: Validate blocks without saving description: >- Dry run: fills in block ids, derives `request_format`, and compiles the blocks exactly as a send would — without persisting anything or spending credits. `valid: false` comes with the engine's messages under `errors`. Iterate here until valid, then create the template or version. requestBody: description: Blocks to validate required: true content: application/json: schema: type: object properties: blocks: type: array items: $ref: '#/components/schemas/TemplateBlock' minItems: 1 sample_data: type: object additionalProperties: nullable: true description: >- Data to compile against; defaults to a null-filled skeleton of the request format required: - blocks responses: '200': description: Validation result content: application/json: schema: type: object properties: valid: type: boolean errors: type: array items: type: object properties: error: type: string details: type: string required: - error - details description: Present when `valid` is false request_format: type: object additionalProperties: nullable: true description: >- `{ template_id, data }` where `data` holds `null` per placeholder and `[{ field: null }]` per array path; what a caller of compile/send must supply. `GET /templates/{id}/input-schema` describes the same paths with types, labels and nesting blocks: type: array items: $ref: '#/components/schemas/TemplateBlock' description: >- The blocks as they would be stored: ids and action ids filled in compiled_preview: type: array items: type: object additionalProperties: nullable: true description: >- Slack Block Kit output for `sample_data`; present when `valid` is true interactivity: type: object properties: buttons: type: number description: Buttons carrying an `action_config` metadata_bytes: type: number description: >- Size of the message metadata a send would embed, measured with `sample_data` required: - buttons fields_truncated: type: number description: How many text fields were shortened to fit Slack's limits warnings: type: array items: type: string description: >- What compile normalised: chart points filled with 0, series or points truncated to Slack's counts required: - valid - request_format - blocks '401': description: Authentication required content: application/json: schema: $ref: '#/components/schemas/ApiError' '403': description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ApiError' '422': description: The request body, query string or path parameters failed validation content: application/json: schema: $ref: '#/components/schemas/ValidationError' '429': description: Rate limit exceeded for this organization; see Retry-After content: application/json: schema: $ref: '#/components/schemas/ApiError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - bearerAuth: - templates:read components: schemas: TemplateBlock: type: object properties: type: type: string minLength: 1 id: type: string required: - type ApiError: type: object properties: error: type: string description: Human-readable summary. Not stable; match on `code`. code: $ref: '#/components/schemas/ErrorCode' request_id: type: string description: >- Echoed from the request's X-Request-Id header, or generated. Quote it in support requests. message: type: string details: type: string error_details: type: string success: type: boolean enum: - false valid: type: boolean enum: - false required_scopes: type: array items: type: string user_scopes: type: array items: type: string required: - error - code - request_id ValidationError: type: object properties: success: type: boolean enum: - false error: type: object properties: issues: type: array items: type: object properties: code: type: string path: type: array items: anyOf: - type: string - type: number message: type: string required: - code - path - message name: type: string required: - issues - name message: type: string description: >- The issues as one line, `path: message; path: message`, for callers that show a string (form builders such as Make) code: type: string enum: - validation_failed request_id: type: string required: - success - error - message - code - request_id ErrorCode: type: string enum: - unauthenticated - invalid_token - insufficient_scope - access_denied - validation_failed - invalid_request - invalid_data - invalid_destination - invalid_search_query - not_found - template_not_found - version_not_found - organization_not_found - entity_not_found - field_not_found - user_not_found - profile_not_found - credits_not_found - insufficient_credits - overage_limit_exceeded - credit_deduction_failed - compilation_failed - no_blocks_to_send - slack_not_connected - slack_user_not_found - slack_dm_failed - slack_token_decrypt_failed - slack_api_error - already_exists - invitation_pending - idempotency_conflict - idempotency_in_progress - rate_limited - tier_limit - invalid_state - maintenance - misconfigured - internal_error description: >- Machine-readable reason for the failure. Match on this, not on `error`. New codes may be added; existing ones are stable. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- LithoBlocks API key obtained from your organization dashboard. The LithoBlocks MCP server also presents a Supabase-issued user session token here on the user's behalf; such a token acts as that user with the scopes their organization role allows. ````