Verifying Your Build

Overview

Before connecting your gateway to Moveworks, use the validate.py script that ships with the Content Gateway Starter Code to confirm that every endpoint on your running server returns responses that conform to the Content Gateway API schema.

The validator works against any source system. It tests protocol conformance, not content. Run it against the demo server before writing any code, and again after connecting your real source.

validate.py is part of the Content Gateway Starter Code repo. If you don’t have it locally yet, clone it from github.com/moveworks/gateway and cd gateway/starter-code before running the commands below.

Requirements

The Content Gateway Starter Code cloned locally (contains validate.py)
Your gateway server must be running and reachable
GATEWAY_API_KEY set to the key your server expects
requests installed (pip install -r requirements.txt)

Running the validator

Files only: use this when your Strategy Config is set to Public to all members:

$ export GATEWAY_API_KEY=<your-key>
$ python validate.py

Full validation including users, groups, and permissions (use this when your Strategy Config is set to ReBAC):

$ export GATEWAY_API_KEY=<your-key>
$ python validate.py --rebac

Against a deployed server:

$ export GATEWAY_API_KEY=<your-key>
$ SERVER_URL=https://your-gateway.example.com python validate.py --rebac

What it checks

Files only (default)

Check	What it validates
Auth: rejects invalid key	Server returns 401 on a wrong API key
Auth: rejects missing header	Server returns 401 when no Authorization header is sent
Auth: accepts valid key	Server returns 200 with the correct key
Rate-limit headers (warn)	Warns if no `X-RateLimit-*` (or RFC 9456 variants) headers are emitted. Advisory only. Not a failure
`GET /v1/files`	Response envelope (`value`, `@odata.context`), at least one file returned
File schema	Each file has `id`, `name`, `external_url`, `last_modified_datetime`, `content.mime_type`; binary files have `download_path` (HTML body is read from `/v1/files/{id}`, not the list response)
`GET /v1/files/{id}`	Single file returns correct shape and id matches; for HTML content, verifies `body` is inline on this endpoint

Additional checks with --rebac

Check	What it validates
`GET /v1/files/permissions/metadata`	Returns `model: "resource_permission"` (the only supported model)
`GET /v1/files/{id}/permissions`	Response has `permissions` array; each entry has `id`, `type` (USER or GROUP), `action` (VIEW)
Wildcard antipattern (warn)	Warns on any `{"type": "USER", "id": ""}` entries. Only `{"type": "GROUP", "id": ""}` is interpreted as a wildcard. See How Permissions Work
`GET /v1/users`	Response has `value` array; each user has `id` and `primary_email_addr`
`GET /v1/groups`	Response has `value` array; each group has `id`
`GET /v1/groups/{groupId}/members`	Each member has `id` and valid `type` (USER or GROUP)

Example output

Run against the demo server (python content_gateway.py followed by python validate.py --rebac):

Moveworks Content Gateway: Schema Validator
════════════════════════════════════════════
  Server:  http://localhost:5001
  Mode:    ReBAC (full)
Authentication
──────────────
  ✓ Rejects invalid API key with 401  got HTTP 401
  ✓ Rejects missing Authorization header with 401  got HTTP 401
  ✓ Accepts valid API key  got HTTP 200
  ⚠ No rate-limit headers found on response  Moveworks reads X-RateLimit-Limit/Remaining/Reset to throttle proactively. Recommended for production.
GET /v1/files
─────────────
  ✓ Returns HTTP 200  got 200
  ✓ Response has required envelope fields (value, @odata.context)
  ✓ Returns at least one file  got 10 files
       10 file(s) returned
  ✓ All files have required fields and valid content shape
GET /v1/files/{id}  (testing id=kb-001)
───────────────────────────────────────
  ✓ Returns HTTP 200  got 200
  ✓ File object has required fields
  ✓ Returned file id matches requested id  requested kb-001, got kb-001
  ✓ text/html content includes inline body on /files/{id}  Moveworks reads HTML content from this endpoint's body field, not from /files
GET /v1/files/permissions/metadata
──────────────────────────────────
  ✓ Returns HTTP 200  got 200
  ✓ Reports model='resource_permission' (the only supported model)  got model='resource_permission'
GET /v1/files/{id}/permissions  (testing id=kb-001)
───────────────────────────────────────────────────
  ✓ Returns HTTP 200  got 200
  ✓ Response has permissions array
  ✓ At least one permission entry returned  got 1
  ✓ All permission entries have valid shape
GET /v1/users
─────────────
  ✓ Returns HTTP 200  got 200
  ✓ Returns at least one user  got 5
       5 user(s) returned
  ✓ All users have required fields (id, primary_email_addr)
GET /v1/groups
──────────────
  ✓ Returns HTTP 200  got 200
  ✓ Returns at least one group  got 4
       4 group(s) returned
  ✓ All groups have required id field
GET /v1/groups/{id}/members  (testing id=group-it-staff)
────────────────────────────────────────────────────────
  ✓ Returns HTTP 200  got 200
       2 member(s) returned
  ✓ All members have valid shape
════════════════════════════════════════════
  ✓ All checks passed

If a check fails

The validator prints exactly which field is missing or malformed. The most common causes:

Symptom	Likely cause
`missing fields: primary_email_addr` on users	`map_item_to_user` is returning `email` instead of `primary_email_addr`. Check your field mapping in Section 3
`type must be USER or GROUP` on permissions	`fetch_permissions_for_file` is returning lowercase types. Ensure values are uppercased
Permissions endpoint returns 404	`fetch_permissions_for_file` not yet implemented; required if using ReBAC strategy
Auth check fails	`GATEWAY_API_KEY` env var doesn’t match the key the server was started with
Wildcard antipattern warning	Permission entry uses `{type: USER, id: ""}` instead of `{type: GROUP, id: ""}`. Only the GROUP form is recognized as a public-access wildcard by Moveworks
Rate-limit header warning	No `X-RateLimit-*` headers emitted on responses. Advisory only; only relevant if you enforce a rate limit on your side and want Moveworks to throttle proactively