POST Verify Source

Re-test a connected source's stored credential against its provider, and update its health status

POSThttps://api.anakin.io/v1/wire/identity-sources/{id}/verify

Re-runs the provider's connection check against the stored credential — a health check, not a rotation. Nothing is replaced; use PATCH for that.

Use it to confirm a source still works before relying on it, or to clear a revoked status after fixing the problem at the provider.

No request body. Requires an X-API-Key; the source must belong to the authenticated user.

What the result does to the source

Outcome	Effect on the row
Success	`last_verified_at` is bumped; a previously `revoked` source returns to `active`
Credential rejected (`SOURCE_AUTH_FAILED`)	Status flips to `revoked` — the credential itself is dead
Permission failure (`SOURCE_FORBIDDEN`)	Status is unchanged — the credential is healthy, it just lacks a grant on one vault

That distinction is the whole point of this endpoint. Only a rejected credential revokes a source; a missing role assignment on one vault leaves every other vault on the connection working, and is fixed at the provider without issuing a new secret.

For Azure Key Vault, verification succeeds if any scoped vault is readable. One revoked role assignment shouldn't mark a connection that still works for its other vaults as broken — per-vault failures surface at bind time instead, where they can name the vault.

Path Parameters

Parameter	Type	Description
`id` required	string (UUID)	Identity source ID

Response

200 OK

{
  "status": "ok",
  "identity_source": {
    "id": "f1e2d3c4-0000-0000-0000-000000000000",
    "user_id": "8a7b6c5d-0000-0000-0000-000000000000",
    "provider": "azure_key_vault",
    "display_name": "Prod Key Vault",
    "config": { "auth_method": "service_principal" },
    "scope_metadata": { "vaults": [ { "id": "https://my-vault.vault.azure.net", "name": "my-vault" } ] },
    "status": "active",
    "last_verified_at": "2026-06-09T11:30:00Z",
    "created_at": "2026-06-01T09:00:00Z",
    "updated_at": "2026-06-09T11:30:00Z"
  }
}

The refreshed row, with last_verified_at freshly stamped. If that bump fails to persist, the response is still ok — the check itself passed, which is what you asked.

Error Responses

Code	HTTP	When
`NOT_FOUND`	404	No source with that ID
`FORBIDDEN`	403	The source belongs to another user
`SOURCE_AUTH_FAILED`	400	The provider rejected the stored credential. The source is now `revoked` — rotate or reconnect
`SOURCE_FORBIDDEN`	400	The credential is valid but lacks access. Grant it at the provider, then verify again
`SOURCE_ITEM_NOT_FOUND`	400	A scoped vault no longer exists
`SOURCE_INACTIVE`	400	The source is not active
`SOURCE_THROTTLED`	429	The provider is rate-limiting us. Retry shortly
`SOURCE_UNREACHABLE`	502	Could not reach the provider. If the vault restricts network access, allow our egress addresses
`SOURCE_UPSTREAM_ERROR`	502	The provider failed for an unclassified reason
`SOURCE_NOT_AVAILABLE`	503	The source resolver isn't configured on this engine

Code Examples

curl https://api.anakin.io/v1/wire/identity-sources/f1e2d3c4-0000-0000-0000-000000000000/verify \
  -X POST \
  -H "X-API-Key: your_api_key"

import requests

source_id = 'f1e2d3c4-0000-0000-0000-000000000000'
response = requests.post(
    f'https://api.anakin.io/v1/wire/identity-sources/{source_id}/verify',
    headers={'X-API-Key': 'your_api_key'},
)

data = response.json()
if data['status'] == 'ok':
    print(f"Healthy — verified at {data['identity_source']['last_verified_at']}")
elif data['error']['code'] == 'SOURCE_FORBIDDEN':
    print('Credential is fine; grant it access to the vault at the provider.')
else:
    print(f"Unhealthy: {data['error']['code']} — {data['error']['message']}")

const sourceId = 'f1e2d3c4-0000-0000-0000-000000000000';
const response = await fetch(`https://api.anakin.io/v1/wire/identity-sources/${sourceId}/verify`, {
  method: 'POST',
  headers: { 'X-API-Key': 'your_api_key' },
});

const data = await response.json();
if (data.status === 'ok') {
  console.log(`Healthy — verified at ${data.identity_source.last_verified_at}`);
} else if (data.error.code === 'SOURCE_FORBIDDEN') {
  console.warn('Credential is fine; grant it access to the vault at the provider.');
} else {
  console.error(`Unhealthy: ${data.error.code} — ${data.error.message}`);
}

Rate limit

10 requests per minute per user (each call makes a live request to the provider).

PATCH /v1/wire/identity-sources/{id} — rotate the credential a failed verify points at
GET /v1/wire/identity-sources/{id} — current status and dependent-identity count
POST /v1/wire/credentials/verify — re-verify a login, not the source behind it