---
title: "Test"
method: POST
path: "/api/v1/ssf-receiver-streams/{id}/test"
tags: ["SSF Receiver"]
---

# Test

`POST /api/v1/ssf-receiver-streams/{id}/test`

Test validates an SSF receiver stream's configuration by checking JWKS reachability, identity resolution, and action preview without processing real events.

## Path parameters

- `id` string, required — The ID of the SSF receiver stream to test.

## Request body

- C1ApiSsfReceiverV1SSFReceiverStreamServiceTestRequestInput — SSFReceiverStreamServiceTestRequest identifies the stream to test and an optional subject for identity resolution validation.
  - `testSubject` string — The upstream identifier to test resolution with. Typically an email address (e.g., "alice@company.com") — the same value the IdP would send in a SET subject. The Test RPC runs resolveSubject on this to verify the identity mapping works. Optional: upstream identifier (email) to test identity resolution. If empty, only JWKS reachability is tested.

## Response `200`

SSFReceiverStreamServiceTestResponse reports the results of the stream configuration test across JWKS, identity, and action readiness checks.

- C1ApiSsfReceiverV1SSFReceiverStreamServiceTestResponse — SSFReceiverStreamServiceTestResponse reports the results of the stream configuration test across JWKS, identity, and action readiness checks.
  - `activeRefreshTokenCount` integer — Number of active refresh tokens for the matched user that would be affected.
  - `activeSessionCount` integer — Number of active sessions for the matched user that would be affected.
  - `configuredSessionRevokedAction` 'SSF_REVOCATION_ACTION_UNSPECIFIED' | 'SSF_REVOCATION_ACTION_REVOKE_ALL' | 'SSF_REVOCATION_ACTION_LOG_ONLY' — Step 3: Action preview. The action configured for session-revoked events on this stream.
  - `identityLinkFound` boolean — Step 2: Identity mapping. Whether the test subject was resolved to a ConductorOne user.
  - `jwksError` string — Error message if the JWKS endpoint could not be reached or returned invalid data.
  - `jwksKeyCount` integer — Number of signing keys found at the JWKS endpoint.
  - `jwksReachable` boolean — Step 1: JWKS reachability. Whether the JWKS endpoint was reachable and returned valid keys.
  - `matchedUserId` string — The ConductorOne user ID the test subject maps to, if an identity link was found.
  - `ready` boolean — Overall readiness. Whether the stream passed all test checks and is ready to process events.
  - `upstreamSubject` string — The upstream IdP subject identifier (e.g., Okta user ID "00u1234") resolved from the test subject.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/d391405a35d3/schema)