diff --git a/R/schematic_rest_api.R b/R/schematic_rest_api.R
index 6de3497f..794c1afa 100644
--- a/R/schematic_rest_api.R
+++ b/R/schematic_rest_api.R
@@ -115,12 +115,36 @@ manifest_populate <- function(url="http://localhost:3001/v1/manifest/populate",
 #' @export
 manifest_validate <- function(url="http://localhost:3001/v1/model/validate",
                               schema_url="https://raw.githubusercontent.com/ncihtan/data-models/main/HTAN.model.jsonld", #nolint
-                              data_type, file_name, restrict_rules=FALSE) {
+                              data_type, file_name, restrict_rules=FALSE, project_scope = NULL,
+                              access_token, asset_view = NULL) {
+  
+  flattenbody <- function(x) {
+    # A form/query can only have one value per name, so take
+    # any values that contain vectors length >1 and
+    # split them up
+    # list(x=1:2, y="a") becomes list(x=1, x=2, y="a")
+    if (all(lengths(x)<=1)) return(x);
+    do.call("c", mapply(function(name, val) {
+      if (length(val)==1 || any(c("form_file", "form_data") %in% class(val))) {
+        x <- list(val)
+        names(x) <- name
+        x
+      } else {
+        x <- as.list(val)
+        names(x) <- rep(name, length(val))
+        x
+      }
+    }, names(x), x, USE.NAMES = FALSE, SIMPLIFY = FALSE))
+  }
+  
   req <- httr::POST(url,
-                     query=list(
+                    httr::add_headers(Authorization = sprintf("Bearer %s", access_token)),
+                     query=flattenbody(list(
                        schema_url=schema_url,
                        data_type=data_type,
-                       restrict_rules=restrict_rules),
+                       restrict_rules=restrict_rules,
+                       project_scope = project_scope,
+                       asset_view = asset_view)),
                     body=list(file_name=httr::upload_file(file_name))
   )
   
diff --git a/server.R b/server.R
index 66918c8b..8e3ce26d 100644
--- a/server.R
+++ b/server.R
@@ -64,7 +64,8 @@ shinyServer(function(input, output, session) {
     project = reactiveVal(NULL), folder = reactiveVal(""),
     schema = reactiveVal(NULL), schema_type = reactiveVal(NULL),
     master_asset_view = reactiveVal(NULL),
-    master_asset_view_label = reactiveVal(NULL)
+    master_asset_view_label = reactiveVal(NULL),
+    project_scope = reactiveVal(NULL)
   )
   
   isUpdateFolder <- reactiveVal(FALSE)
@@ -540,6 +541,14 @@ shinyServer(function(input, output, session) {
     selected$schema(data_list$template()[input$dropdown_template])
     schema_type <- config_schema()[[1]]$type[which(config_schema()[[1]]$display_name == input$dropdown_template)]
     selected$schema_type(schema_type)
+    
+    # set project scope for each template for cross-manifest validation.
+    # If project_scope is missing from dca_template_config.json then
+    # this value will be NULL and cross-manifest validation won't happen.
+    # validation will occur.
+    project_scope <- config_schema()[[1]]$project_scope[which(config_schema()[[1]]$display_name == input$dropdown_template)]
+    selected$project_scope(project_scope)
+    
     # clean all tags related with selected template
     sapply(clean_tags, FUN = hide)
   }, ignoreInit = TRUE)
@@ -626,7 +635,6 @@ shinyServer(function(input, output, session) {
         ),
         {
           message("Downloading offline manifest")
-          Sys.sleep(0)
           tibble(a="b", c="d")
         }
       )
@@ -724,7 +732,13 @@ shinyServer(function(input, output, session) {
     .infile_data <- inFile$data()
     .dd_template <- input$dropdown_template
     .restrict_rules <- dcc_config_react()$schematic$model_validate$restrict_rules
-    
+    .project_scope <- selected$project_scope()
+    .access_token <- access_token
+    # asset view must be NULL to avoid cross-manifest validation.
+    # doing this in a verbose way to avoid warning with ifelse
+    .asset_view <- NULL
+    if (!is.null(.project_scope)) .asset_view <- selected$master_asset_view()
+
     promises::future_promise({
       annotation_status <- switch(dca_schematic_api,
         reticulate = manifest_validate_py(
@@ -737,9 +751,11 @@ shinyServer(function(input, output, session) {
         schema_url=.data_model,
         data_type=.schema,
         file_name=.datapath,
-        restrict_rules = .restrict_rules),
+        restrict_rules = .restrict_rules,
+        project_scope = .project_scope,
+        access_token = .access_token,
+        asset_view = .asset_view),
       {
-        Sys.sleep(0)
         list(list(
         "errors" = list(
         Row = NA, Column = NA, Value = NA,
@@ -748,7 +764,7 @@ shinyServer(function(input, output, session) {
         ))
       }
       )
-      
+
       # validation messages
       validationResult(annotation_status, .dd_template, .infile_data)