Validate JSON Against Schema
Find out whether a record meets the rules it is supposed to follow: in the example, Ada with age 37 and the tags math and code meets every rule, so the list of problems comes back empty. Failures are listed all at once. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
A missing identifier, an unexpected property, a short string, or a number outside its allowed range can break an import long after parsing succeeds.
Well formed is not the same as correct
Data can be perfectly readable and still be wrong for the system that receives it. A missing identifier, an unexpected entry, a text that is too short or a number outside its allowed range can break an import long after the data was read without trouble. Reading only checks that the punctuation is in order. The contract is where the real expectations live: which entries must be there, what kind of value each holds, which limits apply and whether anything else is allowed. This tool compares the data with that contract and lists every violation it finds, instead of stopping at the first one.
How to read the result and put it to use
An empty list of problems means every rule was met, as in the example: Ada, aged 37, with the tags math and code, satisfies a contract that asks for a name of at least two letters, a whole number for the age that is not below zero, tags that do not repeat and no other entries. Each problem names where it sits in the data, which rule it broke and a readable message. Use the message for people and the location and rule for automation: a form can highlight the matching control, and an import can group recurring failures before partner records reach your database.
Read violation paths without guessing
The empty string identifies the document root; <code>/customer/email</code> identifies the email property inside customer; and <code>/lines/2/quantity</code> identifies quantity in the third array item. Pointer escaping is applied consistently, so a property containing a slash or tilde is still unambiguous. Use the human-readable message for logs and interfaces, but use the path and keyword for program logic.
For example, a form can associate an issue with its corresponding control, while an ingestion pipeline can group recurring failures by keyword.
What you can do with it
Guard data imports
Validate partner records before loading them so missing fields and unexpected shapes do not become downstream cleanup work.
FAQ
What does a successful validation return?
It returns valid set to true and an empty violations array.
Does the check stop at the first problem?
No. Every problem found is kept and reported together, which matters for forms, batch imports and configuration reviews, where fixing one issue per run wastes time. An empty list means every rule was met.
How do I read the location given for each problem?
An empty location means the whole document. A location such as /customer/email points to the email inside customer, and /lines/2/quantity points to the quantity in the third item of lines, because positions are counted from zero.
What kinds of rules can the contract express?
The kind of each value, which entries are required or depend on others, whether unexpected entries are allowed, text length and patterns, number ranges, fixed values and lists of allowed values, rules for list items, references to other rules and combinations of several rules.
Why can data that reads fine still fail the check?
Because reading only confirms that braces, quotes and commas are in order. It cannot know that an order must contain an order number, that a quantity must be positive or that unknown entries must be refused; those expectations live in the contract.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/data/json-schema-validate \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"document":{"name":"Ada","age":37},"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string"}}}}'const res = await fetch("https://api.kit.forhosting.com/data/json-schema-validate", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"document": {
"name": "Ada",
"age": 37
},
"schema": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string"
}
}
}
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/data/json-schema-validate",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"document": {
"name": "Ada",
"age": 37
},
"schema": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string"
}
}
}
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/data/json-schema-validate", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"document":{"name":"Ada","age":37},"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string"}}}}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"document":{"name":"Ada","age":37},"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string"}}}}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/data/json-schema-validate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"document": {
"name": "Ada",
"age": 37
},
"schema": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string"
}
}
}
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "data.json_schema_validate",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 25 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
JSON can be perfectly well formed and still be wrong for the system that receives it. This validator compares a JSON document with a JSON Schema and returns every detected violation in one response. Each issue includes the document path, schema path, keyword, and readable explanation, so developers and data teams can move directly from a failed check to the field that needs attention.
Validate the contract, not merely the JSON syntax
An empty array means the document satisfies every evaluated constraint. A failed result keeps all detected issues instead of stopping after the first, which is especially useful for forms, batch imports, configuration reviews, and CI checks where fixing one problem per run wastes time. A JSON parser answers only whether braces, quotes, commas, and values form legal JSON. It cannot know that an order must contain an order number, that a quantity must be positive, or that an object must reject unknown fields. JSON Schema expresses those expectations as a machine-readable contract. Supply the parsed document in the <code>document</code> field and the contract in <code>schema</code>. The result contains a Boolean <code>valid</code> verdict and a <code>violations</code> array. The validator handles core structural and constraint keywords, including types, required and dependent properties, property schemas, additional properties, array items, string lengths and patterns, numeric bounds, constants, enumerations, local references, and composition with all-of, any-of, one-of, and not.
Read violation paths without guessing
Every violation includes a <code>path</code> written as a JSON Pointer. The companion <code>schema_path</code> points to the rule that produced the issue, while <code>keyword</code> provides a stable category such as <code>required</code>, <code>type</code>, or <code>minimum</code>.
Treat a malformed schema differently from invalid data
An invalid document is a normal validation result: the request succeeds with <code>valid</code> set to false and explains every violation. A malformed schema is different because no trustworthy validation can be performed. If a keyword has the wrong shape, a declared type is unknown, a regular expression cannot compile, a numeric limit is nonsensical, or a local reference cannot be resolved, the capability returns an <code>invalid_input</code> error instead of pretending the document failed. That distinction prevents broken contracts from being mistaken for bad customer data. The implementation is pure and performs no network requests, so it cannot retrieve remote references; use local JSON Pointer references beginning with <code>#/</code> or place the referenced definition inside the supplied schema. Validation is appropriate at API boundaries, before database imports, when accepting generated structured output, and in build pipelines. API requests begin at $0.002, while the same deterministic logic can run in the browser for interactive checks.
Integration use cases
Reject broken API payloads
Check request bodies against a shared contract and return precise paths for every field clients need to correct.
Test generated JSON
Verify structured output from automation against required types, ranges, and properties before another system acts on it.
Technical questions
Does it stop at the first problem?
No. It reports every detected violation with its document path, schema path, keyword, and message.
What happens when the schema itself is malformed?
The request fails with an invalid_input error because an invalid contract cannot produce a reliable validation result.
Are remote schema references supported?
No. The deterministic validator performs no network access and supports local JSON Pointer references inside the supplied schema.
How much does an API validation cost?
Each request starts at $0.002. The browser runner uses the same pure validation logic for interactive checks.