Schema Validation

The foundational layer of validation that verifies the syntactic correctness of a data instance against the schema's physical layout.

• Required Field Enforcement: Immediately rejects instances missing mandatory keys, preventing downstream null pointer exceptions.
• Type Checking: Ensures a field defined as an integer does not receive a string, catching serialization errors at the boundary.
• Hierarchy Validation: Confirms that nested objects and arrays match the exact tree structure defined in the schema, rejecting malformed payloads.

This is the fastest check, often catching 90% of integration errors before logical validation begins.

Applies fine-grained rules to the values within a correctly structured data instance, enforcing data integrity beyond basic types.

• Range and Bounds: Validates numeric minimums, maximums, and exclusive boundaries (e.g., age >= 0).
• Pattern Matching: Uses regular expressions to enforce string formats like email addresses, UUIDs, or custom identifiers.
• Enumeration Control: Restricts a field to a predefined set of acceptable values, preventing invalid state entries.
• Cardinality Rules: Enforces minItems, maxItems, and uniqueItems on arrays to control collection sizes and duplication.

The highest-order validation that checks business logic and cross-field consistency, going beyond what a static schema alone can express.

• Cross-Field Dependencies: Ensures that if country is US, then state must be a valid two-letter code and not empty.
• Referential Integrity: Verifies that a foreign key or identifier actually exists in the target system or dataset before accepting the record.
• Temporal Logic: Validates that end_date is strictly after start_date, preventing logically impossible time ranges.

This often requires custom functions or a Data Contract enforcement layer integrated with the validation pipeline.

An often-overlooked validation feature that transforms data into a canonical representation before storage, ensuring consistency.

• String Trimming: Automatically removes leading and trailing whitespace from text inputs to prevent duplicate entries like 'Admin' and 'Admin '.
• Case Folding: Converts email addresses or codes to lowercase to ensure case-insensitive uniqueness.
• Date Standardization: Parses multiple input formats (e.g., MM/DD/YYYY or ISO 8601) into a single, consistent serialization format.

Normalization is a critical step in Data Quality Posture, ensuring that valid data is also clean data.

A strategic validation mode that collects all violations in a single pass rather than failing on the first error, crucial for developer experience.

• Batch Reporting: Returns a comprehensive list of all structural and constraint errors, allowing API consumers to fix every issue in one iteration.
• Path Context: Each error includes the exact JSON Pointer path (e.g., /items/3/price) to the invalid element.
• Severity Classification: Distinguishes between blocking errors and warnings, enabling non-breaking schema evolution.

This approach is a hallmark of production-grade Schema Registries and validation libraries.

Governs how a validator reacts to fields present in the data instance but not defined in the schema, a critical control for forward compatibility.

• Strict Mode: Rejects any instance containing undefined properties, ensuring no unknown data leaks into the system.
• Lenient Mode: Ignores additional properties, allowing producers to evolve their schemas by adding new fields without breaking existing consumers.
• Annotation: Records unknown fields in a log or metadata store for later analysis without failing the validation.

This feature directly implements the principles of Schema Evolution and the Robustness Principle.

The most fundamental layer of validation, ensuring the physical shape of the data instance matches the schema definition. This process checks for required field presence, correct data types (e.g., string vs. integer), and proper nesting of objects and arrays. A failure here indicates a malformed payload that cannot be safely parsed.

• Detects missing mandatory keys like product_id
• Rejects type mismatches, such as a string where a number is expected
• Enforces strict object hierarchy and array structures

Goes beyond basic structure to enforce business rules on data values. This layer validates numeric ranges, string patterns (via regex), enumerations, and cardinality (min/max items). It ensures a valid integer is also a meaningful integer, such as an age between 0 and 150.

• Applies minimum, maximum, minLength, and maxLength rules
• Validates strings against formats like email, uri, or date-time
• Enforces enum lists to restrict values to a controlled vocabulary

The deepest validation layer, verifying that data makes logical sense within its domain context. This often requires cross-field checks and external lookups. For example, a zip_code might be structurally valid but must also exist in a postal database and correspond to the provided state.

• Cross-references fields (e.g., end_date must be after start_date)
• Validates referential integrity against external systems or databases
• Detects logical contradictions that structural checks cannot see

Validation must occur at multiple boundaries. Client-side validation provides instant user feedback and reduces server load, but is trivially bypassed. Server-side validation is the authoritative security gate. A robust architecture implements both: client-side for UX, server-side for data integrity.

• Client-side: Immediate feedback using JSON Schema in the browser
• Server-side: The final, non-negotiable enforcement point before data persistence
• Zero-trust principle: Never assume client-side validation has run

The output of a failed validation is as critical as the check itself. Effective error payloads are machine-readable, actionable, and precise. A good error returns a structured array of violations, each containing a path to the offending field, a keyword that failed, and a human-readable message.

• Returns standard application/problem+json content types
• Pinpoints exact locations: #/items/2/price
• Avoids exposing internal system details that could aid an attacker