When to use it
Confirming an API response satisfies a schema spec right before integration testing, pulling specific fields out of a large JSON for debugging, or simulating what the frontend will receive after a backend schema change to spot what breaks.
Two modes, one tool
Toggle from the top:
- Schema validation — JSON Schema (draft-07) validates your data.
Every violation surfaces at once (
allErrors). Three columns: instance path, keyword, message. - JSONPath extraction — pulls only the matching nodes from a large JSON via a path expression. jsonpath-plus superset syntax.
They're orthogonal — schema is whole-document validation, JSONPath is partial extraction. Both come up often enough that bouncing between sites for them is annoying — one tool, both modes.
Lazy libraries
- ajv 8.x (~80KB gz) — the de-facto JSON Schema validator.
- jsonpath-plus 10.x (~5KB gz) — JSONPath evaluator.
Both dynamically imported. The page's client bundle stays ~10KB; ajv / jsonpath-plus chunks load when you start typing.
JSONPath cheatsheet
$.store.books[*].title # all book titles
$..books[?(@.price < 10)] # books cheaper than 10
$..author # all author keys (recursive)
$..books[0:2] # first two books
$..books[-1:] # last book
$.store.books[*].price # all prices
Close to RFC 9535, but jsonpath-plus is a slight superset (script
expressions like ?(@...) extend the standard).
Schema-mode keywords
The full ajv 8.x draft-07 set:
type(string, number, integer, boolean, object, array, null)required,enum,constproperties,additionalProperties,patternPropertiesitems,minItems,maxItems,uniqueItemspattern,minLength,maxLengthminimum,maximum,exclusiveMinimum,exclusiveMaximummultipleOfif/then/else,allOf/anyOf/oneOf/not
format (email, uuid, date-time, …) is ignored in V1 (no
ajv-formats). Add it in V2 if format checking matters.
Not the right tool when
- API mocking / fake server — generating fake data that satisfies a schema is separate. This tool validates only; it doesn't generate. Use faker / json-schema-faker for that.
- Reviewing the schema's design — missing
required, wrong types, and other schema design problems are not detected automatically. This tool checks only formal correctness. - OpenAPI / Swagger directly — paste the embedded component schema by hand. This tool takes raw JSON Schema only.
Privacy
Auth tokens, user IDs, and payment fields embedded in API responses are safe. ajv and jsonpath-plus are dynamically imported into the client bundle; the schema, data, and path never leave the page.
JSON stays on the page
Auth tokens, user IDs, and payment fields embedded in API responses are safe. ajv and jsonpath-plus are dynamically imported into the client bundle; the schema, data, and path never leave the page.