XML and JSON Toolbox

XML and JSON Toolbox API endpoints

• POST/api/jsonlinter/prettyprint

  Pretty-prints JSON input.

  Use this endpoint to turn compact JSON into readable, consistently indented JSON. Objects, arrays, and primitive JSON roots are supported. Requests up to 10 KiB (10,240 UTF-8 bytes) do not require an API key. Larger requests require a valid X-Api-Key header.

• POST/api/jsonlinter/minify

  Minifies JSON input.

  Use this endpoint to remove insignificant whitespace before storing or transmitting JSON. Objects, arrays, and primitive JSON roots are supported. Requests up to 10 KiB (10,240 UTF-8 bytes) do not require an API key. Larger requests require a valid X-Api-Key header.

• POST/api/jsonpatch/apply

  Applies JSON Patch operations to a JSON document.

  The request body must be a two-element array: [patchOperations, inputDocument]. The first element is an RFC 6902 operation array; the second is the document to update. Operations are applied in array order. Requests up to 10 KiB (10,240 UTF-8 bytes) do not require an API key. Larger requests require a valid X-Api-Key header.

  $0.05 / call
• POST/schematools/generate-documentation

  Generates JSON Schema documentation as HTML from the provided JS

  This endpoint is rate-limited to 100 requests per minute.

  $0.05 / call
• POST/validator/validate

  Validates JSON data against a schema.

  A schema pool can be provided. This endpoint is rate-limited to 100 requests per minute.

  $0.05 / call
• POST/validator/validate-simple

  Validates JSON data against a schema.

  This endpoint is rate-limited to 100 requests per minute.

  $0.05 / call
• POST/api/xml/check

  Checks secure XML well-formedness and returns native document me

  Malformed XML is a completed check and returns HTTP 200 with `wellFormed: false`.

  $0.02 / call
• POST/api/xml/format

  Formats XML deterministically as UTF-8 without changing the nati

  Namespace-correct signed XML is refused because formatting could invalidate its signature.

• POST/api/xml/verify

  Verifies the restricted xmlvalidator-safe-rsa-sha256-v2 XML sign

  The safe v2 profile accepts one whole-document enveloped signature whose Reference URI is exactly empty or `#xpointer(/)`. The transforms must be enveloped-signature alone, or enveloped-signature followed by Canonical XML 1.0 or Exclusive Canonical XML 1.0, without comments. The one-transform form uses Canonical XML 1.0 explicitly. Other fragments, XPointer expressions, transforms, and external references are unsupported and are never resolved or executed. A `valid` result establishes reference-digest and RSA signature integrity only. Certificate trust, signer identity, and certificate-chain validity are not evaluated. Invalid, unsupported, and no-signature results are completed verification results and return HTTP 200. An unsupported result includes a stable diagnostic code and a safe, user-facing explanation of the refused profile feature.

  $0.10 / call