JSON Schema Specification

repository·main·Indexed 26 days ago

https://github.com/json-schema-org/json-schema-spec

The official specification for JSON Schema, including architectural decision records (ADRs) and guidance on the Specification Development Lifecycle (SDLC). It covers the meta-schema, custom keyword extensions, stability levels for features, and the use of application/schema+json and application/schema-instance+json media types for content negotiation.

Tokens
19.6K
Snippets
28
Records
113
Agent score
90%

What's inside json-schema-spec

  1. Understand JSON Schema keyword behaviors

    main

    JSON Schema keywords are categorized into three primary behaviors:

    1. Assertions: Validate that an instance satisfies specific constraints, returning true if satisfied and false otherwise.
    2. Annotations: Attach metadata to specific instance locations for application-level use (e.g., title, description).
    3. Applicators: Apply subschemas to parts of the instance and combine their results (e.g., allOf, anyOf, not).

    Note that operational directive keywords like $id and $schema provide metadata for implementation processing and do not fall into these three categories.

  2. Understand Applicator keywords

    main

    Applicators are used to build complex schemas by applying subschemas to the instance. They behave as assertions by combining the boolean results of their subschemas using logic (e.g., allOf for conjunction, not for negation).

    Applicators can work in two ways:

    1. In-place: Applying subschemas to the current location.
    2. By Reference: Referring to a schema elsewhere (the referenced schema) from the current schema (the referencing schema). Keywords like $ref use static analysis, while $dynamicRef uses dynamic scoping.
  3. Understand the Machine-Readable JSON Schema Validation Output Specification

    main
    This specification defines a standard format for machine-readable validation results and annotations in JSON Schema to ensure cross-platform compatibility. Implementations SHOULD conform to this format so that machine consumers can consistently interpret whether an instance is valid and where validation occurred.
  4. Understand JSON Schema Validation concepts

    main

    JSON Schema validation is used to assert constraints on the structure of JSON instance data. An instance is considered valid if all locations within the instance satisfy all asserted constraints defined by the schema keywords.

    Key concepts:

    • Assertion Keywords: Keywords that define constraints (e.g., requiring a specific type or value).
    • Metadata Keywords: Keywords used to annotate instances with non-assertion information (e.g., descriptions or UI hints).
    • Container Instance: Refers to both JSON arrays and objects.
    • Children Instances: Refers to array elements or object member values.
    • Independent Evaluation: Each schema object is evaluated independently against each instance location, meaning validators do not need to maintain state across the document-wide validation process.
  5. Understand the JSON Schema specification development lifecycle

    main

    JSON Schema has decoupled from the IETF (Internet Engineering Task Force) standards track to implement a custom Specification Development Lifecycle (SDLC). Unlike typical IETF Internet-Drafts (I-Ds) which are often considered "incomplete" or "not ready for production," JSON Schema releases are intended for immediate production use.

    Key characteristics of the current approach:

    • Production Readiness: All releases are intended to be used in production environments.
    • Versioning: The project uses date-based versioning rather than the standard IETF draft versioning system.
    • Governance: The project is a member of the OpenJS Foundation (a sub-group of the Linux Foundation), which provides the necessary credibility for standards referencing in lieu of IETF/W3C status.
  6. Understand the core concepts of JSON Schema

    main

    JSON Schema is a declarative language used for two primary purposes:

    1. Validation: Ensuring a JSON instance conforms to a specific structure and set of constraints.
    2. Annotation: Attaching metadata to values in a JSON document for use by applications (e.g., documentation generation, form builders, or type code generation).

    A JSON Schema is itself a JSON document. A JSON value is considered valid against a schema if it satisfies the constraints defined by every keyword within that schema. Evaluation is a recursive process where keywords can contain subschemas to describe complex structures like objects and arrays.

  7. Understand the JSON Schema specification development process

    main

    JSON Schema uses a TC-39 inspired development process. Unlike traditional versioned releases where each version is a distinct, immutable document, the JSON Schema specification is a mutable spec. This means there is only one current version of the spec that evolves over time.

    Key Concepts:

    • Mutable Spec: The specification document can change at any time to include clarifications, bug fixes, or new features.
    • Stability Levels: Features within the spec are flagged by their stability level.
      • Stable features: Subject to strict backward and forward compatibility requirements. Once a feature is marked stable, it will not change in a way that breaks existing schemas.
      • Unstable features: New or evolving features that do not yet meet the strict requirements for stability. These are used for rapid iteration and real-world vetting.
    • Releases: A "release" is defined as the promotion of unstable features to "stable" status. These typically occur once a year and are designated by the year of release.
  8. Understand JSON Schema validation output formats

    main

    The specification defines three distinct machine-readable output formats for JSON Schema validation and annotation results. An implementation MUST provide the flag format and SHOULD provide at least one of the list or hierarchical formats.

    • Flag: A simple boolean indicating the overall validation result (valid).
    • List: A flat list of output units contained within a root output unit.
    • Hierarchical: A tree structure that follows the evaluation paths generated during processing, resembling the schema structure (with references inlined).
  9. Secure external schema resolution

    main

    Resolving external references (via https: or file:) introduces security risks. It is recommended to disable dynamic retrieval by default and use a local registry. If dynamic retrieval is enabled, implement the following protections:

    HTTP(S) Security

    • DoS Protection: Set timeouts on dynamic retrievals to prevent validation from hanging on slow responses.
    • SSRF Protection: Restrict HTTP schema retrieval to a configurable allowlist of trusted domains to prevent Server-Side Request Forgery.
    • Integrity: Only allow retrieval over https: unless unsecured transport is explicitly configured.

    File System Security

    • Information Disclosure: Restrict filesystem access to a specific, dedicated schema directory tree.
    • Cross-Context Access: Only allow file: references if the referencing schema was also loaded from the filesystem (similar to same-origin policies).
    • Path Sanitization: Reject $id values that use the file: scheme. If file: URIs are used internally, sanitize them (e.g., convert to relative URIs) to avoid exposing host filesystem structures.
  10. Understand how Assertions work with primitive types

    main

    Most assertions only constrain values within a specific primitive type. If the instance's type does not match the type targeted by the keyword, the instance is considered to conform to that assertion.

    For example, the maxLength keyword only restricts strings. If the instance is a number, boolean, null, array, or object, it is considered valid against the maxLength assertion. This allows you to combine keywords using type to create flexible schemas:

    {
      "type": ["string", "null"],
      "maxLength": 255
    }

    In this example, if the value is a string, it must be $\le$ 255 characters. If the value is null, it passes the maxLength assertion automatically.

  11. Load and Associate Remote Schemas

    main

    Implementations should ideally know which schemas and IRIs they will use ahead of time.

    • Pre-loading: You can supply IRIs and their associated schemas to an implementation prior to processing instances.
    • Automatic Association: Implementations can associate arbitrary IRIs with schemas, often using the $id value.
    • Fetching: While implementations MAY automatically fetch schemas via HTTP, this functionality SHOULD be disabled by default to support offline operation.