OpenAPI payload validator

FREE with proof-of-work · or $0.001 in USDC · POST /api/openapi-validate-payload

Validate a JSON payload against the request or response schema for one operation in an OpenAPI 3.x or Swagger 2.x spec. Send POST /api/openapi-validate-payload with the required fields spec, part and payload and pay $0.001 per call over x402 or MPP, or call it free by solving a proof-of-work challenge. It returns a JSON object with valid, schemaPresent and errors.

Locate the operation by operationId or method+path; choose `part: "request"` or `part: "response"` (status defaults to the first 2xx). Deterministic subset of JSON Schema: type, required, enum, properties, items, additionalProperties:false, oneOf/anyOf/allOf, $ref-detection (not dereferenced). Returns `valid`, `schemaPresent` (false → no contract to check; result is vacuously valid), and ordered `errors[]` with stable rule codes. Pure CPU - deterministic, no network.

Category: Validation & parsing · Tags: openapi swagger validation json-schema api agent-readiness

TRY IN PLAYGROUND →

Parameters

Name	Type	Required	Description
`spec`	any	yes	OpenAPI/Swagger document (object or JSON string) Also accepted as `openapi`, `schema`, `document`, `doc`, `definition`.
`operationId`	any	no	operationId to validate against (preferred)
`method`	any	no	HTTP method (use with `path` if no operationId)
`path`	any	no	Path template (use with `method` if no operationId)
`part`	any	yes	Schema to validate against: "request" or "response"
`status`	any	no	Response status when part="response" (defaults to first 2xx)
`payload`	any	yes	JSON value to validate Also accepted as `body`, `data`, `claims`, `message`.

Example request

curl -i -X POST https://agent402.tools/api/openapi-validate-payload \
  -H "Content-Type: application/json" \
  -d '{"spec":{"openapi":"3.0.0","paths":{"/users":{"post":{"operationId":"createUser","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["name","email"],"properties":{"name":{"type":"string"},"email":{"type":"string"},"age":{"type":"integer"},"role":{"type":"string","enum":["admin","user"]}},"additionalProperties":false}}}},"responses":{"201":{"description":"ok"}}}}}},"operationId":"createUser","part":"request","payload":{"name":"Alice","age":"thirty","extra":"noise"}}'

Without payment this returns HTTP 402 Payment Required with the exact price for openapi-validate-payload; any x402 v2 or MPP client pays it and retries.

Example response

{
  "valid": false,
  "schemaPresent": true,
  "errors": [
    {
      "path": "",
      "rule": "required",
      "message": "missing required field: email"
    },
    {
      "path": ".age",
      "rule": "type",
      "message": "expected integer, got string"
    },
    {
      "path": ".extra",
      "rule": "additionalProperties",
      "message": "unexpected property: extra"
    }
  ]
}

Field	Type	Always present	In the example
`valid`	boolean	yes	false
`schemaPresent`	boolean	yes	true
`errors`	array of objects	yes	3 items in the example

From an MCP client

catalog.call {
  "slug": "openapi-validate-payload",
  "params": {
    "spec": {
      "openapi": "3.0.0",
      "paths": {
        "/users": {
          "post": {
            "operationId": "createUser",
            "requestBody": {
              "content": {
                "application/json": {
                  "schema": {
                    "type": "object",
                    "required": [
                      "name",
                      "email"
                    ],
                    "properties": {
                      "name": {
                        "type": "string"
                      },
                      "email": {
                        "type": "string"
                      },
                      "age": {
                        "type": "integer"
                      },
                      "role": {
                        "type": "string",
                        "enum": [
                          "admin",
                          "user"
                        ]
                      }
                    },
                    "additionalProperties": false
                  }
                }
              }
            },
            "responses": {
              "201": {
                "description": "ok"
              }
            }
          }
        }
      }
    },
    "operationId": "createUser",
    "part": "request",
    "payload": {
      "name": "Alice",
      "age": "thirty",
      "extra": "noise"
    }
  }
}

On the hosted connector at https://agent402.tools/mcp, catalog.call runs openapi-validate-payload free (rate-limited, no wallet). Local install: npx -y agent402-mcp.

Errors and behavior

spec, part and payload are required. An input the tool rejects returns an HTTP 4xx whose body carries error, tool, expected, required and example, so the caller can correct it.
A paid call that ends in any status of 400 or above is not charged over x402, MPP or a prepaid credits key: settlement is cancelled when the tool fails. The exception is a Tempo push credential, a transfer the buyer sent before the call: it settles before the tool runs, so if the tool then fails the payment is recorded as a refund owed to the paying wallet.
Free tier: no outbound network call leaves the server for this tool, so proof-of-work (16 leading zero bits of sha256) pays for it.
A GET or HEAD to /api/openapi-validate-payload returns the same 402 quote, so the price can be read without a body.
An Idempotency-Key header makes a retried paid call replay the first 200 instead of charging again (an answer larger than 1 MB is not replayed).

Paid call (JavaScript agent)

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
client.setSpendControls?.(false); // keep your own spending ceiling in code
registerExactEvmScheme(client, { signer: privateKeyToAccount(KEY) });
const payFetch = wrapFetchWithPayment(fetch, client);

const res = await payFetch("https://agent402.tools/api/openapi-validate-payload", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "spec": {
      "openapi": "3.0.0",
      "paths": {
        "/users": {
          "post": {
            "operationId": "createUser",
            "requestBody": {
              "content": {
                "application/json": {
                  "schema": {
                    "type": "object",
                    "required": [
                      "name",
                      "email"
                    ],
                    "properties": {
                      "name": {
                        "type": "string"
                      },
                      "email": {
                        "type": "string"
                      },
                      "age": {
                        "type": "integer"
                      },
                      "role": {
                        "type": "string",
                        "enum": [
                          "admin",
                          "user"
                        ]
                      }
                    },
                    "additionalProperties": false
                  }
                }
              }
            },
            "responses": {
              "201": {
                "description": "ok"
              }
            }
          }
        }
      }
    },
    "operationId": "createUser",
    "part": "request",
    "payload": {
      "name": "Alice",
      "age": "thirty",
      "extra": "noise"
    }
  }),
});

No wallet? Pay with compute

Fetch a challenge, solve the sha256 puzzle (16 leading zero bits, a fraction of a second of CPU), and resend with the X-Pow-Solution header:

import { createHash } from "node:crypto";
const lz = (b) => { let t = 0; for (const x of b) { if (!x) { t += 8; continue; } t += Math.clz32(x) - 24; break; } return t; };
const c = await (await fetch("https://agent402.tools/api/pow/challenge?slug=openapi-validate-payload")).json();
let n = 0;
while (lz(createHash("sha256").update(c.challenge + ":" + n).digest()) < c.difficulty) n++;
await fetch("https://agent402.tools/api/openapi-validate-payload", { method: "POST", headers: { "X-Pow-Solution": c.token + ":" + n, "Content-Type": "application/json" }, body: JSON.stringify({"spec":{"openapi":"3.0.0","paths":{"/users":{"post":{"operationId":"createUser","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["name","email"],"properties":{"name":{"type":"string"},"email":{"type":"string"},"age":{"type":"integer"},"role":{"type":"string","enum":["admin","user"]}},"additionalProperties":false}}}},"responses":{"201":{"description":"ok"}}}}}},"operationId":"createUser","part":"request","payload":{"name":"Alice","age":"thirty","extra":"noise"}}) });

Part of these workflows

OpenAPI payload validator is one step in these 2 skill packs, each sold as a single call:

API contract drift check - The 'did this API contract change in a way that breaks our integration?' workflow. Diff two OpenAPI snapshots structurally, lint the new one for agent-readiness regressions, extract the endpoint surface for inventory comparison, validate a known-good payload against the new contract, and summarize security-relevant changes. Six tools, one go/no-go answer on whether the upstream API broke us.
OpenAPI spec audit - Lint an OpenAPI spec and validate a sample payload against it - catch schema errors in one pass.

OpenAPI payload validator

Parameters

Example request

Example response

From an MCP client

Errors and behavior

Paid call (JavaScript agent)

No wallet? Pay with compute

Part of these workflows

Related tools

OpenAPI agent-readiness lint

OpenAPI endpoint extractor

OpenAPI mock response generator

OpenAPI operation search

OpenAPI to curl command

OpenAPI / Swagger diff