Schema Validation¶

Tip

Most of the documentation for this package assumes you’re familiar with the fundamentals of writing JSON schemas themselves, and focuses on how this library helps you validate with them in Python.

If you aren’t already comfortable with writing schemas and need an introduction which teaches about JSON Schema the specification, you may find Understanding JSON Schema to be a good read!

The Basics¶

The simplest way to validate an instance under a given schema is to use the validate function.

jsonschema.validate(instance, schema, cls=None, *args, **kwargs)[source]

Validate an instance under the given schema.

>>> validate([2, 3, 4], {"maxItems": 2})
Traceback (most recent call last):
    ...
ValidationError: [2, 3, 4] is too long

validate() will first verify that the provided schema is itself valid, since not doing so can lead to less obvious error messages and fail in less obvious or consistent ways.

If you know you have a valid schema already, especially if you intend to validate multiple instances with the same schema, you likely would prefer using the jsonschema.protocols.Validator.validate method directly on a specific validator (e.g. Draft202012Validator.validate).

Parameters:

instance – The instance to validate
schema – The schema to validate with
cls (jsonschema.protocols.Validator) – The class that will be used to validate the instance.

If the cls argument is not provided, two things will happen in accordance with the specification. First, if the schema has a $schema keyword containing a known meta-schema [1] then the proper validator will be used. The specification recommends that all schemas contain $schema properties for this reason. If no $schema property is found, the default validator class is the latest released draft.

Any other provided positional and keyword arguments will be passed on when instantiating the cls.

Raises:

jsonschema.exceptions.ValidationError – if the instance is invalid
jsonschema.exceptions.SchemaError – if the schema itself is invalid

Footnotes

Warning

Accepting untrusted schemas as input, especially when combined with untrusted data to validate, can lead to vulnerabilities even when restricting to official JSON Schema dialects and vocabularies. Never validate data against schemas from untrusted sources without proper sandboxing or input validation.

The Validator Protocol¶

jsonschema defines a protocol that all validator classes adhere to.

Hint

If you are unfamiliar with protocols, either as a general notion or as specifically implemented by typing.Protocol, you can think of them as a set of attributes and methods that all objects satisfying the protocol have.

Here, in the context of jsonschema, the Validator.iter_errors method can be called on jsonschema.validators.Draft202012Validator, or jsonschema.validators.Draft7Validator, or indeed any validator class, as all of them have it, along with all of the other methods described below.

class jsonschema.protocols.Validator(schema: Mapping | bool, resolver: Any = None, format_checker: jsonschema.FormatChecker | None = None, *, registry: referencing.jsonschema.SchemaRegistry = Ellipsis, regex_provider: jsonschema.protocols.RegexProvider = Ellipsis)[source]

The protocol to which all validator classes adhere.

Parameters:

schema – The schema that the validator object will validate with. It is assumed to be valid, and providing an invalid schema can lead to undefined behavior. See Validator.check_schema to validate a schema first.
registry – a schema registry that will be used for looking up JSON references
resolver –
a resolver that will be used to resolve $ref properties (JSON references). If unprovided, one will be created.

Deprecated since version v4.18.0: RefResolver has been deprecated in favor of JSON (Schema) Referencing, and with it, this argument.
format_checker – if provided, a checker which will be used to assert about format properties present in the schema. If unprovided, no format validation is done, and the presence of format within schemas is strictly informational. Certain formats require additional packages to be installed in order to assert against instances. Ensure you’ve installed jsonschema with its extra (optional) dependencies when invoking pip.
regex_provider – if provided, this is the RegexProvider that will be used when validating regex-based constructs, like patternProperties.

Deprecated since version v4.12.0: Subclassing validator classes now explicitly warns this is not part of their public API.

FORMAT_CHECKER: ClassVar[jsonschema.FormatChecker]: A jsonschema.FormatChecker that will be used when validating format keywords in JSON schemas.

ID_OF: _typing.id_of: A function which given a schema returns its ID.

META_SCHEMA: ClassVar[Mapping]: An object representing the validator’s meta schema (the schema that describes valid schemas in the given version).

REGEX_PROVIDER: ClassVar[jsonschema.protocols.RegexProvider]: A jsonschema.protocols.RegexProvider that will be used when handling

TYPE_CHECKER: ClassVar[jsonschema.TypeChecker]: A jsonschema.TypeChecker that will be used when validating type keywords in JSON schemas.

VALIDATORS: ClassVar[Mapping]: A mapping of validation keywords (strs) to functions that validate the keyword with that name. For more information see Creating or Extending Validator Classes.

classmethod check_schema(schema: Mapping | bool) → None[source]

Validate the given schema against the validator’s META_SCHEMA.

Raises:: jsonschema.exceptions.SchemaError – if the schema is invalid

evolve(**kwargs) → Validator[source]

Create a new validator like this one, but with given changes.

Preserves all other attributes, so can be used to e.g. create a validator with a different schema but with the same $ref resolution behavior.

>>> validator = Draft202012Validator({})
>>> validator.evolve(schema={"type": "number"})
Draft202012Validator(schema={'type': 'number'}, format_checker=None)

The returned object satisfies the validator protocol, but may not be of the same concrete class! In particular this occurs when a $ref occurs to a schema with a different $schema than this one (i.e. for a different draft).

>>> validator.evolve(
...     schema={"$schema": Draft7Validator.META_SCHEMA["$id"]}
... )
Draft7Validator(schema=..., format_checker=None)

is_type(instance: Any, type: str) → bool[source]

Check if the instance is of the given (JSON Schema) type.

Parameters:

instance – the value to check
type – the name of a known (JSON Schema) type

Returns:

whether the instance is of the given type

Raises:

jsonschema.exceptions.UnknownType – if type is not a known type

is_valid(instance: Any) → bool[source]

Check if the instance is valid under the current schema.

Returns:: whether the instance is valid or not

>>> schema = {"maxItems" : 2}
>>> Draft202012Validator(schema).is_valid([2, 3, 4])
False

iter_errors(instance: Any) → Iterable[ValidationError][source]

Lazily yield each of the validation errors in the given instance.

>>> schema = {
...     "type" : "array",
...     "items" : {"enum" : [1, 2, 3]},
...     "maxItems" : 2,
... }
>>> v = Draft202012Validator(schema)
>>> for error in sorted(v.iter_errors([2, 3, 4]), key=str):
...     print(error.message)
4 is not one of [1, 2, 3]
[2, 3, 4] is too long

Deprecated since version v4.0.0: Calling this function with a second schema argument is deprecated. Use Validator.evolve instead.

schema: Mapping | bool: The schema that will be used to validate instances

validate(instance: Any) → None[source]

Check if the instance is valid under the current schema.

Raises:: jsonschema.exceptions.ValidationError – if the instance is invalid

>>> schema = {"maxItems" : 2}
>>> Draft202012Validator(schema).validate([2, 3, 4])
Traceback (most recent call last):
    ...
ValidationError: [2, 3, 4] is too long

All of the versioned validators that are included with jsonschema adhere to the protocol, and any extensions of these validators will as well. For more information on creating or extending validators see Creating or Extending Validator Classes.

Type Checking¶

To handle JSON Schema’s type keyword, a Validator uses an associated TypeChecker. The type checker provides an immutable mapping between names of types and functions that can test if an instance is of that type. The defaults are suitable for most users - each of the versioned validators that are included with jsonschema have a TypeChecker that can correctly handle their respective versions.

Validating With Additional Types¶

Occasionally it can be useful to provide additional or alternate types when validating JSON Schema’s type keyword.

jsonschema tries to strike a balance between performance in the common case and generality. For instance, JSON Schema defines a number type, which can be validated with a schema such as {"type" : "number"}. By default, this will accept instances of Python numbers.Number. This includes in particular ints and floats, along with decimal.Decimal objects, complex numbers etc. For integer and object, however, rather than checking for numbers.Integral and collections.abc.Mapping, jsonschema simply checks for int and dict, since the more general instance checks can introduce significant slowdown, especially given how common validating these types are.

If you do want the generality, or just want to add a few specific additional types as being acceptable for a validator object, then you should update an existing jsonschema.TypeChecker or create a new one. You may then create a new Validator via jsonschema.validators.extend.

from jsonschema import validators

class MyInteger:
    pass

def is_my_int(checker, instance):
    return (
        Draft202012Validator.TYPE_CHECKER.is_type(instance, "number") or
        isinstance(instance, MyInteger)
    )

type_checker = Draft202012Validator.TYPE_CHECKER.redefine(
    "number", is_my_int,
)

CustomValidator = validators.extend(
    Draft202012Validator,
    type_checker=type_checker,
)
validator = CustomValidator(schema={"type" : "number"})

exception jsonschema.exceptions.UnknownType(type, instance, schema)[source]: A validator was asked to validate an instance against an unknown type.

Versioned Validators¶

jsonschema ships with validator classes for various versions of the JSON Schema specification. For details on the methods and attributes that each validator class provides see the Validator protocol, which each included validator class implements.

Each of the below cover a specific release of the JSON Schema specification.

class jsonschema.Draft202012Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

class jsonschema.Draft201909Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

class jsonschema.Draft7Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

class jsonschema.Draft6Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

class jsonschema.Draft4Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

class jsonschema.Draft3Validator(schema: referencing.jsonschema.Schema, resolver=None, format_checker: _format.FormatChecker | None = None, regex_provider: RegexProvider = <jsonschema._regex_provider.PythonRegexProvider object>, *, registry: referencing.jsonschema.SchemaRegistry = <Registry (20 resources)>, _resolver=None)

For example, if you wanted to validate a schema you created against the Draft 2020-12 meta-schema, you could use:

from jsonschema import Draft202012Validator

schema = {
    "$schema": Draft202012Validator.META_SCHEMA["$id"],

    "type": "object",
    "properties": {
        "name": {"type": "string"},
        "email": {"type": "string"},
    },
    "required": ["email"]
}
Draft202012Validator.check_schema(schema)

Validating Formats¶

JSON Schema defines the format keyword which can be used to check if primitive types (strings, numbers, booleans) conform to well-defined formats. By default, as per the specification, no validation is enforced. Optionally however, validation can be enabled by hooking a format-checking object into a Validator.

>>> validate("127.0.0.1", {"format" : "ipv4"})
>>> validate(
...     instance="-12",
...     schema={"format" : "ipv4"},
...     format_checker=Draft202012Validator.FORMAT_CHECKER,
... )
Traceback (most recent call last):
    ...
ValidationError: "-12" is not a "ipv4"

Some formats require additional dependencies to be installed.

The easiest way to ensure you have what is needed is to install jsonschema using the format or format-nongpl extras.

For example:

$ pip install jsonschema[format]

Or if you want to avoid GPL dependencies, a second extra is available:

$ pip install jsonschema[format-nongpl]

Warning

It is your own responsibility ultimately to ensure you are license-compliant, so you should be double checking your own dependencies if you rely on this extra.

The more specific list of formats along with any additional dependencies they have is shown below.

Warning

If a dependency is not installed when using a checker that requires it, validation will succeed without throwing an error, as also specified by the specification.

Checker	Notes
`color`	requires webcolors
`date`
`date-time`	requires rfc3339-validator
`duration`	requires isoduration
`email`
`hostname`	requires fqdn
`idn-hostname`	requires idna
`ipv4`
`ipv6`	OS must have `socket.inet_pton` function
`iri`	requires rfc3987 or rfc3987-syntax
`iri-reference`	requires rfc3987 or rfc3987-syntax
`json-pointer`	requires jsonpointer
`regex`
`relative-json-pointer`	requires jsonpointer
`time`	requires rfc3339-validator
`uri`	requires rfc3987 or rfc3986-validator
`uri-reference`	requires rfc3987 or rfc3986-validator
`uri-template`	requires uri-template
`uuid`

The supported mechanism for ensuring these dependencies are present is again as shown above, not by directly installing the packages.

class jsonschema.FormatChecker(formats: Iterable[str] | None = None)[source]

A format property checker.

JSON Schema does not mandate that the format property actually do any validation. If validation is desired however, instances of this class can be hooked into validators to enable format validation.

FormatChecker objects always return True when asked about formats that they do not know how to validate.

To add a check for a custom format use the FormatChecker.checks decorator.

Parameters:: formats – The known formats to validate. This argument can be used to limit which formats will be used during validation.

checkers¶: A mapping of currently known formats to tuple of functions that validate them and errors that should be caught. New checkers can be added and removed either per-instance or globally for all checkers using the FormatChecker.checks decorator.

classmethod cls_checks(format, raises=())[source]¶

Any instance created after this function is called will pick up the supplied checker.

Parameters:

format (str) – the format that the decorated function will check
raises (Exception) – the exception(s) raised by the decorated function when an invalid instance is found. The exception object will be accessible as the jsonschema.exceptions.ValidationError.cause attribute of the resulting validation error.

Deprecated since version v4.14.0: Use FormatChecker.checks on an instance instead.

check(instance: object, format: str) → None[source]

Check whether the instance conforms to the given format.

Parameters:

instance (any primitive type, i.e. str, number, bool) – The instance to check
format – The format that instance should conform to

Raises:

FormatError – if the instance does not conform to format

checks(format: str, raises: type[Exception] | tuple[type[Exception], ...] = ()) → Callable[[_F], _F][source]

Parameters:

format – The format that the decorated function will check.
raises –
The exception(s) raised by the decorated function when an invalid instance is found.

The exception object will be accessible as the jsonschema.exceptions.ValidationError.cause attribute of the resulting validation error.

conforms(instance: object, format: str) → bool[source]

Check whether the instance conforms to the given format.

Parameters:

instance (any primitive type, i.e. str, number, bool) – The instance to check
format – The format that instance should conform to

Returns:

whether it conformed

Return type:

bool

exception jsonschema.exceptions.FormatError(message, cause=None)[source]: Validating a format failed.

Format-Specific Notes¶

regex¶

The JSON Schema specification recommends (but does not require) that implementations use ECMA 262 regular expressions.

Given that there is no current library in Python capable of supporting the ECMA 262 dialect, the regex format will instead validate Python regular expressions, which are the ones used by this implementation for other keywords like pattern or patternProperties.

Note

The regex format checker currently uses Python’s re module regardless of any custom regex provider that may be in use. A pattern accepted by Python’s re but rejected by a custom engine — such as a backreference when using RE2 — will pass the format check but fail at match time. See Regex Providers for details.

email¶

Since in most cases “validating” an email address is an attempt instead to confirm that mail sent to it will deliver to a recipient, and that that recipient is the correct one the email is intended for, and since many valid email addresses are in many places incorrectly rejected, and many invalid email addresses are in many places incorrectly accepted, the email format keyword only provides a sanity check, not full RFC 5322 validation.

The same applies to the idn-email format.

If you indeed want a particular well-specified set of emails to be considered valid, you can use FormatChecker.checks to provide your specific definition.

Regex Providers¶

jsonschema uses regular expressions when validating schemas. By default, these operations use Python’s built-in re module.

Python’s re engine is vulnerable to catastrophic (or “pathological”) backtracking, which occurs when a regular expression and an input cause the re module to run for exponentially long periods of time. If you are validating user-submitted input against user-supplied schemas, you may want to use a regular expression engine that isn’t vulnerable.

The `RegexProvider` Protocol¶

A regex provider is any class that satisfies the jsonschema.protocols.RegexProvider protocol.

Two methods are required, as well as a class attribute named raises:

raises: tuple[type[Exception], ...]

A tuple of exception classes that might be raised when interacting with the regex provider.

compile(pattern: str)

Compile pattern and return the result.

This is expected to be equivalent to the behavior of the builtin re.compile() function.

search(pattern, text: str)

Search for text in the pattern.

pattern may be a string, or the result returned by compile(), above.

This is expected to be equivalent to the behavior of the builtin re.search() function.

Depending on your use case and the features or drawbacks of the regex engine you’re using, it may be beneficial to use caching.

Installing a Provider at the Class Level¶

Pass a regex provider instance to jsonschema.validators.extend to derive a validator class that uses your regex provider:

from jsonschema import validators

SafeValidator = validators.extend(
    validators.Draft202012Validator,
    regex_provider=MyProvider(),
)

All instances of SafeValidator will use MyProvider by default. The same argument is accepted by jsonschema.validators.create when building a validator class from scratch.

Per-Instance Override¶

Pass a provider instance to the validator constructor to override the default for a single validator instance:

validator = Draft202012Validator(schema, regex_provider=MyProvider())

Critical pitfalls¶

The {"format": "regex"} format checker in jsonschema is hard-coded to use Python’s re module to determine whether a string is a valid regular expression. It currently cannot access the regex provider you designate, so its validity check may not align with what your regex engine supports.

At the current time, the only solution is to override the default "regex" format checker with a custom function.

You cannot use the extend function’s format_checker argument because when Validator.check_schema is called jsonschema creates a new validator class that will not honor that argument format_checker. Therefore, always override the class attribute FORMAT_CHECKER directly:

def is_regex(instance: str) -> bool:
    if not isinstance(instance, str):
        return True
    return bool(re2.compile(_instance))

MyValidator.FORMAT_CHECKER.checkers["regex"] = (is_regex, (MyException,))

Example: `google-re2`¶

Google RE2 is a regex engine that is not vulnerable to catastrophic backtracking (it simply doesn’t support features that require backtracking, like backreferences or lookahead assertions). It is available as the google-re2 package on PyPI and exposes a re-compatible Python API.

import jsonschema
import re2

class Re2Provider(jsonschema.protocols.RegexProvider):
    raises = (re2.error,)
    compile = staticmethod(re2.compile)
    search = staticmethod(re2.search)

SafeValidator = jsonschema.validators.extend(
    jsonschema.validators.Draft202012Validator,
    regex_provider=Re2Provider(),
)

def is_regex(instance: str) -> bool:
    if not isinstance(instance, str):
        return True
    return bool(re2.compile(instance))

SafeValidator.FORMAT_CHECKER.checkers["regex"] = (is_regex, Re2Provider.raises)

Schema Validation¶

The Basics¶

The Validator Protocol¶

Type Checking¶

Validating With Additional Types¶

Versioned Validators¶

Validating Formats¶

Format-Specific Notes¶

regex¶

email¶

Regex Providers¶

The RegexProvider Protocol¶

Installing a Provider at the Class Level¶

Per-Instance Override¶

Critical pitfalls¶

Example: google-re2¶

The `RegexProvider` Protocol¶

Example: `google-re2`¶