@@ -55,11 +55,11 @@ which it applies. This greatly simplifies the implementation requirements for
55
55
validators by ensuring that they do not need to maintain state across the
56
56
document-wide validation process.
57
57
58
- This specification defines a set of assertion keywords, as well as a small
59
- vocabulary of metadata keywords that can be used to annotate the JSON instance
60
- with useful information. The {{format}} keyword is intended primarily as an
61
- annotation, but can optionally be used as an assertion. The {{content}} keywords
62
- are annotations for working with documents embedded as JSON strings.
58
+ This specification defines a set of assertion keywords, as well as a number of
59
+ metadata keywords that can be used to annotate the JSON instance with useful
60
+ information. The {{format}} keyword is intended primarily as an annotation, but
61
+ can optionally be used as an assertion. The {{content}} keywords are annotations
62
+ for working with documents embedded as JSON strings.
63
63
64
64
## Interoperability Considerations
65
65
@@ -87,32 +87,21 @@ regular expressions in the [JSON Schema Core](#json-schema) specification.
87
87
88
88
The current IRI for the default JSON Schema dialect meta-schema is
89
89
` https://json-schema.org/draft/next/schema ` . For schema author convenience, this
90
- meta-schema describes a dialect consisting of all vocabularies defined in this
91
- specification and the JSON Schema Core specification, as well as two former
92
- keywords which are reserved for a transitional period. Individual vocabulary and
93
- vocabulary meta-schema IRIs are given for each section below. Certain
94
- vocabularies are optional to support, which is explained in detail in the
95
- relevant sections.
90
+ meta-schema describes a dialect consisting of all keywords defined in this
91
+ specification and the JSON Schema Core specification. Certain keywords specify
92
+ some functionality which is optional to support and is explained in detail in
93
+ the relevant sections.
96
94
97
- Updated vocabulary and meta-schema IRIs MAY be published between specification
98
- drafts in order to correct errors. Implementations SHOULD consider IRIs dated
99
- after this specification draft and before the next to indicate the same syntax
100
- and semantics as those listed here.
95
+ Updated meta-schema IRIs MAY be published between specification drafts in order
96
+ to correct errors. Implementations SHOULD consider IRIs dated after this
97
+ specification draft and before the next to indicate the same syntax and
98
+ semantics as those listed here.
101
99
102
- ## A Vocabulary for Structural Validation
100
+ ## Keywords for Structural Validation
103
101
104
102
Validation keywords in a schema impose requirements for successful validation of
105
103
an instance. These keywords are all assertions without any annotation behavior.
106
104
107
- Meta-schemas that do not use ` $vocabulary ` SHOULD be considered to require this
108
- vocabulary as if its IRI were present with a value of true.
109
-
110
- The current IRI for this vocabulary, known as the Validation vocabulary, is:
111
- ` https://json-schema.org/draft/next/vocab/validation ` .
112
-
113
- The current IRI for the corresponding meta-schema is:
114
- ` https://json-schema.org/draft/next/meta/validation ` .
115
-
116
105
### Validation Keywords for Any Instance Type {#general}
117
106
118
107
#### ` type `
@@ -295,7 +284,7 @@ the name of a property in the instance.
295
284
296
285
Omitting this keyword has the same behavior as an empty object.
297
286
298
- ## Vocabularies for Semantic Content With ` format ` {#format}
287
+ ## Semantic Content With ` format ` {#format}
299
288
300
289
### Foreword
301
290
@@ -320,115 +309,57 @@ can be used alongside the `type` keyword with a value of "integer", or could be
320
309
explicitly defined to always pass if the number is not an integer, which
321
310
produces essentially the same behavior as only applying to integers.
322
311
323
- The current IRI for this vocabulary, known as the Format-Annotation vocabulary,
324
- is: ` https://json-schema.org/draft/next/vocab/format-annotation ` . The current
325
- IRI for the corresponding meta-schema is:
326
- ` https://json-schema.org/draft/next/meta/format-annotation ` . Implementing
327
- support for this vocabulary is REQUIRED.
328
-
329
- In addition to the Format-Annotation vocabulary, a secondary vocabulary is
330
- available for custom meta-schemas that defines ` format ` as an assertion. The IRI
331
- for the Format-Assertion vocabulary, is:
332
- ` https://json-schema.org/draft/next/vocab/format-assertion ` . The current IRI for
333
- the corresponding meta-schema is:
334
- ` https://json-schema.org/draft/next/meta/format-assertion ` . Implementing support
335
- for the Format-Assertion vocabulary is OPTIONAL.
336
-
337
- Specifying both the Format-Annotation and the Format-Assertion vocabularies is
338
- functionally equivalent to specifying only the Format-Assertion vocabulary since
339
- its requirements are a superset of the Format-Annotation vocabulary.
340
-
341
- ### Implementation Requirements
342
-
343
- The ` format ` keyword functions as defined by the vocabulary which is referenced.
344
-
345
- #### Format-Annotation Vocabulary
346
-
347
- The value of format MUST be collected as an annotation, if the implementation
348
- supports annotation collection. This enables application-level validation when
349
- schema validation is unavailable or inadequate.
350
-
351
- Implementations MAY still treat ` format ` as an assertion in addition to an
352
- annotation and attempt to validate the value's conformance to the specified
353
- semantics. The implementation MUST provide options to enable and disable such
354
- evaluation and MUST be disabled by default. Implementations SHOULD document
355
- their level of support for such validation.[ ^ 2 ]
312
+ Implementing support for ` format ` as an annotation is REQUIRED (if the
313
+ implementation supports annotation collection).
356
314
357
- [ ^ 2 ] : Specifying the Format-Annotation vocabulary and enabling validation in an
358
- implementation should not be viewed as being equivalent to specifying the
359
- Format-Assertion vocabulary since implementations are not required to provide
360
- full validation support when the Format-Assertion vocabulary is not specified.
361
-
362
- When the implementation is configured for assertion behavior, it:
315
+ Implementing support for ` format ` as an assertion is OPTIONAL. Implementations
316
+ which choose to support assertion behavior:
363
317
318
+ - MUST still collect the keyword's value as an annotation (if the implementation
319
+ supports annotation collection),
320
+ - MUST provide a configuration option to enable assertion behavior, defaulting to
321
+ annotation-only behavior
364
322
- SHOULD provide an implementation-specific best effort validation for each
365
- format attribute defined below;
323
+ format attribute defined below;[ ^ 3 ]
366
324
- MAY choose to implement validation of any or all format attributes as a no-op
367
- by always producing a validation result of true;[ ^ 3 ]
325
+ by always producing a validation result of true;[ ^ 4 ]
326
+ - SHOULD use a common parsing library for each format, or a well-known regular
327
+ expression;
328
+ - SHOULD clearly document how and to what degree each format attribute is
329
+ validated.
330
+
331
+ [ ^ 3 ] : The expectation is that for simple formats such as date-time, syntactic
332
+ validation will be thorough. For a complex format such as email addresses, which
333
+ are the amalgamation of various standards and numerous adjustments over time,
334
+ with obscure and/or obsolete rules that may or may not be restricted by other
335
+ applications making use of the value, a minimal validation is sufficient. For
336
+ example, an instance string that does not contain an "@" is clearly not a valid
337
+ email address, and an "email" or "hostname" containing characters outside of
338
+ 7-bit ASCII is likewise clearly invalid.
368
339
369
- [ ^ 3 ] : This matches the current reality of implementations, which provide widely
340
+ [ ^ 4 ] : This matches the current reality of implementations, which provide widely
370
341
varying levels of validation, including no validation at all, for some or all
371
342
format attributes. It is also designed to encourage relying only on the
372
343
annotation behavior and performing semantic validation in the application, which
373
344
is the recommended best practice.
374
345
375
- #### Format-Assertion Vocabulary
376
-
377
- When the Format-Assertion vocabulary is declared with a value of true,
378
- implementations MUST provide full validation support for all of the formats
379
- defined by this specification. Implementations that cannot provide full
380
- validation support MUST refuse to process the schema.
381
-
382
- An implementation that supports the Format-Assertion vocabulary:
383
-
384
- - MUST still collect ` format ` as an annotation if the implementation supports
385
- annotation collection;
386
- - MUST evaluate ` format ` as an assertion;
387
- - MUST implement syntactic validation for all format attributes defined in this
388
- specification, and for any additional format attributes that it recognizes,
389
- such that there exist possible instance values of the correct type that will
390
- fail validation.
391
-
392
346
The requirement for minimal validation of format attributes is
393
347
intentionally vague and permissive, due to the complexity involved in many of
394
348
the attributes. Note in particular that the requirement is limited to syntactic
395
349
checking; it is not to be expected that an implementation would send an email,
396
350
attempt to connect to a URL, or otherwise check the existence of an entity
397
- identified by a format instance.[ ^ 4 ]
398
-
399
- [ ^ 4 ] : The expectation is that for simple formats such as date-time, syntactic
400
- validation will be thorough. For a complex format such as email addresses, which
401
- are the amalgamation of various standards and numerous adjustments over time,
402
- with obscure and/or obsolete rules that may or may not be restricted by other
403
- applications making use of the value, a minimal validation is sufficient. For
404
- example, an instance string that does not contain an "@" is clearly not a valid
405
- email address, and an "email" or "hostname" containing characters outside of
406
- 7-bit ASCII is likewise clearly invalid.
407
-
408
- It is RECOMMENDED that implementations use a common parsing library for each
409
- format, or a well-known regular expression. Implementations SHOULD clearly
410
- document how and to what degree each format attribute is validated.
411
-
412
- The [ standard core and validation meta-schema] ( #meta-schema ) includes this
413
- vocabulary in its ` $vocabulary ` keyword with a value of false, since by default
414
- implementations are not required to support this keyword as an assertion.
415
- Supporting the format vocabulary with a value of true is understood to greatly
416
- increase code size and in some cases execution time, and will not be appropriate
417
- for all implementations.
351
+ identified by a format instance.
418
352
419
353
#### Custom format attributes
420
354
421
355
Implementations MAY support custom format attributes. Save for agreement between
422
356
parties, schema authors SHALL NOT expect a peer implementation to support such
423
- custom format attributes. An implementation MUST NOT fail to collect unknown
424
- formats as annotations. When the Format-Assertion vocabulary is specified,
425
- implementations MUST fail upon encountering unknown formats.
357
+ custom format attributes.
426
358
427
- Vocabularies do not support specifically declaring different value sets for
428
- keywords. Due to this limitation, and the historically uneven implementation of
429
- this keyword, it is RECOMMENDED to define additional keywords in a custom
430
- vocabulary rather than additional format attributes if interoperability is
431
- desired.
359
+ An implementation MUST NOT fail to collect unknown formats as annotations.
360
+
361
+ When configured for assertion behavior for ` format ` , implementations MUST fail
362
+ upon encountering unknown formats.
432
363
433
364
### Defined Formats
434
365
@@ -560,7 +491,7 @@ Implementations that validate formats MUST accept at least the subset of
560
491
ECMA-262 defined in {{regexinterop}}), and SHOULD accept all valid ECMA-262
561
492
expressions.
562
493
563
- ## A Vocabulary for the Contents of String-Encoded Data {#content}
494
+ ## Keywords for the Contents of String-Encoded Data {#content}
564
495
565
496
### Foreword
566
497
@@ -573,15 +504,6 @@ encoded, and/or how it may be validated. They do not function as validation
573
504
assertions; a malformed string-encoded document MUST NOT cause the containing
574
505
instance to be considered invalid.
575
506
576
- Meta-schemas that do not use ` $vocabulary ` SHOULD be considered to require this
577
- vocabulary as if its IRI were present with a value of true.
578
-
579
- The current IRI for this vocabulary, known as the Content vocabulary, is:
580
- ` https://json-schema.org/draft/next/vocab/content ` .
581
-
582
- The current IRI for the corresponding meta-schema is:
583
- ` https://json-schema.org/draft/next/meta/content ` .
584
-
585
507
### Implementation Requirements
586
508
587
509
Due to security and performance concerns, as well as the open-ended nature of
@@ -710,20 +632,12 @@ structures: first the header, and then the payload. Since the JWT media type
710
632
ensures that the JWT can be represented in a JSON string, there is no need for
711
633
further encoding or decoding.
712
634
713
- ## A Vocabulary for Basic Meta-Data Annotations These general-purpose annotation
714
- keywords provide commonly used information for documentation and user interface
715
- display purposes. They are not intended to form a comprehensive set of features.
716
- Rather, additional vocabularies can be defined for more complex annotation-based
717
- applications.
718
-
719
- Meta-schemas that do not use ` $vocabulary ` SHOULD be considered to require this
720
- vocabulary as if its IRI were present with a value of true.
635
+ ## Keywords for Basic Meta-Data Annotations
721
636
722
- The current IRI for this vocabulary, known as the Meta-Data vocabulary, is:
723
- ` https://json-schema.org/draft/next/vocab/meta-data ` .
724
-
725
- The current IRI for the corresponding meta-schema is:
726
- ` https://json-schema.org/draft/next/meta/meta-data ` .
637
+ These general-purpose annotation keywords provide commonly used information for
638
+ documentation and user interface display purposes. They are not intended to form
639
+ a comprehensive set of features. Rather, additional keywords can be defined
640
+ for more complex annotation-based applications.
727
641
728
642
### ` title ` and ` description `
729
643
@@ -815,10 +729,10 @@ example. If `examples` is absent, `default` MAY still be used in this manner.
815
729
816
730
## Security Considerations {#security}
817
731
818
- JSON Schema validation defines a vocabulary for JSON Schema core and concerns
819
- all the security considerations listed there .
732
+ JSON Schema Validation assumes all the security considerations listed in the
733
+ JSON Schema Core specification .
820
734
821
- JSON Schema validation allows the use of Regular Expressions, which have
735
+ JSON Schema Validation allows the use of Regular Expressions, which have
822
736
numerous different (often incompatible) implementations. Some implementations
823
737
allow the embedding of arbitrary code, which is outside the scope of JSON Schema
824
738
and MUST NOT be permitted. Regular expressions can often also be crafted to be
@@ -969,40 +883,6 @@ draft-bhutton-json-schema-01, June 2022,
969
883
Hoehrmann, B., "Scripting Media Types", RFC 4329, DOI 10.17487/RFC4329, April
970
884
2006, << https://www.rfc-editor.org/info/rfc4329 > >.
971
885
972
- ## [ Appendix] Keywords Moved from Validation to Core
973
-
974
- Several keywords have been moved from this document into the [ Core
975
- Specification] ( #json-schema ) starting with draft 2019-09, in some cases with
976
- re-naming or other changes. This affects the following former validation
977
- keywords:
978
-
979
- - * ` definitions ` * Renamed to ` $defs ` to match ` $ref ` and be shorter to type.
980
- Schema vocabulary authors SHOULD NOT define a ` definitions ` keyword with
981
- different behavior in order to avoid invalidating schemas that still use the
982
- older name. While ` definitions ` is absent in the single-vocabulary
983
- meta-schemas referenced by this document, it remains present in the default
984
- meta-schema, and implementations SHOULD assume that ` $defs ` and ` definitions `
985
- have the same behavior when that meta-schema is used.
986
- - * ` allOf ` , ` anyOf ` , ` oneOf ` , ` not ` , ` if ` , ` then ` , ` else ` , ` items ` ,
987
- ` additionalItems ` , ` contains ` , ` propertyNames ` , ` properties ` ,
988
- ` patternProperties ` , ` additionalProperties ` * All of these keywords apply
989
- subschemas to the instance and combine their results, without asserting any
990
- conditions of their own. Without assertion keywords, these applicators can
991
- only cause assertion failures by using the false boolean schema, or by
992
- inverting the result of the true boolean schema (or equivalent schema
993
- objects). For this reason, they are better defined as a generic mechanism on
994
- which validation, hyper-schema, and extension vocabularies can all be based.
995
- - * ` maxContains ` , ` minContains ` * These keywords modify the behavior of
996
- ` contains ` , and are therefore grouped with it in the applicator vocabulary.
997
- - * ` dependencies ` * This keyword had two different modes of behavior, which made
998
- it relatively challenging to implement and reason about. The schema form has
999
- been moved to Core and renamed to ` dependentSchemas ` , as part of the
1000
- applicator vocabulary. It is analogous to ` properties ` , except that instead of
1001
- applying its subschema to the property value, it applies it to the object
1002
- containing the property. The property name array form is retained here and
1003
- renamed to ` dependentRequired ` , as it is an assertion which is a shortcut for
1004
- the conditional use of the ` required ` assertion keyword.
1005
-
1006
886
## [ Appendix] Acknowledgments
1007
887
1008
888
Thanks to Gary Court, Francis Galiegue, Kris Zyp, Geraint Luff, and Henry
0 commit comments