]> Data Transfer Initiative

lisa@rtfm.com

aaa@bzfx.net

henry@henryandrews.net

ART Internet-Draft JSON JSON Schema defines the media type "application/schema+json", a JSON-based format for describing the structure of JSON data. A JSON Schema may assert constraints on a JSON value, ways to extract information from it, and how to interact with it. The "application/schema-instance+json" media type provides additional feature-rich integration with "application/schema+json" beyond what can be offered for "application/json" documents. Discussion Venues The jsonschema WG is where this draft is discussed. Source for this draft can be found at .

Introduction JSON Schemas are documents that describe and constrain JSON values. JSON Schema defines validation, documentation, hyperlink navigation, and interaction control of JSON data. This specification defines JSON Schema core terminology and mechanisms, including pointing to another JSON Schema by reference, dereferencing a JSON Schema reference, specifying the dialect being used, specifying a dialect's vocabulary requirements, and defining the expected output. The status of this document is literally a draft, and it is not ready for implementors to adopt in place of widely implemented versions of JSON Schema. It is a proposed starting point for a WG and a wide consensus process.

Notational Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . For brevity, the converse of logical statements is assumed, except for values described as undefined; that is, "only <X> is accepted" shall imply "<not X> is rejected".

Audiences This specification has three reading audiences: authors of JSON Schemas, implementors of validation or other software, and authors of meta-schemas.

• For schema authors, the chapter on terminology () might be the first read, followed by chapters about core keywords (), subschema applicator keywords () and validation assertion keywords () as these are the keywords most commonly used when authoring schemas. In addition, the formats used with the format keyword are defined in . Other sections up to and including may be interesting depending on the topic of the chapter.
• Implementors will need to understand the requirements in sections 3 through 10 but also the requirements on loading and processing schemas (), keyword behaviors (), and formatted output (). Refer to the appendix on keyword dependency implementation () for additional guidance on approaches to implementing keyword dependencies.
• Authors of meta-schemas including extensions to JSON Schema will want to read the chapter on and .

Functionality A JSON Schema implementation takes input in the form of a JSON-compatible data structure and performs validation and, if the input is accepted as a valid instance, returns a standard annotation output.

Validation In computer science terms, a JSON Schema document (a schema) notates a grammar that describes a language of JSON values. That is, a schema describes a set of JSON values by listing rules to classify an input as within or not within the set. The largest possible set is that of all syntactically valid structured inputs. The smallest set is the empty set. A validator (also known as an acceptor) is a process that tests if a particular input is described by the schema, by evaluating it against the requirements. An accepted input is called an instance of the schema, and a rejected input is called a violation of the schema.

Annotation A JSON Schema may describe additional output to accompany an "accept" result, called annotations. An annotation is a tuple that, at the minimum, relates a particular annotation keyword in the schema to a particular value within the instance. Annotations typically document the meaning of properties, declare relationships between data, or denote hyperlinks. Several forms of output are defined, and the annotation process can be disabled as a performance or resource consumption optimization. A basic annotation exampe can be seen at . Output annotations might only be "as true as" the input, and useful only for select inputs. For example, annotations may only meaningfully describe inputs with a particular "profile" link relation, or in some particular context. In any event, annotations never describe violations (rejected inputs). As noted in , annotation production and output can be highly configurable to support performance trade-offs and/or streaming output.

Internet media types The specification registers the "application/schema+json" media type to identify a JSON Schema resource, and the "application/schema-instance+json" media type to identify an instance of a particular JSON Schema.

Keywords JSON Schema uses keywords to assert constraints on JSON values or provide annotations with additional information. Additional keywords combine other keywords or provide references to sub-schemas, features which allow more complex JSON data structures. In formal language theory, JSON Schema resembles a context-free language, as most keywords are context-free. Thus, JSON instances can be validated quickly and simply, without I/O or querying data elsewhere in the same JSON instance.

Vocabularies To facilitate re-use, keywords can be organized into vocabularies. A vocabulary consists of a list of keywords, together with their syntax and semantics. A dialect is defined as a set of vocabularies and their required support identified in a meta-schema. Vocabularies, dialects and meta-schemas are not required features for most schema authors to understand, but must be understood by authors of meta-schemas and handled by implementors of validation or other JSON Schema processing software. JSON Schema can be extended either by defining additional vocabularies, or less formally by defining additional keywords outside of any vocabulary. Unrecognized individual keywords are handled in accordance with section , while the behavior with respect to an unrecognized vocabulary can be controlled when declaring which vocabularies are in use.

Terminology Terms in this document are consistent with use in other JSON specifications, but may take on additional nuance in the context of JSON Schema. These definitions may provide a useful reference. More comprehensive requirements are later in the document. The terms "JSON", "JSON text", "JSON value", "member", "element", "object", "array", "number", "string", "boolean", "true", "false", and "null" in this document are to be interpreted as defined in . JSON Text A JSON text is an information resource (series of octets) described by the application/json media type, as defined in . JSON Value In addition to 's definition, describes a JSON value as "often constructed by parsing a JSON text" (emphasis added). Unlike a JSON text, a JSON value is not required to be a serialized sequence of octets; it may instead be a parsed, in-memory data structure. This document uses JSON value when referring to such parsed or structured data, reserving JSON text for the serialized form. Input A JSON text or JSON value, supplied to a validator or other implementation, in order to compare it to a schema, is an input until it is known to be in the valid set for that schema. Instance A JSON value that is in the valid set for a given schema is an instance of that schema. Schema A JSON Schema document, or simply a schema, is used to describe and constrain JSON values. Used in validation, the schema defines the valid set, or all possible inputs that validate successfully. A JSON Schema is also a JSON value and may also be an instance of some meta-schema. Schema Resource A JSON Schema resource is a schema uniquely identified by a URI, in contrast to an anonymous schema which has no URI. A schema is canonically identified (in the sense of ) by an absolute URI (). Keyword JSON Schema works by defining keywords with specific behavior. A keyword appears as a JSON name . Not all JSON names in a schema are keywords, but all keywords have required behavior. Broadly speaking, keywords fall into one or more of five categories:

identifiers

control schema identification through setting a URI for the schema and/or changing how the base URI is determined

assertions

produce a boolean result info item indicating input acceptance or rejection; produce errors upon rejection

annotations

attach information intended for application use to an instance via output

applicators

apply one or more subschemas to a particular location in the instance, and produce a boolean result info item that combines or modifies those produced by the subschemas; applicators producing an acceptance result suppress the errors of any subschemas that produced a rejection

reserved locations

do not interact with any results or output, but reserve a place for a specific purpose to ensure interoperability

Keywords which are properties within the same schema object are referred to as adjacent keywords. Extension keywords, meaning those defined outside of this document, are free to define their own behaviors, within the constraints required by this specification. Vocabulary A vocabulary is a set of keywords that are defined to enable some functionality, particularly when JSON Schema is extended with external vocabularies. Meta-Schema A meta-schema describes and constrains schemas which may be instances of the meta-schema. Dialect A dialect is a set of vocabularies used within a given schema resource, together with the syntax constraints described by a meta-schema. The meta-schema's URI also identifies the dialect. Root schema The root schema is the top-level schema object that serves as the starting point and container for all of a schema's rules and annotations. It typically defines the Base URI for the entire document. Subschema A subschema is a schema that happens to be located inside another schema. Structural keywords like 'items' and 'properties' use subschemas to describe structure inside arrays and objects. Aggregation keywords like 'anyOf' and 'not' direct how to apply the subschemas they hold. A subschema can be directly inside its parent schema, can be elsewhere in the Schema Document (using a fragment reference), or in a separate document (using an absolute reference). Implementation An implementation is software that implements this specification. Some implementations validate inputs, but some implementations generate documentation, data or code based on a schema.

Overall Definitions and Requirements This section is the start of normative requirements.

JSON Schema Documents A JSON Schema, with its specific rules or constraints to describe and validate JSON data, is represented in digital form as a JSON schema document. A JSON Schema MUST be an object or a boolean. When a schema is an object, it can be seen to be a schema from the '$schema' keyword in the object. See below for special treatment of the boolean schemas. Schemas are used to validate inputs that may be instances of the schema, but each schema can itself be interpreted as an instance (see for when and how this happens). Schema documents SHOULD always be given the media type "application/schema+json", even when playing the role of an instance.

Trivial schema documents The schema values "true" and "false" are trivial schemas. The valid set for the 'true' schema is all possible syntactically correct inputs, and the valid set for the 'false' schema is empty. The trivial boolean schemas exist to clarify schema author intent and facilitate schema processing optimizations. They behave identically to the following schema objects (where "not" is part of the subschema application vocabulary defined in this document).

true

Always accepts, equivalent to the empty schema {}

false

Always rejects, equivalent to the schema { "not": {} }

While the empty schema object is unambiguous, there are many possible equivalents to the "false" schema. Using the boolean values ensures that the intent is clear to both human readers and implementations.

Root Schema and Subschemas and Resources A JSON Schema resource is a schema which is canonically identified (in the sense of ) by an absolute URI (). Schema resources MAY also be identified by URIs, including URIs with fragments, if the resulting secondary resource (as defined by ) is identical to the primary resource. This can occur with the empty fragment, or when one schema resource is embedded in another. Any such URIs with fragments are considered to be non-canonical. The root schema is always a schema resource, where the URI is determined as described in .Note that documents that embed schemas in another format will not have a root schema resource in this sense. Exactly how such usages fit with the JSON Schema document and resource concepts will be clarified in a future draft. Some keywords take schemas themselves, allowing JSON Schemas to be nested: In this example document, the schema titled "array item" is a subschema, and the schema titled "root" is the root schema. As with the root schema, a subschema is either an object or a boolean. As discussed in , a JSON Schema document can contain multiple JSON Schema resources. When used without qualification, the term "root schema" refers to the document's root schema. In some cases, resource root schemas are discussed. A resource's root schema is its top-level schema object, which would also be a document root schema if the resource were to be extracted to a standalone JSON Schema document. Whether multiple schema resources are embedded or linked with a reference, they are processed in the same way, with the same available behaviors.

Input Any -compliant JSON value or document MAY be used as input. An instance of a schema is an input that is in the valid set of that schema. An input value has one of JSON's six primitive types, and a range of possible values depending on the type:

null

A JSON "null" value

boolean

A JSON "true" or "false" value

object

An unordered set of properties mapping a string to an instance, the JSON "object" value

array

An ordered list of instances, with the JSON "array" value

number

An arbitrary-precision, base-10 decimal number value, from the JSON "number" value

string

A string of Unicode code points, from the JSON "string" value

Whitespace and formatting concerns, including different lexical representations of numbers that are equal within the data model, are outside the scope of JSON Schema. JSON Schema that wish to work with such differences in lexical representations SHOULD define keywords to precisely interpret formatted strings within the data model rather than relying on having the original JSON representation Unicode characters available. Since an object cannot have two properties with the same key, behavior for a document that tries to define two properties with the same key in a single object is undefined. Note that JSON Schema vocabularies are free to define their own extended type system. This should not be confused with the core types defined here. As an example, "integer" is a reasonable type for a vocabulary to define as a value for a keyword, but the data model makes no distinction between integers and other numbers.

Input Equality Two JSON inputs are said to be equal if and only if they are of the same type and have the same value according to the JSON data model. Specifically, this means:

• both are null; or
• both are true; or
• both are false; or
• both are strings, and are the same codepoint-for-codepoint; or
• both are numbers, and have the same mathematical value; or
• both are arrays, and have an equal value item-for-item; or
• both are objects, and each property in one has exactly one property with a key equal to the other's, and that other property has an equal value.

Implied in this definition is that arrays must be the same length, objects must have the same number of members, properties in objects are unordered, there is no way to define multiple properties with the same key, and mere formatting differences (indentation, placement of commas, trailing zeros) are insignificant. Two equal inputs are guaranteed to yield identical validation results for a given schema, regardless of their original formatting.

Keywords To ensure interoperability, all JSON Schema keywords, whether defined in this specification or elsewhere, MUST define their behavior in terms of the categories defined in and described in detail under . A JSON Schema object MAY contain properties which are not recognized as known schema keywords. The behavior of such keywords is governed by . An empty schema is a JSON Schema with no properties, or only unknown properties.

Fragment Identifiers In accordance with section 3.1 of , the syntax and semantics of fragment identifiers specified for any +json media type SHOULD be as specified for "application/json". (At publication of this document, there is no fragment identification syntax defined for "application/json".) Additionally, the "application/schema+json" media type supports two fragment identifier structures: plain names and JSON Pointers. The "application/schema-instance+json" media type supports one fragment identifier structure: JSON Pointers. The use of JSON Pointers as URI fragment identifiers is described in . For "application/schema+json", which supports two fragment identifier syntaxes, fragment identifiers matching the JSON Pointer syntax, including the empty string, MUST be interpreted as JSON Pointer fragment identifiers. Per the W3C's best practices for fragment identifiers (), plain name fragment identifiers in "application/schema+json" are reserved for referencing locally named schemas. All fragment identifiers that do not match the JSON Pointer syntax MUST be interpreted as plain name fragment identifiers. Defining and referencing a plain name fragment identifier within an "application/schema+json" document are specified in the "$anchor" keyword section.

Other General Considerations

Required and recommended vocabularies This document defines a core vocabulary of keywords that MUST be supported by any implementation. Its keywords are each prefixed with a "$" character to emphasize their required nature. This vocabulary is essential to the functioning of the "application/schema+json" media type, and is used to bootstrap the loading of other vocabularies. This document further defines a RECOMMENDED set of additional vocabularies for standard use. These vocabularies together compose the standard JSON Schema dialect, which serves as the default dialect as discussed in .

Requirements for handling extensions Additional schema keywords and schema vocabularies MAY be defined by any entity. Save for explicit agreement, schema authors SHALL NOT expect these additional keywords and vocabularies to be supported by implementations that do not explicitly document such support. Keywords that an implementation does not support are considered to be unrecognized; their behavior is governed by . Implementations MAY provide the ability to register or load handlers for vocabularies that they do not support directly. The exact mechanism for registering and implementing such handlers is implementation-dependent.

Validation and Annotation JSON Schema validation applies the rules of a JSON Schema to determine if an input is in the valid set for that schema. An instance location that satisfies all asserted constraints is then annotated with any keywords that contain non-assertion information, such as descriptive metadata and usage hints. Each schema object is independently evaluated against each input location to which it applies. This greatly simplifies implementation requirements by ensuring that implementations do not need to maintain state across the document-wide validation process. Keywords MUST NOT modify the input during evaluation. Annotations MAY be used to indicate that modification is desired, however the exact mechanism of modification is deferred to applications or other specifications building on JSON Schema. In all validator implementations, equivalent JSON values MUST return the same validation result and annotations. For example, selection between equivalent character escapes, or use of whitespace, does not affect the result. This also means that a validation keyword MUST NOT accept or reject based on third factors (those factors besides the schema and the input itself). A separate "outside verification" scheme that queries external data sources is possible, but outside the scope of this document. This specification defines a set of assertion keywords, as well as a small vocabulary of metadata keywords that can be used to annotate the JSON instance with useful information. The keyword is intended primarily as an annotation, but can optionally be used as an assertion. The keywords are annotations for working with documents embedded as JSON strings. Implementations MAY allow configuring annotations in such ways as limiting output to certain annotation keywords, aggregating values together, or other features to enhance performance. Implementations MAY allow annotation output to be bypassed entirely. Annotations MAY be presented as a single data structure, or as a stream of events, however if the input is rejected during processing, this voids all annotations previously emitted from that input. See for detailed guidance on when previously emitted annotations MUST be discarded.

Vocabulary for Core Keywords Core keywords MUST be implemented by any implementation indicating support for the "application/schema+json" media type. The behavior of a false value for this vocabulary (and only this vocabulary) is undefined, as is the behavior when "$vocabulary" is present but the Core vocabulary is not included. However, it is RECOMMENDED that implementations detect these cases and raise an error when they occur. It is not meaningful to declare that a meta-schema optionally uses Core. The current URI for the Core vocabulary is: <https://json-schema.org/draft/2020-12/vocab/core>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/core. While the "$" prefix is not formally reserved for the Core vocabulary, it is RECOMMENDED that extension keywords (in vocabularies or otherwise) begin with a character other than "$" to avoid possible future collisions.

Environment Environment keywords MUST be read by implementations before other keywords may be evaluated, as they are capable of impacting the behavior of other keywords.

"$schema" The "$schema" keyword is both used as a JSON Schema dialect identifier and as the identifier of a resource which is itself a JSON Schema, which describes the set of valid schemas written for this particular dialect. The value of this keyword MUST be a full URI () and this URI MUST be normalized. The current schema MUST be an instance of the meta-schema identified by this URI. If this URI identifies a retrievable resource, that resource SHOULD be of media type "application/schema+json". The "$schema" keyword SHOULD be used in the document root schema object, and MAY be used in the root schema objects of embedded schema resources. It MUST NOT appear in non-resource root schema objects. If absent from the document root schema, the resulting behavior is implementation-defined, however, using this specification's default dialect () is RECOMMENDED. Values for this property are defined elsewhere in this and other documents, and by other parties.

"$vocabulary" The "$vocabulary" keyword is used in meta-schemas to identify the vocabularies available for use in schemas described by that meta-schema. It is also used to indicate whether each vocabulary is required or optional, in the sense that an implementation MUST understand the required vocabularies in order to successfully process the schema. Together, this information forms a dialect. Any vocabulary that is understood by the implementation MUST be processed in a manner consistent with the semantic definitions contained within the vocabulary. The value of this keyword MUST be an object. The property names in the object MUST be absolute URIs and each URI MUST be normalized. Each URI that appears as a property name identifies a specific set of keywords and their semantics. The URI MAY be a URL, but the nature of the retrievable resource is currently undefined, and reserved for future use. Vocabulary authors MAY use the URL of the vocabulary specification, in a human-readable media type such as text/html or text/plain, as the vocabulary URI.Vocabulary documents may be added in forthcoming drafts. For now, identifying the keyword set is deemed sufficient as that, along with meta-schema validation, is how the current "vocabularies" work today. Any future vocabulary document format will be specified with JSON, so using text/html or other non-JSON formats in the meantime will not produce any future ambiguity. The values of the object properties MUST be booleans. If the value is true, then implementations that do not recognize the vocabulary MUST refuse to process any schemas that declare this meta-schema with "$schema". If the value is false, implementations that do not recognize the vocabulary SHOULD proceed with processing such schemas. The value has no impact if the implementation understands the vocabulary. Keywords defined by unrecognized vocabularies are considered to be unrecognized, with behavior governed by . It is not currently possible to distinguish between unrecognized keywords that are defined in vocabularies from those that are not part of any vocabulary. The "$vocabulary" keyword SHOULD be used in the root schema of any schema resource intended for use as a meta-schema. It MUST NOT appear in subschemas. The "$vocabulary" keyword MUST be ignored in schema resources that are not being processed as a meta-schema. This allows validating a meta-schema M against its own meta-schema M' without requiring the implementation to understand the vocabularies declared by M.

Default vocabularies If "$vocabulary" is absent, an implementation MAY determine behavior based on the meta-schema if it is recognized from the URI value of the referring schema's "$schema" keyword. This is how behavior (such as Hyper-Schema usage) has been recognized prior to the existence of vocabularies. If the meta-schema, as referenced by the schema, is not recognized, or is missing, then the behavior is implementation-defined. If the implementation proceeds with processing the schema, it MUST assume the use of the core vocabulary. If the implementation is built for a specific purpose, then it SHOULD assume the use of all of the most relevant vocabularies for that purpose. For example, an implementation that is a validator SHOULD assume the use of all vocabularies in this specification.

Non-inheritability of vocabularies Note that the processing restrictions on "$vocabulary" mean that meta-schemas that reference other meta-schemas using "$ref" or similar keywords do not automatically inherit the vocabulary declarations of those other meta-schemas. All such declarations must be repeated in the root of each schema document intended for use as a meta-schema. This is demonstrated in the example meta-schema.This requirement allows implementations to find all vocabulary requirement information in a single place for each meta-schema. As schema extensibility means that there are endless potential ways to combine more fine-grained meta-schemas by reference, requiring implementations to anticipate all possibilities and search for vocabularies in referenced meta-schemas would be overly burdensome.

Updates to Meta-Schema and Vocabulary URIs Updated vocabulary and meta-schema URIs MAY be published between specification drafts in order to correct errors. Implementations SHOULD consider URIs dated after this specification draft and before the next to indicate the same syntax and semantics as those listed here.

"$id" The $id keyword identifies a schema resource with its canonical URI (in the sense of ). Explicit identification makes it easier for a schema to be referenced, especially from other schemas, allowing re-use, modularity and extensibility of schemas. An explicit identifier is a more stable way to reference a schema than its location (either its URL on the Web or as a location within the structure of a parent schema). Requirements on $id value:

• MUST be a string
• MUST be a valid URI reference ()
• SHOULD be normalized
• MUST NOT have a fragment ()

The value of an $id may be a full URI or a relative reference (). When a relative URI is used, knowing the base URI becomes important. Read and to understand how that must be done. Note that an URI does not have to be a URL. Even if it is a URL, the URL may not resolve and return a schema, and implementations are warned against automatically resolving network references to fetch schemas (see ). Nevertheless, the URI still identifies the schema. The presence of "$id" in a subschema indicates that the subschema constitutes a distinct schema resource within a single schema document. See also the $anchor keyword () for naming subschemas, and the $ref keyword () in which $id and $anchor values are frequently used.

Identifying the root schema The root schema of a JSON Schema document SHOULD contain an "$id" keyword with an absolute-URI (; containing a scheme, but no fragment).

"$anchor" and "$dynamicAnchor" Using JSON Pointer fragments requires knowledge of the structure of the schema. When writing schema documents with the intention to provide re-usable schemas, it may be preferable to use a plain name fragment that is not tied to any particular structural location. This allows a subschema to be relocated without requiring JSON Pointer references to be updated. The "$anchor" and "$dynamicAnchor" keywords are used to specify such fragments. They are identifier keywords that can only be used to create plain name fragments. The base URI to which the resulting fragment is appended is the canonical URI of the schema resource containing the "$anchor" or "$dynamicAnchor" in question. As discussed in the previous section, this is either the nearest "$id" in the same or parent schema object, or the base URI for the document as determined according to RFC 3986. Separately from the usual usage of URIs, "$dynamicAnchor" indicates that the fragment is an extension point when used with the "$dynamicRef" keyword. This low-level, advanced feature makes it easier to extend recursive schemas such as the meta-schemas, without imposing any particular semantics on that extension. See the section on "$dynamicRef" for details. In most cases, the normal fragment behavior both suffices and is more intuitive. Therefore it is RECOMMENDED that "$anchor" be used to create plain name fragments unless there is a clear need for "$dynamicAnchor". If present, the value of this keyword MUST be a string and MUST start with a letter ([A-Za-z]) or underscore ("_"), followed by any number of letters, digits ([0-9]), hyphens ("-"), underscores ("_"), and periods ("."). This matches the US-ASCII part of XML's NCName production, per .Note that the anchor string does not include the "#" character, as it is not a URI-reference. An "$anchor": "foo" becomes the fragment "#foo" when used in a URI. See below for full examples. The effect of specifying the same fragment name multiple times within the same resource, using any combination of "$anchor" and/or "$dynamicAnchor", is undefined. Implementations MAY raise an error if such usage is detected.

Example In this example, more than one property can hold an address object. The address object is defined under a nested "$defs" so that utility schemas can be gathered under "utils". To ensure references continue working even if this nested "utils" arrangement is changed, the model is given an anchor and the anchor is used to refer to it. The extra layers and names are not needed in a schema this short, but in a much larger schema they could help with maintainability and readability. For an example of $dynamicAnchor see .

Definitions and References

"$ref" and "$dynamicRef" The "$ref" and "$dynamicRef" keywords are applicator keywords used to reference a schema. Their results are the results of the referenced schema.Note that this definition of how the results are determined means that other keywords can appear alongside of "$ref" in the same schema object. As the values of "$ref" and "$dynamicRef" are URI References, this allows the possibility to externalise or divide a schema across multiple files, and provides the ability to validate recursive structures through self-reference. The resolved URI produced by these keywords is not necessarily a network locator, only an identifier. Even if it is a network locator, implementations should refer to about loading such schemas. The value of the "$ref" keyword MUST be a string which is a URI-Reference. Resolved against the current URI base, it produces the URI of the schema to apply. This resolution is safe to perform on schema load, as the process of evaluating an input cannot change how the reference resolves. The "$dynamicRef" keyword is an applicator that allows for deferring the full resolution until runtime, at which point it is resolved each time it is encountered while evaluating an input. Together with "$dynamicAnchor", "$dynamicRef" implements a cooperative extension mechanism that is primarily useful with recursive schemas (schemas that reference themselves). Both the extension point and the runtime-determined extension target are defined with "$dynamicAnchor", and only exhibit runtime dynamic behavior when referenced with "$dynamicRef". The value of the "$dynamicRef" property MUST be a string which is a URI-Reference. Resolved against the current URI base, it produces the URI used as the starting point for runtime resolution. This initial resolution is safe to perform on schema load. If the initially resolved starting point URI includes a fragment that was created by the "$dynamicAnchor" keyword, the initial URI MUST be replaced by the URI (including the fragment) for the outermost schema resource in the dynamic scope that defines an identically named fragment with "$dynamicAnchor". Otherwise, its behavior is identical to "$ref", and no runtime resolution is needed. For an example of $ref, see the example of $anchor above in . For an example of $dynamicRef, see .The difference between the hyper-schema meta-schema in pre-2019 drafts and in this draft dramatically demonstrates the utility of these keywords.

"$defs" The "$defs" keyword reserves a location for schema authors to inline re-usable JSON Schemas into a more general schema. The keyword does not directly affect the validation result. This keyword's value MUST be an object. Each member value of this object MUST be a valid JSON Schema.

Example In this partial schema for an IMAP folder representation in JSON, a reusable definition for 32-bit unsigned integers is factored out and referenced in multiple property definitions.

"$comment" This keyword reserves a location for comments from schema authors to readers or maintainers of the schema. The value of this keyword MUST be a string. Implementations MUST NOT present this string to end users. Tools for editing schemas SHOULD support displaying and editing this keyword. The value of this keyword MAY be used in debug or error output which is intended for developers making use of schemas. Schema vocabularies SHOULD allow "$comment" within any object containing vocabulary keywords. Implementations MAY assume "$comment" is allowed unless the vocabulary specifically forbids it. Vocabularies MUST NOT specify any effect of "$comment" beyond what is described in this specification. Tools that translate other media types or programming languages to and from application/schema+json MAY choose to convert that media type or programming language's native comments to or from "$comment" values. The behavior of such translation when both native comments and "$comment" properties are present is implementation-dependent. Implementations MAY strip "$comment" values at any point during processing. In particular, this allows for shortening schemas when the size of deployed schemas is a concern. Implementations MUST NOT take any other action based on the presence, absence, or contents of "$comment" properties. In particular, the value of "$comment" MUST NOT be produced as an annotation result. For an example using $comment, see above, where a comment explains to schema maintainers where a value limit comes from.

Vocabulary for Subschema Applicators This section defines keywords that are RECOMMENDED for use as the basis of other vocabularies. Meta-schemas that do not use "$vocabulary" SHOULD be considered to require this vocabulary as if its URI were present with a value of true. The current URI for this vocabulary, known as the Applicator vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/applicator>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/applicator.

Keyword Independence Schema keywords typically operate independently, without affecting each other's outcomes. For schema author convenience, there are some exceptions among the keywords in this vocabulary:

• "additionalProperties", whose behavior is defined in terms of "properties" and "patternProperties"
• "items", whose behavior is defined in terms of "prefixItems"
• "contains", whose behavior is affected by the presence and value of "minContains", in the Validation vocabulary

Keywords for Applying Subschemas in Place These keywords apply subschemas to the same location in the input as the parent schema is being applied. They allow combining or modifying the subschema results in various ways. With the exception of the cooperative "if", "then", and "else" keywords, subschemas of these keywords evaluate the input completely independently such that the results of one such subschema MUST NOT impact the results of sibling subschemas. Therefore subschemas may be applied in any order. "if", "then", and "else" MUST NOT interact with each other across subschema boundaries. In other words, an "if" in one branch of an "allOf" MUST NOT have an impact on a "then" or "else" in another branch. There is no default behavior for "if", "then", or "else" when they are not present. In particular, they MUST NOT be treated as if present with an empty schema, and when "if" is not present, both "then" and "else" MUST be entirely ignored.

"allOf" This keyword's value MUST be a non-empty array. Each item of the array MUST be a valid JSON Schema. This keyword accepts only if every subschema in its value accepts the input. The allOf keyword is useful for combining multiple conditionals in a schema. See the example for if below in .

Example Another example of the utility of allOf is multiple inheritance. In this example, a project has all of the properties of a task and a collection.

"anyOf" This keyword's value MUST be a non-empty array. Each item of the array MUST be a valid JSON Schema. This keyword accepts only if at least one schema in its value accepts the input. Note that in general all subschemas MUST be examined to ensure that keyword dependencies from each subschema are discovered, although see for possible short-circuiting conditions. Examples of using anyOf:

• Defining objects that can satisfy one or more schemas, such as attachments that can be a note or a task OR satisfy both schemas.
• Requiring alternate fields in an object, when combined with the "required" keyword: a contact could require a work_email or require a work_phone, and putting both required keywords inside the anyOf keyword allows either to satisfy the schema.

"oneOf" This keyword's value MUST be a non-empty array. Each item of the array MUST be a valid JSON Schema. This keyword accepts only if exactly one schema in its value accepts the input. Similar to anyOf and allOf, oneOf can be used in combination with object definitions to allow only one object definition to be satisfied. Compare to the example for "anyOf": using "oneOf" with an attachment envelope would allow the attachment to satisfy the note or task schema but not both. A task might have a duration or a due date but not both.

"not" This keyword's value MUST be a valid JSON Schema. This keyword accepts the input only if its subschema rejects the input. For example, a product schema could require the property expiration_date if the validity property does NOT have a value equal to forever. Or, if two properties could either be present or both absent but not appear at the same time, this can be expressed in many ways but possibly the briefest is

"if" This keyword's value MUST be a valid JSON Schema. This keyword always accepts the input. However, it affects whether "then" or "else" is evaluated, depending on whether its subschema accepts or rejects the input. As applicable, annotations are produced from its subschema in the usual way (when the subschema accepts), and regardless of whether "then" or "else" is present.

Example This shows how the if keyword can be conditionally restrict a "postal-code" value on the "country" value.

"then" This keyword's value MUST be a valid JSON Schema. When an adjacent "if" is present and its subschema accepts the input, this keyword's result is the result of the "then" subschema evaluating the same input. Otherwise this keyword is ignored. This keyword has no effect when "if" is absent, or when its subschema rejects the input. Implementations MUST NOT evaluate the input against this keyword, for either validation or annotation production purposes, in such cases. See the example above in for a constraint added in a then, conditionally upon the if statement, and below for an example using if/then/else.

"else" This keyword's value MUST be a valid JSON Schema. When an adjacent "if" is present and its subschema rejects the input, this keyword's result is the result of the "else" subschema evaluating the same input. Otherwise this keyword is ignored. This keyword has no effect when "if" is absent, or when the input is accepted by its subschema. Implementations MUST NOT evaluate the input against this keyword, for either validation or annotation production purposes, in such cases.

"dependentSchemas" This keyword specifies subschemas that are evaluated whenever the input is an object and contains a certain property. This keyword's value MUST be an object. Each value in the object MUST be a valid JSON Schema. If the object key is a property in the instance, the entire input must be accepted by the subschema. Its use is dependent on the presence of the property. Omitting this keyword has the same behavior as an empty object.

Example of requiring rejection reason if rejection date is set

Keywords for Applying Subschemas to Arrays Each of these keywords defines a rule for applying its subschema(s) to array items, and combining their results.

"prefixItems" The value of "prefixItems" MUST be a non-empty array of valid JSON Schemas. This keyword accepts an array input only if every subschema accepts the input item at the same array index, if any. This keyword does not constrain the length of the array. If the array is longer than this keyword's value, this keyword only validates items in the input up to the size of the keyword value. Omitting this keyword has the same assertion behavior as an empty array.

"items" The value of "items" MUST be a valid JSON Schema. This keyword accepts the input only if its subschema accepts every item at an index not covered by the adjacent prefixItems (or every item, if prefixItems is absent). Omitting this keyword has the same assertion behavior as the empty schema. Examples of items can be found in other examples in this specification. One of the clearest is in , where the items keyword requires the input to be a list of points objects.

"contains" The value of this keyword MUST be a valid JSON Schema. This keyword accepts an array input only if the number of elements accepted by its subschema is within the inclusive range of the minimum and (if any) maximum number of occurrences. The minimum and maximum numbers of occurrences are provided by the "minContains" and "maxContains" keywords, respectively, within the same schema object as "contains". If "minContains" is absent, the minimum SHALL be 1. If "maxContains" is absent, the maximum SHALL be unbounded. In general, the subschema MUST be applied to every array element even after enough matches to satisfy "minContains" and "maxContains" have been found in order to produce annotations and support keyword dependencies, although see for conditions under which short-circuiting is possible.

Keywords for Applying Subschemas to Objects Each of these keywords defines a rule for applying its subschema(s) to object properties and combining their results.

"properties" The value of "properties" MUST be an object. Each value of this object MUST be a valid JSON Schema. This keyword accepts only if, for every name that appears in both the input and as a name within this keyword's value, the subschema accepts the corresponding input property value. Omitting this keyword has the same assertion behavior as an empty object. In this example, the properties of a simple contact record are defined, with two properties required.

"additionalProperties" The value of "additionalProperties" MUST be a valid JSON Schema. The behavior of this keyword depends on the presence of "properties" and "patternProperties" within the same schema object. Validation with "additionalProperties" applies only to the child values of input names that do not appear in "properties" or match regular expressions in "patternProperties". This keyword accepts only if the keyword's subschema accepts all such properties. Omitting this keyword has the same assertion behavior as an empty schema. One of the most frequent examples of using "additionalProperties" is to give it a value of false to forbid all unspecified properties. See for an example of this. In the example above for , the "phone_numbers" field can have any internal properties with names such as "home", "office" or "cell", but the value for any property inside "phone_numbers" is constrained to the format of a phone number by "additionalProperties".

"patternProperties" The value of "patternProperties" MUST be an object. Each property name of this object SHOULD be a valid regular expression, according to the ECMA-262 regular expression dialect. Each property value of this object MUST be a valid JSON Schema. This keyword accepts only if, for each input name that matches any of those regular expressions, the corresponding property value is accepted by each matching subschema. Recall: Regular expressions are not implicitly anchored. Omitting this keyword has the same assertion behavior as an empty object. In this example, an alternative to the schema example in , phone numbers are instead represented as top-level fields ending in "_phone". A field like "office_phone" is constrained to the format given.

"propertyNames" The value of "propertyNames" MUST be a valid JSON Schema. If the input is an object, this keyword accepts only if every property name in the input is accepted by the keyword's subschema. Note the property name that the schema is testing will always be a string. Omitting this keyword has the same behavior as an empty schema. In this example, the "participants" field can have zero or one of each of the roles for an incident response process, but no undefined roles.

Vocabulary for Unevaluated Locations The purpose of these keywords is to enable schema authors to apply subschemas to array items or object properties that have not been successfully evaluated within the current schema evaluation or any of its relevant and valid sub-evaluations (see ). Meta-schemas that do not use "$vocabulary" SHOULD be considered to require this vocabulary as if its URI were present with a value of true. The current URI for this vocabulary, known as the Unevaluated Applicator vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/unevaluated>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/unevaluated.

Keyword Independence Schema keywords typically operate independently, without affecting each other's outcomes. However, the keywords in this vocabulary are notable exceptions:

• "unevaluatedItems", whose behavior depends on "prefixItems", "items", "contains", and itself
• "unevaluatedProperties", whose behavior depends on "properties", "patternProperties", "additionalProperties" and itself

"unevaluatedItems" The value of "unevaluatedItems" MUST be a valid JSON Schema. The "unevaluatedItems" subschema MUST be applied only to those items that were not evaluated by "prefixItems", "items", or "contains" in the current schema evaluation or a successful sub-evaluation, or by "unevaluatedItems" in a successful sub-evaluation. This means that "prefixItems", "items", "contains", and all in-place applicators MUST be evaluated before this keyword can be evaluated. Authors of extension keywords MUST NOT define an in-place applicator that would need to be evaluated after this keyword. Omitting this keyword has the same assertion behavior as an empty schema. The unevaluatedItems keyword can be very similar to the items keyword in some examples, like the example in where prefixItems is used to define exactly three items in a list and further items are forbidden, and in that example unevaluatedItems could replace items. Here's an example where unevaluatedItems is doing work that could not be done by items, constraining a list to be only numbers (and the first two numbers must be geospatial points). An input with seven numbers in a list might validate, but an input with a string would fail on unevaluatedItems because the string was not evaluated by the items definition.

"unevaluatedProperties" The value of "unevaluatedProperties" MUST be a valid JSON Schema. The "unevaluatedProperties" subschema MUST be applied only to those properties that were not evaluated by "properties", "patternProperties", or "additionalProperties" in the current schema evaluation or a successful sub-evaluation, or by "unevaluatedProperties" in a successful sub-evaluation. This means that "properties", "patternProperties", "additionalProperties", and all in-place applicators MUST be evaluated before this keyword can be evaluated. Authors of extension keywords MUST NOT define an in-place applicator that would need to be evaluated after this keyword. Omitting this keyword has the same assertion behavior as an empty schema. As an example of using unevaluatedProperties, imagine a schema similar to the one in but instead of a list, the geospatial data is an object such as The additional values could all be constrained to numbers using

Vocabulary for Validation Assertions Validation keywords in a schema impose requirements for successful validation of an input. These keywords are all assertions without any annotation behavior. Meta-schemas that do not use "$vocabulary" SHOULD be considered to require this vocabulary as if its URI were present with a value of true. The current URI for this vocabulary, known as the Validation vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/validation>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/validation.

Validation Keywords for Any Instance Type

"type" The value of this keyword MUST be either a string or an array. If it is an array, elements of the array MUST be strings and MUST be unique. String values MUST be one of the six primitive types ("null", "boolean", "object", "array", "number", or "string"), or "integer" which matches any number with a zero fractional part. If the value of "type" is a string, this keyword accepts exactly when its type matches the type represented by the value of the string. If the value of "type" is an array, this keyword accepts exactly when its type matches any of the types indicated by the strings in the array.

"enum" The value of this keyword MUST be an array. This array SHOULD have at least one element. Elements in the array SHOULD be unique. This keyword accepts exactly when the input is equal to one of the elements in this keyword's array value. Elements in the array might be of any type, including null.

"const" The value of this keyword MAY be of any type, including null. Use of this keyword is functionally equivalent to an enum () with a single value. This keyword accepts exactly when the input is equal to the value of the keyword.

Validation Keywords for Numeric Inputs (number and integer)

"multipleOf" The value of "multipleOf" MUST be a number, strictly greater than 0. With a numeric input value, this keyword accepts the input only if division by this keyword's value yields an integer. This product is only sold in six-packs, so "quantity" must be a multiple of 6; an order that does not specify "quantity" defaults to a single pack.

"maximum" The value of "maximum" MUST be a number, representing an inclusive upper limit for a numeric input value. If the input value is a number, then this keyword only accepts inputs less than or exactly equal to "maximum". See the example for which includes the "maximum" keyword as well.

"exclusiveMaximum" The value of "exclusiveMaximum" MUST be a number, representing an exclusive upper limit for a numeric input value. If the input value is a number, then this keyword only accepts inputs strictly less than (not equal to) "exclusiveMaximum".

"minimum" The value of "minimum" MUST be a number, representing an inclusive lower limit for a numeric input value. If the input value is a number, then then this keyword only accepts inputs greater than or exactly equal to "minimum".

"exclusiveMinimum" The value of "exclusiveMinimum" MUST be a number, representing an exclusive lower limit for a numeric input value. If the input value is a number, then this keyword only accepts inputs strictly greater than (not equal to) "exclusiveMinimum". A discount of 0% is not a discount at all, so it is excluded by "exclusiveMinimum", while a discount of 100% is a valid (if extreme) value, so it is included by "maximum".

Validation Keywords for Strings

"maxLength" The value of this keyword MUST be a non-negative integer. This keyword accepts a string input value only if its length is less than, or equal to, the value of this keyword. The length of a string input value is defined as the number of its characters as defined by .

"minLength" The value of this keyword MUST be a non-negative integer. This keyword accepts a string input value only if its length is greater than, or equal to, the value of this keyword. The length of a string input value is defined as the number of its characters as defined by . Omitting this keyword has the same behavior as a value of 0.

"pattern" The value of this keyword MUST be a string. This string SHOULD be a valid regular expression, according to the ECMA-262 regular expression dialect. This keyword accepts a string input value only if the regular expression matches the value. Recall: regular expressions are not implicitly anchored. An example including "pattern" can be found in .

Validation Keywords for Arrays

"maxItems" The value of this keyword MUST be a non-negative integer. This keyword accepts an array input value only if its size is less than, or equal to, the value of this keyword.

"minItems" The value of this keyword MUST be a non-negative integer. This keyword accepts an array input value only if its size is greater than, or equal to, the value of this keyword. Omitting this keyword has the same behavior as a value of 0.

"uniqueItems" The value of this keyword MUST be a boolean. If this keyword has boolean value false, this keyword is ignored (vacuously accepts). If it has boolean value true, this keyword accepts only array inputs where no two elements are equal (). Omitting this keyword has the same behavior as a value of false. In this example, an object may have at most five labels ("maxItems"), and the same label cannot be applied twice ("uniqueItems").

"maxContains" The value of this keyword MUST be a non-negative integer. This keyword SHALL be ignored by itself (it implicitly succeeds); its validation effect is to modify the behavior of "contains" by setting the maximum number of array elements permitted to match the "contains" schema. As an example of maxContains and how it modifies contains, the example in constrains the assignees list to contain maximum one assignee of type 'owner', though other types of assignees are unlimited.

"minContains" The value of this keyword MUST be a non-negative integer. This keyword SHALL be ignored by itself (it implicitly succeeds); its validation effect is to modify the behavior of "contains" by modifying the minimum number of array elements required to match the "contains" schema. Omitting this keyword has the same behavior as a value of 1. The example for contains and maxContains could easily be imagined to use minContains instead. An exercise for the reader is to extend the example in to require the assignees list to have exactly one owner AND at least one reviewer (hint: using allOf is one solution).

Validation Keywords for Objects

"maxProperties" The value of this keyword MUST be a non-negative integer. This keyword accepts an object input only if its number of properties is less than, or equal to, the value of this keyword. In this example, a contact record must have exactly one primary contact method. The value of "minProperties" rules out giving none, and "maxProperties" rules out giving more than one.

"minProperties" The value of this keyword MUST be a non-negative integer. This keyword accepts an object input only if its number of properties is greater than, or equal to, the value of this keyword. Omitting this keyword has the same behavior as a value of 0.

"required" The value of this keyword MUST be an array. Elements of this array, if any, MUST be strings, and MUST be unique. This keyword accepts an object input only if every item in the array is the name of a property in the object. Omitting this keyword has the same behavior as an empty array.

"dependentRequired" The value of this keyword MUST be an object. Properties in this object, if any, MUST be arrays. Elements in each array, if any, MUST be strings, and MUST be unique. This keyword specifies properties that are required if a specific other property is present. Their requirement is dependent on the presence of the other property. This keyword accepts if, for each name that appears in both the input object and as a name within this keyword's value, every item in the corresponding array is also the name of a property in the input object. Omitting this keyword has the same behavior as an empty object. In this example, a meeting invitation can have neither "startTime" nor "endTime", but it cannot give an "endTime" without also giving a "startTime".

Vocabulary for Semantic Content With "format"

Foreword Structural validation alone may be insufficient to allow an application to correctly utilize certain values. The "format" annotation keyword is defined to allow schema authors to convey semantic information for a fixed subset of values which are accurately described by authoritative resources, be they RFCs or other external specifications. The value of this keyword is called a format attribute. It MUST be a string. A format attribute can generally only validate a given set of input types. If the type of the input is not in this set, validation for this format attribute and input SHOULD succeed. All format attributes defined in this section apply to strings, but a format attribute can be specified to apply to any input type in the input data model.Note that the "type" keyword in this specification defines an "integer" type which is not part of the data model. Therefore a format attribute can be limited to numbers, but not specifically to integers. However, a numeric format can be used alongside the "type" keyword with a value of "integer", or could be explicitly defined to always pass if the number is not an integer, which produces essentially the same behavior as only applying to integers. The current URI for this vocabulary, known as the Format-Annotation vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/format-annotation>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/format-annotation. Implementing support for this vocabulary is REQUIRED. In addition to the Format-Annotation vocabulary, a secondary vocabulary is available for custom meta-schemas that defines "format" as an assertion. The URI for the Format-Assertion vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/format-assertion>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/format-assertion. Implementing support for the Format-Assertion vocabulary is OPTIONAL. Specifying both the Format-Annotation and the Format-Assertion vocabularies is functionally equivalent to specifying only the Format-Assertion vocabulary since its requirements are a superset of the Format-Annotation vocabulary.

Implementation Requirements The "format" keyword functions as defined by the vocabulary which is referenced.

Format-Annotation Vocabulary The value of format MUST be produced as an annotation, if the implementation supports annotation production. This enables application-level validation when schema validation is unavailable or inadequate. Implementations MAY still treat "format" as an assertion in addition to an annotation and attempt to validate the value's conformance to the specified semantics. The implementation MUST provide options to enable and disable such evaluation and MUST be disabled by default. Implementations SHOULD document their level of support for such validation.Specifying the Format-Annotation vocabulary and enabling validation in an implementation should not be viewed as being equivalent to specifying the Format-Assertion vocabulary since implementations are not required to provide full validation support when the Format-Assertion vocabulary is not specified. When the implementation is configured for assertion behavior, it:

• SHOULD provide an implementation-specific best effort validation for each format attribute defined below;
• MAY choose to implement validation of any or all format attributes as a no-op by always producing a validation result of true;

This matches the current reality of implementations, which provide widely varying levels of validation, including no validation at all, for some or all format attributes. It is also designed to encourage relying only on the annotation behavior and performing semantic validation in the application, which is the recommended best practice.

Format-Assertion Vocabulary When the Format-Assertion vocabulary is declared with a value of true, implementations MUST provide full validation support for all of the formats defined by this specification. Implementations that cannot provide full validation support MUST refuse to process the schema. An implementation that supports the Format-Assertion vocabulary:

• MUST still produce "format" as an annotation if the implementation supports annotation production;
• MUST evaluate "format" as an assertion;
• MUST implement syntactic validation for all format attributes defined in this specification, and for any additional format attributes that it recognizes, such that there exist possible input values of the correct type that will fail validation.

The requirement for minimal validation of format attributes is intentionally vague and permissive, due to the complexity involved in many of the attributes. Note in particular that the requirement is limited to syntactic checking; it is not to be expected that an implementation would send an email, attempt to connect to a URL, or otherwise check the existence of an entity identified by a format instance.The expectation is that for simple formats such as date-time, syntactic validation will be thorough. For a complex format such as email addresses, which are the amalgamation of various standards and numerous adjustments over time, with obscure and/or obsolete rules that may or may not be restricted by other applications making use of the value, a minimal validation is sufficient. For example, an input string that does not contain an "@" is clearly not a valid email address, and an "email" or "hostname" containing characters outside of 7-bit ASCII is likewise clearly invalid. It is RECOMMENDED that implementations use a common parsing library for each format, or a well-known regular expression. Implementations SHOULD clearly document how and to what degree each format attribute is validated. The standard core and validation meta-schema includes this vocabulary in its "$vocabulary" keyword with a value of false, since by default implementations are not required to support this keyword as an assertion. Supporting the format vocabulary with a value of true is understood to greatly increase code size and in some cases execution time, and will not be appropriate for all implementations.

Custom format attributes Implementations MAY support custom format attributes. Save for agreement between parties, schema authors SHALL NOT expect a peer implementation to support such custom format attributes. An implementation MUST NOT fail to produce unknown formats as annotations. When the Format-Assertion vocabulary is specified, implementations MUST fail upon encountering unknown formats. Vocabularies do not support specifically declaring different value sets for keywords. Due to this limitation, and the historically uneven implementation of this keyword, it is RECOMMENDED to define additional keywords in a custom vocabulary rather than additional format attributes if interoperability is desired.

Defined Formats

Dates, Times, and Duration These attributes apply to string inputs. Date and time format names are derived from . The duration format is from the ISO 8601 ABNF as given in Appendix A of RFC 3339. Implementations supporting formats SHOULD implement support for the following attributes:

"date-time" A string input is accepted by this attribute if it is a valid representation according to the "date-time" ABNF rule (referenced above).

"date" A string input is accepted by this attribute if it is a valid representation according to the "full-date" ABNF rule (referenced above).

"time" A string input is accepted by this attribute if it is a valid representation according to the "full-time" ABNF rule (referenced above).

"duration" A string input is accepted by this attribute if it is a valid representation according to the "duration" ABNF rule (referenced above).

Additional RFC3339 Formats Implementations MAY support additional attributes using the other format names defined anywhere in that RFC. If "full-date" or "full-time" are implemented, the corresponding short form ("date" or "time" respectively) MUST be implemented, and MUST behave identically. Implementations SHOULD NOT define extension attributes with any name matching an RFC 3339 format unless it validates according to the rules of that format.There is not currently consensus on the need for supporting all RFC 3339 formats, so this approach of reserving the namespace will encourage experimentation without committing to the entire set. Either the format implementation requirements will become more flexible in general, or these will likely either be promoted to fully specified attributes or dropped.

Email Addresses These attributes apply to string inputs. A string input is accepted by these attributes if it is a valid Internet email address as follows:

"email" As defined by the "Mailbox" ABNF rule in .

"idn-email" As defined by the extended "Mailbox" ABNF rule in . Note that all strings accepted by the "email" attribute are also accepted by the "idn-email" attribute.

Hostnames These attributes apply to string inputs. A string input is accepted by these attributes if it is a valid representation for an Internet hostname as follows:

"hostname" As defined by , including host names produced using the Punycode algorithm specified in .

"idn-hostname" As defined by either RFC 1123 as for hostname, or an internationalized hostname as defined by . Note that all strings accepted by the "hostname" attribute are also accepted by the "idn-hostname" attribute.

IP Addresses These attributes apply to string inputs. A string input is accepted by these attributes if it is a valid representation of an IP address as follows:

"ipv4" An IPv4 address according to the "dotted-quad" ABNF syntax as defined in .

"ipv6" An IPv6 address as defined in .

Resource Identifiers These attributes apply to string inputs.

"uri" A string input is accepted by this attribute if it is a valid URI, according to .

"uri-reference" A string input is accepted by this attribute if it is a valid URI Reference (either a URI or a relative-reference), according to .

"iri" A string input is accepted by this attribute if it is a valid IRI, according to .

"iri-reference" A string input is accepted by this attribute if it is a valid IRI Reference (either an IRI or a relative-reference), according to .

"uuid" A string input is accepted by this attribute if it is a valid string representation of a UUID, according to . Note that all valid URIs are valid IRIs, and all valid URI References are also valid IRI References. Note also that the "uuid" format is for plain UUIDs, not UUIDs in URNs. An example is "f81d4fae-7dec-11d0-a765-00a0c91e6bf6". For UUIDs as URNs, use the "uri" format, with a "pattern" regular expression of "^urn:uuid:" to indicate the URI scheme and URN namespace.

Templates

"uri-template" This attribute applies to string inputs. A string input is accepted by this attribute if it is a valid URI Template (of any level), according to . Note that URI Templates may be used for IRIs; there is no separate IRI Template specification.

JSON Pointers These attributes apply to string inputs. To allow for both regular and relative JSON Pointers, use "anyOf" or "oneOf" to indicate support for either format.

"json-pointer" A string input is accepted by this attribute if it is a valid JSON string representation of a JSON Pointer, according to .

"relative-json-pointer" A string input is accepted by this attribute if it is a valid .

Expressions

"regex" This attribute applies to string inputs. A regular expression, which SHOULD be valid according to the regular expression dialect. Implementations that validate formats MUST accept at least the subset of ECMA-262 defined in Regular Expressions section of this specification, and SHOULD accept all valid ECMA-262 expressions.

Vocabulary for the Contents of String-Encoded Data

Foreword Annotations defined in this section indicate that an instance contains non-JSON data encoded in a JSON string. These properties provide additional information required to interpret JSON data as rich multimedia documents. They describe the type of content, how it is encoded, and/or how it may be validated. They do not function as validation assertions; a malformed string-encoded document MUST NOT cause the containing instance to be considered invalid. Meta-schemas that do not use "$vocabulary" SHOULD be considered to require this vocabulary as if its URI were present with a value of true. The current URI for this vocabulary, known as the Content vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/content>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/content.

Implementation Requirements Due to security and performance concerns, as well as the open-ended nature of possible content types, implementations MUST NOT automatically decode, parse, and/or validate the string contents by default. This additionally supports the use case of embedded documents intended for processing by a different consumer than that which processed the containing document. All keywords in this section apply only to strings, and have no effect on other data types. Implementations MAY offer the ability to decode, parse, and/or validate the string contents automatically. However, it MUST NOT perform these operations by default, and MUST provide the validation result of each string-encoded document separately from the enclosing document. This process SHOULD be equivalent to fully evaluating the input against the original schema, followed by using the annotations to decode, parse, and/or validate each string-encoded document.For now, the exact mechanism of performing and returning parsed data and/or validation results from such an automatic decoding, parsing, and validating feature is left unspecified. Should such a feature prove popular, it may be specified more thoroughly in a future draft. See also the Security Considerations sections for possible vulnerabilities introduced by automatically processing inputs according to these keywords.

"contentEncoding" If the input value is a string, this property defines that the string SHOULD be interpreted as encoded binary data and decoded using the encoding named by this property. Possible values indicating base 16, 32, and 64 encodings with several variations are listed in . Additionally, sections 6.7 and 6.8 of provide encodings used in MIME. This keyword is derived from MIME's Content-Transfer-Encoding header, which was designed to map binary data into ASCII characters. It is not related to HTTP's Content-Encoding header, which is used to encode (e.g. compress or encrypt) the content of HTTP request and responses. As "base64" is defined in both RFCs, the definition from RFC 4648 SHOULD be assumed unless the string is specifically intended for use in a MIME context. Note that all of these encodings result in strings consisting only of 7-bit ASCII characters. Therefore, this keyword has no meaning for strings containing characters outside of that range. If this keyword is absent, but "contentMediaType" is present, this indicates that the encoding is the identity encoding, meaning that no transformation was needed in order to represent the content in a UTF-8 string. The value of this property MUST be a string.

"contentMediaType" If the input value is a string, this property indicates the media type of the contents of the string. If "contentEncoding" is present, this property describes the decoded string. The value of this property MUST be a string, which MUST be a media type, as defined by .

"contentSchema" If the input value is a string, and if "contentMediaType" is present, this property contains a schema which describes the structure of the string. This keyword MAY be used with any media type that can be mapped into JSON Schema's data model. The value of this property MUST be a valid JSON schema. It SHOULD be ignored if "contentMediaType" is not present.

Example Here is an example schema, illustrating the use of "contentEncoding" and "contentMediaType": Instances described by this schema are expected to be strings, and their values should be interpretable as base64-encoded PNG images. Another example: Instances described by this schema are expected to be strings containing HTML, using whatever character set the JSON string was decoded into. Per , outside of an entirely closed system, this MUST be UTF-8. This example describes a JWT that is MACed using the HMAC SHA-256 algorithm, and requires the "iss" and "exp" fields in its claim set. Note that "contentEncoding" does not appear. While the "application/jwt" media type makes use of base64url encoding, that is defined by the media type, which determines how the JWT string is decoded into a list of two JSON data structures: first the header, and then the payload. Since the JWT media type ensures that the JWT can be represented in a JSON string, there is no need for further encoding or decoding.

Vocabulary for Basic Meta-Data Annotations These general-purpose annotation keywords provide commonly used information for documentation and user interface display purposes. They are not intended to form a comprehensive set of features. Rather, additional vocabularies can be defined for more complex annotation-based applications. Meta-schemas that do not use "$vocabulary" SHOULD be considered to require this vocabulary as if its URI were present with a value of true. The current URI for this vocabulary, known as the Meta-Data vocabulary, is: <https://json-schema.org/draft/2020-12/vocab/meta-data>. The current URI for the corresponding meta-schema is: https://json-schema.org/draft/2020-12/meta/meta-data.

"title" and "description" The value of both of these keywords MUST be a string. Both of these keywords can be used to decorate a user interface with information about the data produced by this user interface. A title will preferably be short, whereas a description will provide explanation about the purpose of the instance described by this schema.

"title" and "description" example Consider the following schema, which has one "title" and two "description" keywords, one in a referenced schema and one beside the reference: Given the instance: While the exact structure depends on the selected output format (), the following information would be included (recall that the root JSON Pointer is an empty string): Annotation information

keyword	input pointer	evaluation path	annotation value
"title"	""	""	"Change Record"
"description"	"/editor"	"/properties/editor"	"The user who made the change."
"description"	"/editor"	"/properties/editor/$ref"	"A username identifying an account."

There is one "title" applied to the instance root from the evaluation root. There are two "descriptions", and given the presence or absence of "$ref" in the evaluation path, we can tell that "A username identifying an account." comes from a re-usable schema, while "The user who made the change." comes from the schema where that re-usable schema is used. The consuming application is expected to use this information to decide whether or how to use each annotation, based on its knowledge of the schema's design conventions. This specification does not define semantics for the different evaluation paths. Note that "$comment" () does not appear in the output table as it is not an annotation; this is the main distinction between "$comment" and "description".

"default" There are no restrictions placed on the value of this keyword. This keyword can be used to supply a default JSON value associated with a particular schema. It is RECOMMENDED that a default value be an instance of the associated schema. Because annotations can only appear in output if they are attached to a location that exists, this keyword's annotation behavior is only useful for use cases such as determining whether the value provided matches the default. This keyword is most commonly used by applications outside of the scope of this specification, such as generating documentation or web forms from schemas. For an example of "default", see the "quantity" property in the "multipleOf" example above in .

"deprecated" The value of this keyword MUST be a boolean. When multiple occurrences of this keyword are applicable to a single sub-instance, applications SHOULD consider the instance location to be deprecated if any occurrence specifies a true value. If "deprecated" has a value of boolean true, it indicates that applications SHOULD refrain from usage of the declared property. It MAY mean the property is going to be removed in the future. A root schema containing "deprecated" with a value of true indicates that the entire resource being described MAY be removed in the future. The "deprecated" keyword applies to each instance location to which the schema object containing the keyword successfully applies. This can result in scenarios where every array item or object property is deprecated even though the containing array or object is not. Omitting this keyword has the same behavior as a value of false.

"readOnly" and "writeOnly" The value of these keywords MUST be a boolean. When multiple occurrences of these keywords are applicable to a single sub-instance, the resulting behavior SHOULD be as for a true value if any occurrence specifies a true value, and SHOULD be as for a false value otherwise. If "readOnly" has a value of boolean true, it indicates that the value of the instance is managed exclusively by the owning authority, and attempts by an application to modify the value of this property are expected to be ignored or rejected by that owning authority. An instance document that is marked as "readOnly" for the entire document MAY be ignored if sent to the owning authority, or MAY result in an error, at the authority's discretion. If "writeOnly" has a value of boolean true, it indicates that the value is never present when the instance is retrieved from the owning authority. It can be present when sent to the owning authority to update or create the document (or the resource it represents), but it will not be included in any updated or newly created version of the instance. An instance document that is marked as "writeOnly" for the entire document MAY be returned as a blank document of some sort, or MAY produce an error upon retrieval, or have the retrieval request ignored, at the authority's discretion. For example, "readOnly" would be used to mark a database-generated serial number as read-only, while "writeOnly" would be used to mark a password input field. These keywords can be used to assist in user interface instance generation. In particular, an application MAY choose to use a widget that hides input values as they are typed for write-only fields. Omitting these keywords has the same behavior as values of false.

"readOnly" and "writeOnly" example In the following example of a read/write API accepting and producing JSON representations of resources, "username" is a field meant for display and cannot be changed, while "password" cannot be retrieved for display but can be set to a new value. When the above schema evaluates the following input: two annotation output units would be produced: These annotations are used for context-dependent validation, which is performed by the application that invoked schema evaluation. The API's behavior when sent a readonly field in a write request or a write-only field in a read request is out of scope of this document. This illustrates how the API server can use the schema to trigger whatever that behavior is, rather than hard-code read-only and write-only flags or find a custom data-oriented solution.

"examples" The value of this keyword MUST be an array. There are no restrictions placed on the values within the array. This keyword can be used to provide sample JSON values associated with a particular schema, for the purpose of illustrating usage. It is RECOMMENDED that these values be instances of the associated schema. Because annotations can only appear in output if they are attached to a location that exists, this keyword's annotation behavior is only useful for use cases such as determining whether the value provided matches one of the examples. This keyword is most commonly used by applications outside of the scope of this specification, such as generating documentation or web forms from schemas.

Loading and Processing Schemas

Loading a Schema

Initial Base URI defines how to determine the default base URI of a document. Informatively, the initial base URI of a schema is the URI at which it was found, whether that was a network location, a local filesystem, or any other situation identifiable by a URI of any known scheme. If a schema document defines no explicit base URI with "$id" (embedded in content), the base URI is that determined per . If no source is known, or no URI scheme is known for the source, a suitable implementation-specific default URI MAY be used as described in . It is RECOMMENDED that implementations document any default base URI that they assume. If a schema object is embedded in a document of another media type, then the initial base URI is determined according to the rules of that media type. Unless the "$id" keyword described in an earlier section is present in the root schema, this base URI SHOULD be considered the canonical URI of the schema document's root schema resource.

Loading a referenced schema Although it's impossible to cover all use cases, we start by assuming that an implementation given a schema with references to other schemas not in the same document can be given instructions about those other documents, and the implementation therefore SHOULD NOT automatically dereference network locations or search the network for schemas not already loaded in. What should implementations do when the referenced schema is not known? The implementation could have error messages, flags or UX to explicitly get instructions to fetch a schema or to signal that it should be configured differently. The examples from HTTP of same-origin policies would seem relevant here too, but such a feature has not yet been defined for JSON Schema. Some use cases may involve schema definitions that regularly are extended or updated by reference. For example, a service hosting an evolving API might include documentation and requirements via JSON schemas, and the schemas might be intended for dynamic fetching and inclusion of sub-schemas, so placing an absolute requirement of pre-loading schema documents is not feasible. When schemas are downloaded, for example by a generic user-agent that does not know until runtime which schemas to download, see Usage for Hypermedia. Implementations SHOULD be able to associate arbitrary URIs with an arbitrary schema and/or automatically associate a schema's "$id"-given URI, depending on the trust that the implementation has in the schema. Such URIs and schemas can be supplied to an implementation prior to processing instances, or may be noted within a schema document as it is processed, producing associations as shown in . A schema MAY (and likely will) have multiple URIs, but there is no way for a URI to identify more than one schema. When multiple schemas try to identify as the same URI, an implementation SHOULD raise an error condition.

Detecting a Meta-Schema Implementations MUST recognize a schema as a meta-schema if it is being examined because it was identified as such by another schema's "$schema" keyword. This means that a single schema document might sometimes be considered a regular schema, and other times be considered a meta-schema. In the case of examining a schema which is its own meta-schema, when an implementation begins processing it as a regular schema, it is processed under those rules. However, when loaded a second time as a result of checking its own "$schema" value, it is treated as a meta-schema. So the same document is processed both ways in the course of one session. Implementations MAY allow a schema to be explicitly passed as a meta-schema, for implementation-specific purposes, such as pre-loading a commonly used meta-schema and checking its vocabulary support requirements up front. Meta-schema authors MUST NOT expect such features to be interoperable across implementations.

Dereferencing Schemas can be identified by any URI that has been given to them, including a JSON Pointer or their URI given directly by "$id". In all cases, dereferencing a "$ref" reference involves first resolving its value as a URI reference against the current base URI per . If the resulting URI identifies a schema within the current document, or within another schema document that has been made available to the implementation, then that schema SHOULD be used automatically. For example, consider this schema: In this example, when an implementation encounters the <#/$defs/single> schema, it resolves the "$anchor" value as a fragment name against the current base URI to form <https://example.net/root.json#item>. When an implementation then looks inside the <#/items> schema, it encounters the <#item> reference, and resolves this to <https://example.net/root.json#item>, which it has seen defined in this same document and can therefore use automatically. When an implementation encounters the reference to "other.json", it resolves this to <https://example.net/other.json>, which is not defined in this document. If a schema with that identifier has otherwise been supplied to the implementation, it can also be used automatically.

Relative References Many hypermedia contexts (like HTML) make use of full URIs, anchors/names, and relative references (). In JSON Schema, different contexts and use cases may make any of these three approaches the most convenient and least brittle; but relative references do require the most care in implementations. A fully conformant implementation MUST handle relative references, with the following guidance hopefully keeping implementation logic and overhead to a reasonable level. A schema's $id acts as a base URI (see ) for relative references within the schema. In accordance with regarding encapsulating entities, if an "$id" in a subschema is a relative reference, the base URI for resolving that reference is the URI of the parent schema resource. If no parent schema object explicitly identifies itself as a resource with "$id", the base URI is that of the entire document, as established by the steps given in .

JSON Pointer fragments and embedded schema resources JSON Pointer URI fragments are constructed based on the structure of the schema document, allowing an embedded schema resource and its subschemas to be identified by JSON Pointer fragments relative to either its own canonical URI, or relative to any containing resource's URI. Conceptually, a set of linked schema resources should behave identically whether each resource is a separate document connected with schema references, or is structured as a single document with one or more schema resources embedded as subschemas. Since URIs involving JSON Pointer fragments relative to the parent schema resource's URI cease to be valid when the embedded schema is moved to a separate document and referenced, applications and schemas SHOULD NOT use such URIs to identify embedded schema resources or locations within them. Consider the following schema document that contains another schema resource embedded within it: The URI "https://example.com/foo#/items" points to the "items" schema, which is an embedded resource. The canonical URI of that schema resource, however, is "https://example.com/bar". For the "additionalProperties" schema within that embedded resource, the URI "https://example.com/foo#/items/additionalProperties" points to the correct object, but that object's URI relative to its resource's canonical URI is "https://example.com/bar#/additionalProperties". Now consider the following two schema resources linked by reference using a URI value for "$ref": Here we see that "https://example.com/bar#/additionalProperties", using a JSON Pointer fragment appended to the canonical URI of the "bar" schema resource, is still valid, while "https://example.com/foo#/items/additionalProperties", which relied on a JSON Pointer fragment appended to the canonical URI of the "foo" schema resource, no longer resolves to anything. Note also that "https://example.com/foo#/items" is valid in both arrangements, but resolves to a different value. This URI ends up functioning similarly to a retrieval URI for a resource. While this URI is valid, it is more robust to use the "$id" of the embedded or referenced resource unless it is specifically desired to identify the object containing the "$ref" in the second (non-embedded) arrangement. An implementation MAY choose not to support addressing schema resource contents by URIs using a base other than the resource's canonical URI, plus a JSON Pointer fragment relative to that base. Therefore, schema authors SHOULD NOT rely on such URIs, as using them may reduce interoperability.This is to avoid requiring implementations to keep track of a whole stack of possible base URIs and JSON Pointer fragments for each, given that all but one will be fragile if the schema resources are reorganized. Some have argued that this is easy so there is no point in forbidding it, while others have argued that it complicates schema identification and should be forbidden. Feedback on this topic is encouraged. After some discussion, we feel that we need to remove the use of "canonical" in favour of talking about JSON Pointers which reference across schema resource boundaries as undefined or even forbidden behavior (https://github.com/json-schema-org/json-schema-spec/issues/937, https://github.com/json-schema-org/json-schema-spec/issues/1183) Further examples of such non-canonical URI construction, as well as the appropriate canonical URI-based fragments to use instead, are provided in .

Compound Documents A Compound Schema Document (sometimes called a "bundled" schema) has multiple embedded JSON Schema Resources bundled into the same document to ease transportation. Each embedded Schema Resource MUST be treated as an individual Schema Resource, following standard schema loading and processing requirements, including determining vocabulary support.

Bundling The bundling process for creating a Compound Schema Document is defined as taking references (such as "$ref") to an external Schema Resource and embedding the referenced Schema Resources within the referring document. Bundling SHOULD be done in such a way that all URIs (used for referencing) in the base document and any referenced/embedded documents do not require altering. Each embedded JSON Schema Resource MUST identify itself with a URI using the "$id" keyword, and SHOULD make use of the "$schema" keyword to identify the dialect it is using, in the root of the schema resource. It is RECOMMENDED that the URI identifier value of "$id" be an absolute URI. When the Schema Resource referenced by a by-reference applicator is bundled, it is RECOMMENDED that the Schema Resource be located as a value of a "$defs" object at the containing schema's root. The key of the "$defs" for the now embedded Schema Resource MAY be the "$id" of the bundled schema or some other form of application defined unique identifier (such as a UUID). This key is not intended to be referenced in JSON Schema, but may be used by an application to aid the bundling process. A Schema Resource MAY be embedded in a location other than "$defs" where the location is defined as a schema value. A Bundled Schema Resource MUST NOT be bundled by replacing the schema object from which it was referenced, or by wrapping the Schema Resource in other applicator keywords. In order to produce identical output, references in the containing schema document to the previously external Schema Resources MUST NOT be changed, and now resolve to a schema using the "$id" of an embedded Schema Resource. Such identical output includes validation evaluation and URIs or paths used in resulting annotations or errors. While the bundling process will often be the main method for creating a Compound Schema Document, it is also possible and expected that some will be created by hand, potentially without individual Schema Resources existing on their own previously.

Differing and Default Dialects When multiple schema resources are present in a single document, schema resources which do not define with which dialect they should be processed MUST be processed with the same dialect as the enclosing resource. Since any schema that can be referenced can also be embedded, embedded schema resources MAY specify different processing dialects using the "$schema" values from their enclosing resource.

Validating Given that a Compound Schema Document may have embedded resources which identify as using different dialects, these documents SHOULD NOT be validated by applying a meta-schema to the Compound Schema Document as an instance. It is RECOMMENDED that an alternate validation process be provided in order to validate Schema Documents. Each Schema Resource SHOULD be separately validated against its associated meta-schema.If you know a schema is what's being validated, you can identify if the schemas is a Compound Schema Document or not, by way of use of "$id", which identifies an embedded resource when used not at the document's root. A Compound Schema Document in which all embedded resources identify as using the same dialect, or in which "$schema" is omitted and therefore defaults to that of the enclosing resource, MAY be validated by applying the appropriate meta-schema.

Caveats

Guarding Against Infinite Recursion A schema MUST NOT be run into an infinite loop evaluating input. For example, if two schemas "#alice" and "#bob" both have an "allOf" property that refers to the other, a naive implementation might get stuck in an infinite recursive loop trying to validate the input. Schemas SHOULD NOT make use of infinite recursive nesting like this; the behavior is undefined.

References to Possible Non-Schemas Subschema objects (or booleans) are recognized by their use with known applicator keywords or with location-reserving keywords such as "$defs" that take one or more subschemas as a value. These keywords may be "$defs" and the standard applicators from this document, or extension keywords from a known vocabulary, or implementation-specific custom keywords. Multi-level structures of unknown keywords are capable of introducing nested subschemas, which would be subject to the processing rules for "$id". Therefore, having a reference target in such an unrecognized structure cannot be reliably implemented, and the resulting behavior is undefined. Similarly, a reference target under a known keyword, for which the value is known not to be a schema, results in undefined behavior in order to avoid burdening implementations with the need to detect such targets.These scenarios are analogous to fetching a schema over HTTP but receiving a response with a Content-Type other than application/schema+json. An implementation can certainly try to interpret it as a schema, but the origin server offered no guarantee that it actually is any such thing. Therefore, interpreting it as such has security implications and may produce unpredictable results. Note that single-level custom keywords with identical syntax and semantics to "$defs" do not allow for any intervening "$id" keywords, and therefore will behave correctly under implementations that attempt to use any reference target as a schema. However, this behavior is implementation-specific and MUST NOT be relied upon for interoperability.

RESTful / Hypermedia Schema References JSON and JSON schemas are not always used for HTTP resources or other hypermedia resources, and the rest of this document assumes no one protocol, nor does it even assume network access. However since HTTP resources in JSON with JSON Schemas to describe them are pretty common in Web APIs, this section describes how to process JSON texts in a more RESTful manner when using protocols that support media types and Web linking ().

Linking to a Schema It is RECOMMENDED that instances described by a schema provide a link to a downloadable JSON Schema using the link relation "describedby", as defined by Linked Data Protocol 1.0, () Section 8.1. In HTTP, such links can be attached to any response using the Link header (). An example of such a header would be: ; rel="describedby" ]]>

Usage Over HTTP When used for hypermedia systems over a network, HTTP () is frequently the protocol of choice for distributing schemas. Misbehaving clients can pose problems for server maintainers if they pull a schema over the network more frequently than necessary, when it's instead possible to cache a schema for a long period of time. HTTP servers SHOULD set long-lived caching headers on JSON Schemas. HTTP clients SHOULD observe caching headers and not re-request documents within their freshness period. Distributed systems SHOULD make use of a shared cache and/or caching proxy. Clients SHOULD set or prepend a User-Agent header specific to the JSON Schema implementation or software product. Since symbols are listed in decreasing order of significance, the JSON Schema library name/version should precede the more generic HTTP library name (if any). For example: Clients SHOULD be able to make requests with a "From" header so that server operators can contact the owner of a potentially misbehaving script.

Keyword Behaviors JSON Schema keywords fall into several general behavior categories. Assertions validate that an instance satisfies constraints, producing a boolean result. Annotations attach information that applications may use in any way they see fit. Applicators apply subschemas to parts of input and combine their results. Extension keywords SHOULD stay within these categories, keeping in mind that annotations in particular are extremely flexible. Complex behavior is usually better delegated to applications on the basis of annotation data than implemented directly as schema keywords. However, extension keywords MAY define other behaviors for specialized purposes. Evaluating an input against a schema involves processing all of the keywords in the schema against the appropriate locations within the input. Typically, applicator keywords are processed until a schema object with no applicators (and therefore no subschemas) is reached. The appropriate location in the input is evaluated against the assertion and annotation keywords in the schema object. The validation result of a schema object containing keywords MUST be the logical AND of the validation results of its keywords. The interactions of keyword and schema results with annotations, errors, and keyword dependencies are defined by , while the relationship of subschema results to the results of the applicator keyword that applied them is described by . Evaluation of a parent schema object can complete once all of its subschemas have been evaluated, although in some circumstances evaluation may be short-circuited due to assertion results. Implementations MAY short-circuit evaluation if analysis of the schema at load time shows that no annotation production or keyword dependency communication could be impacted, and if the runtime configuration does not request "verbose" output ().

Lexical Scope and Dynamic Scope While most JSON Schema keywords can be evaluated on their own, or at most need to take into account the values or results of adjacent keywords in the same schema object, a few have more complex behavior. The lexical scope of a keyword is determined by the nested JSON data structure of objects and arrays. The largest such scope is an entire schema document. The smallest scope is a single schema object with no subschemas. Other keywords may take into account the dynamic scope that exists during the evaluation of a schema, typically together with an input document. The outermost dynamic scope is the schema object at which processing begins, even if it is not a schema resource root. The path from this root schema to any particular keyword (that includes any "$ref" and "$dynamicRef" keywords that may have been resolved) is considered the keyword's "evaluation path." A dynamic scope consists of a schema evaluation (at a particular evaluation path), which for non-empty schema objects contains one or more immediate keyword sub-evaluations. A dynamic scope's subscopes are the result of applicator keyword subschema evaluations, which are considered sub-evaluations of the applicator keyword evaluation. The sub-evaluation and parent evaluation relationships are transitive. Lexical and dynamic scopes align until a reference keyword is encountered. While following the reference keyword moves processing from one lexical scope into a different one, from the perspective of dynamic scope, following a reference is no different from descending into a subschema present as a value. A keyword on the far side of that reference that resolves information through the dynamic scope will consider the originating side of the reference to be their dynamic parent, rather than examining the local lexically enclosing parent. The concept of dynamic scope should be considered an advanced feature and used with caution when defining extension keywords.

Keyword output relevance In addition to accepting or rejecting the instance as the validation result, each keyword evaluation can produce output in the form of an annotation (on acceptance) or an error (on rejection), as well as information that is used to implement keyword dependencies. Whether this produced output appears in actual streamed or finalized output, and whether dependency information is usable by a depending keyword, is determined by the producing keyword evaluation's relevance, and in the case of output, the output configuration. Relevance is a function of a keyword's validation result as it compares to the validation results of its parent evaluations:

• All keyword evaluations are initially considered to be relevant
• A schema object evaluation that rejects the input MUST cause all keyword sub-evaluations that accepted the input to become irrelevant
• A keyword that accepts the input MUST cause all keyword sub-evaluations that rejected the input to become irrelevant
• A schema object that accepts the input MUST NOT impact relevance
• A keyword object that rejects the input has no necessary effect on relevance, but will cause its parent schema evaluation to reject, triggering the appropriate relevancy transitions
• Once a keyword evaluation becomes irrelevant, it MUST NOT ever subsequently be deemed relevant.

Annotations and errors MUST only be included in output if the output configuration includes them; note that only "verbose" () output formats include irrelevant output. Dependency information MUST only be used from evaluations considered to be relevant at the time of the depending keyword's evaluation, regardless of output choice.

Keyword Interactions Keywords MAY be defined with a partial value, such as a URI-reference, which must be resolved against another value, such as another URI-reference or a full URI, which is found through the lexical structure of the structured document. The "$id", "$ref", and "$dynamicRef" core keywords, and the "base" JSON Hyper-Schema keyword, are examples of this sort of behavior. Note that some keywords, such as "$schema", apply to the lexical scope of the entire schema resource, and therefore MUST only appear in a schema resource's root schema. A keyword MAY depend on the value or outcome of other keywords within the same dynamic scopes or its successful subscopes. No constraints are placed on the mechanism of communication within implementations. Interactions within the same dynamic scope that depend only on adjacent keyword values SHOULD be determined statically. Other interactions, including all those involving dynamic subscopes, are expected to be handled as runtime communication. Note that dependencies involving either dynamic subscopes or evaluation of adjacent keywords impose an ordering on keyword evaluation. Such keywords MUST NOT result in a circular dependency. Keywords MAY modify their behavior based on the presence or absence of another keyword in the same schema object. Keywords MUST NOT define interactions outside of these mechanisms.

Default Behaviors A missing keyword MUST NOT produce a false assertion result, MUST NOT produce annotation results, and MUST NOT cause any other schema to be evaluated as part of its own behavioral definition. However, given that missing keywords do not contribute annotations, the lack of annotation results may indirectly change the behavior of other keywords. In some cases, the missing keyword assertion behavior of a keyword is identical to that produced by a certain value, and keyword definitions SHOULD note such values where known. However, even if the value which produces the default behavior would produce annotation results if present, the default behavior still MUST NOT result in annotations.

Handling unrecognized or unsupported keywords Implementations SHOULD treat keywords they do not recognize, or that they recognize but do not support, as annotations, where the value of the keyword is the value of the annotation. Whether an implementation produces these annotations or not, they MUST otherwise ignore the keywords.

Identifiers Identifiers define URIs for a schema, or affect how such URIs are resolved in schema references, or both. The Core vocabulary defined in this document defines several identifying keywords, most notably "$id". Canonical schema URIs MUST NOT change while processing an input, but keywords that affect URI-reference resolution MAY have behavior that is only fully determined at runtime. While custom identifier keywords are possible, vocabulary designers should take care not to disrupt the functioning of core keywords. For example, the "$dynamicAnchor" keyword in this specification limits its URI resolution effects to the matching "$dynamicRef" keyword, leaving the behavior of "$ref" undisturbed.

Applicators Applicators allow for building more complex schemas than can be accomplished with a single schema object. Evaluation of an input against a schema document begins by applying the root schema to the complete input document. From there, keywords known as applicators are used to determine which additional schemas are applied. Such schemas may be applied in-place to the current location, or to a child location. The schemas to be applied may be present as subschemas comprising all or part of the keyword's value. Alternatively, an applicator may refer to a schema elsewhere in the same schema document, or in a different one. The mechanism for identifying such referenced schemas is defined by the keyword. Applicator keywords also define how subschema or referenced schema boolean assertion results are modified and/or combined to produce the boolean result of the applicator. Applicators MAY apply any boolean logic operation to the assertion results of subschemas, but MUST NOT introduce new assertion conditions of their own.

Referenced and Referencing Schemas As noted in , an applicator keyword may refer to a schema to be applied, rather than including it as a subschema in the applicator's value. In such situations, the schema being applied is known as the referenced schema, while the schema containing the applicator keyword is the referencing schema. While root schemas and subschemas are static concepts based on a schema's position within a schema document, referenced and referencing schemas are dynamic. Different pairs of schemas may find themselves in various referenced and referencing arrangements during the evaluation of input against a schema. For some by-reference applicators, such as "$ref", the referenced schema can be determined by static analysis of the schema document's lexical scope. Others, such as "$dynamicRef" (with "$dynamicAnchor"), may make use of dynamic scoping, and therefore only be resolvable in the process of evaluating an input with the schema.

Assertions JSON Schema can be used to assert constraints on a JSON value, which either passes or fails the assertions. This approach can be used to validate conformance with the constraints, or document what is needed to satisfy them. JSON Schema implementations produce a single boolean result when evaluating an input against schema assertions. An input can only fail an assertion that is present in the schema.

Assertions and Input Primitive Types Most assertions only constrain values within a certain primitive type. When the type of the input is not of the type targeted by the keyword, the input is considered to conform to the assertion. For example, the "maxLength" keyword from the validation vocabulary () will only restrict certain strings (that are too long) from being valid. If the input is a number, boolean, null, array, or object, then it is accepted by this assertion. This behavior allows keywords to be used more easily with inputs that can be of multiple primitive types. The validation vocabulary also includes a "type" keyword which can independently restrict the input to one or more primitive types. This allows for a concise expression of use cases such as a function that might return either a string of a certain length or a null value: If "maxLength" also restricted the input type to be a string, then this would be substantially more cumbersome to express because the example as written would not actually allow null values. Each keyword is evaluated separately unless explicitly specified otherwise, so if "maxLength" restricted the input to strings, then including "null" in "type" would not have any useful effect.

Annotations JSON Schema can annotate an instance with information, whenever the instance validates against the schema object containing the annotation, and all of its parent schema objects. The annotation value produced by each annotation keyword MUST be the keyword's value. Annotations are attached to specific locations in an instance. Since many subschemas can be applied to any single location, applications may need to decide how to handle differing annotation values being attached to the same instance location by the same schema keyword in different schema objects. Unlike assertion results, annotation data can take a wide variety of forms, which are provided to applications to use as they see fit. JSON Schema implementations are not expected to make use of the produced annotations on behalf of applications. While "short-circuit" evaluation is possible for assertions, producing annotations requires examining all schemas that apply to an instance location, even if they cannot change the overall assertion result. The only exception is that subschemas of a schema object that has failed validation MAY be skipped, as annotations are not retained for failing schemas.

Producing Annotations Annotations are produced by keywords that explicitly define annotation-producing behavior. Note that boolean schemas cannot produce annotations as they do not make use of keywords. See for conditions under which annotations appear in output, and how they are managed throughout the evaluation process. A produced annotation MUST include the following information:

• The name of the keyword that produces the annotation
• The instance location to which it is attached, as a JSON Pointer
• The schema location path, indicating how reference keywords such as "$ref" were followed to reach the absolute schema location.
• The absolute schema location of the attaching keyword, as a URI. This MAY be omitted if it is the same as the schema location path from above.
• The attached value

Reserved Locations A final category of keywords simply reserve a location to hold re-usable components or data of interest to schema authors that is not suitable for re-use. These keywords do not affect validation or annotation results. Their purpose in the core vocabulary is to ensure that locations are available for certain purposes and will not be redefined by extension keywords. While these keywords do not directly affect results, as explained in unrecognized extension keywords that reserve locations for re-usable schemas may have undesirable interactions with references in certain circumstances.

Loading Input Data While none of the vocabularies defined as part of this or the associated documents define a keyword which may target and/or load input data, it is possible that other vocabularies may wish to do so. Keywords MAY be defined to use JSON Pointers or Relative JSON Pointers to examine parts of an input outside the current evaluation location. Keywords that allow adjusting the location using a Relative JSON Pointer SHOULD default to using the current location if a default is desirable.

Output Formatting JSON Schema is defined to be platform-independent. As such, to increase compatibility across platforms, implementations SHOULD conform to a standard validation output format. This section describes the minimum requirements that consumers will need to properly interpret validation results.

Format JSON Schema output is defined using the JSON Schema data model. Implementations MAY deviate from this as supported by their specific languages and platforms, however it is RECOMMENDED that the output be convertible to the JSON format defined herein via serialization or other means.

Output Formats This specification defines four output formats. See the "Output Structure" section for the requirements of each format.

• Flag - A boolean which simply indicates the overall validation result with no further details.
• Basic - Provides validation information in a flat list structure.
• Detailed - Provides validation information in a condensed hierarchical structure based on the structure of the schema.
• Verbose - Provides validation information in an uncondensed hierarchical structure that matches the exact structure of the schema.

An implementation SHOULD provide at least one of the "flag", "basic", or "detailed" format and MAY provide the "verbose" format. If it provides one or more of the "detailed" or "verbose" formats, it MUST also provide the "flag" format. Implementations SHOULD specify in their documentation which formats they support.

Minimum Information Beyond the simplistic "flag" output, additional information is useful to aid in debugging a schema or input. Each sub-result SHOULD contain the information contained within this section at a minimum. A single object that contains all of these components is considered an output unit. Implementations MAY elect to provide additional information.

Keyword Relative Location The relative location of the validating keyword that follows the evaluation path. The value MUST be expressed as a JSON Pointer, and it MUST include any by-reference applicators such as "$ref" or "$dynamicRef". Note that this pointer may not be resolvable by the normal JSON Pointer process due to the inclusion of these by-reference applicator keywords. The JSON key for this information is "keywordLocation".

Keyword Absolute Location The absolute, dereferenced location of the validating keyword. The value MUST be expressed as a full URI using the canonical URI of the relevant schema resource with a JSON Pointer fragment, and it MUST NOT include by-reference applicators such as "$ref" or "$dynamicRef" as non-terminal path components. It MAY end in such keywords if the error or annotation is for that keyword, such as an unresolvable reference.Note that "absolute" here is in the sense of "absolute filesystem path" (meaning the complete location) rather than the "absolute-URI" terminology from RFC 3986 (meaning with scheme but without fragment). Keyword absolute locations will have a fragment in order to identify the keyword. This information MAY be omitted only if either the dynamic scope did not pass over a reference or if the schema does not declare an absolute URI as its "$id". The JSON key for this information is "absoluteKeywordLocation".

Instance Location The location of the JSON value within the instance. The value MUST be expressed as a JSON Pointer. The JSON key for this information is "instanceLocation".

Error or Annotation The error or annotation that is produced by the validation. For errors, the specific wording for the message is not defined by this specification. Implementations will need to provide this. The JSON key for failed validations is "error"; for successful validations it is "annotation".

Nested Results For the two hierarchical structures, this property will hold nested errors and annotations. The JSON key for nested results in failed validations is "errors"; for successful validations it is "annotations". Note the plural forms, as a keyword with nested results can also have a local error or annotation.

Output Structure The output MUST be an object containing a boolean property named "valid". When additional information about the result is required, the output MUST also contain "errors" or "annotations" as described below.

• "valid" - a boolean value indicating the overall validation success or failure
• "errors" - the collection of errors or annotations produced by a failed validation
• "annotations" - the collection of errors or annotations produced by a successful validation

Unless otherwise specified or required for the overall output structure, output units for irrelevant keyword evaluations () SHOULD be omitted, and annotations and errors from such evaluations MUST be omitted. For these examples, the following schema and input will be used. This input will fail validation and produce errors, but it's trivial to deduce examples for passing schemas that produce annotations. Specifically, the errors it will produce are:

• The second object is missing a "y" property.
• The second object has a disallowed "z" property.
• There are only two objects, but three are required.

Note that the error message wording as depicted in these examples is not a requirement of this specification. Implementations SHOULD craft error messages tailored for their audience or provide a templating mechanism that allows their users to craft their own messages.

Flag In the simplest case, merely the boolean result for the "valid" property needs to be fulfilled. Because no errors or annotations are returned with this format, it is RECOMMENDED that implementations supporting short-circuiting logic () use it to return failure or success as soon as the outcome can be determined.

Basic The "Basic" structure is a flat list of output units.

Detailed The "Detailed" structure is based on the schema and can be more readable for both humans and machines. Having the structure organized this way makes associations between the errors more apparent. For example, the fact that the missing "y" property and the extra "z" property both stem from the same location in the instance is not immediately obvious in the "Basic" structure. In a hierarchy, the correlation is more easily identified. The following rules govern the construction of the results object:

• All applicator keywords ("*Of", "$ref", "if"/"then"/"else", etc.) require a node.
• Nodes that have no children are removed.
• Nodes that have a single child are replaced by the child.

Branch nodes do not require an error message or an annotation.

Verbose The "Verbose" structure is a fully realized hierarchy that exactly matches that of the schema. This structure has applications in form generation and validation where the error's location is important. The primary difference between this and the "Detailed" structure is that all results are returned, including information from irrelevant () keyword evaluations. Because of this, it is RECOMMENDED that each node also carry a valid property to indicate the validation result for that node, which can also be used to determine which output units are relevant and which are only included because of the verbosity. Because this output structure can be quite large, a smaller example is given here for brevity. The URI of the full output structure of the example above is: https://json-schema.org/draft/2020-12/output/verbose-example. schema: input: result:

Output validation schemas For convenience, JSON Schema has been provided to validate output generated by implementations. Its URI is: https://json-schema.org/draft/2020-12/output/schema.

Extensibility

Non-JSON Inputs It is possible to use JSON Schema with a superset of the JSON Schema data model, where an input may be outside any of the six JSON data types. In this case, annotations still apply; but most validation keywords will not be useful, as they will always pass or always fail. A custom vocabulary may define support for a superset of the core data model. The schema itself may only be expressible in this superset; for example, to make use of the "const" keyword.

Schema Vocabularies A schema vocabulary, or simply a vocabulary, is a set of keywords, their syntax, and their semantics. A vocabulary is generally organized around a particular purpose. Different uses of JSON Schema, such as validation, hypermedia, or user interface generation, will involve different sets of vocabularies. Vocabularies are the primary unit of re-use in JSON Schema, as schema authors can indicate what vocabularies are required or optional in order to process the schema. Since vocabularies are identified by URIs in the meta-schema, generic implementations can load extensions to support previously unknown vocabularies. While keywords can be supported outside of any vocabulary, there is no analogous mechanism to indicate individual keyword usage. A schema vocabulary can be defined by anything from an informal description to a standards proposal, depending on the audience and interoperability expectations. In particular, in order to facilitate vocabulary use within non-public organizations, a vocabulary specification need not be published outside of its scope of use.

Meta-Schemas A schema that itself describes a schema is called a meta-schema. Meta-schemas are used to validate JSON Schemas and specify which vocabularies they are using. Meta-schemas that use the "$vocabulary" keyword to declare the vocabularies in use MUST explicitly list the Core vocabulary, which MUST have a value of true indicating that it is required. Meta-schemas that do not use "$vocabulary" MUST be considered to require the Core vocabulary as if its URI were present with a value of true. Typically, a meta-schema will specify a set of vocabularies, and validate schemas that conform to the syntax of those vocabularies. However, meta-schemas and vocabularies are separate in order to allow meta-schemas to validate schema conformance more strictly or more loosely than the vocabularies' specifications call for. Meta-schemas may also describe and validate additional keywords that are not part of a formal vocabulary. Meta-schemas and vocabularies together are used to inform an implementation how to interpret a schema. Every schema has a meta-schema, which can be declared using the "$schema" keyword. The meta-schema serves two purposes:

1. Declaring the vocabularies in use
   • The "$vocabulary" keyword, when it appears in a meta-schema, declares which vocabularies are available to be used in schemas that refer to that meta-schema. Vocabularies define keyword semantics, as well as their general syntax.
2. Describing valid schema syntax
   • A schema MUST successfully validate against its meta-schema, which constrains the syntax of the available keywords. The syntax described is expected to be compatible with the vocabularies declared; while it is possible to describe an incompatible syntax, such a meta-schema would be unlikely to be useful.

Meta-schemas are separate from vocabularies to allow for vocabularies to be combined in different ways, and for meta-schema authors to impose additional constraints such as forbidding certain keywords, or performing unusually strict syntactical validation, as might be done during a development and testing cycle. Each vocabulary typically identifies a meta-schema consisting only of the vocabulary's keywords. Meta-schema authoring is an advanced usage of JSON Schema, so the design of meta-schema features emphasizes flexibility over simplicity.

Default JSON Schema Dialect The current URI for the default JSON Schema dialect meta-schema is . For schema author convenience, this meta-schema describes a dialect consisting of all vocabularies defined in this specification, as well as two former keywords which are reserved for a transitional period. Individual vocabulary and vocabulary meta-schema URIs are given for each section below. Certain vocabularies are optional to support, which is explained in detail in the relevant sections. Updated vocabulary and meta-schema URIs may be published between specification drafts in order to correct errors.

Security Considerations Both schemas and instances are JSON values. As such, all security considerations defined in apply. Instances and schemas are both frequently written by untrusted third parties, to be deployed on public Internet servers. Implementations should take care that the parsing and validating against schemas does not consume excessive system resources. Implementations MUST NOT fall into an infinite loop. A malicious party could cause an implementation to repeatedly produce a copy of a very large value as an annotation. Implementations SHOULD guard against excessive consumption of system resources in such a scenario. Servers MUST ensure that malicious parties cannot change the functionality of existing schemas by uploading a schema with a pre-existing or very similar "$id". Individual JSON Schema vocabularies are liable to also have their own security considerations. Consult the respective specifications for more information. Schema authors should take care with "$comment" contents, as a malicious implementation can display them to end-users in violation of a spec, or fail to strip them if such behavior is expected. A malicious schema author could place executable code or other dangerous material within a "$comment". Implementations MUST NOT parse or otherwise take action based on "$comment" contents. JSON Schema validation allows the use of Regular Expressions, which have numerous different (often incompatible) implementations. Some implementations allow the embedding of arbitrary code, which is outside the scope of JSON Schema and MUST NOT be permitted. Regular expressions can often also be crafted to be extremely expensive to compute (with so-called "catastrophic backtracking"), resulting in a denial-of-service attack. Implementations that support validating or otherwise evaluating input string data based on "contentEncoding" and/or "contentMediaType" are at risk of evaluating data in an unsafe way based on misleading information. Applications can mitigate this risk by only performing such processing when a relationship between the schema and input is established (e.g., they share the same authority). Processing a media type or encoding is subject to the security considerations of that media type or encoding. For example, the security considerations Scripting Media Types () apply when processing JavaScript or ECMAScript encoded within a JSON string.

Interoperability Considerations

Programming Language Independence JSON Schema is programming language agnostic, and supports the full range of values described in the data model. Be aware, however, that some languages and JSON parsers may not be able to represent in memory the full range of values describable by JSON.

Mathematical Integers Some programming languages and parsers use different internal representations for floating point numbers than they do for integers. For consistency, integer JSON numbers SHOULD NOT be encoded with a fractional part.

Regular Expressions Keywords MAY use regular expressions to express constraints, or constrain the input value to be a regular expression. These regular expressions SHOULD be valid according to the regular expression dialect described in , Section 21.2.1. Unless otherwise specified by a keyword, regular expressions MUST NOT be considered to be implicitly anchored at either end. All regular expression keywords in this specification are un-anchored. Regular expressions SHOULD be built with the "u" flag (or equivalent) to provide Unicode support, or processed in such a way which provides Unicode support as defined by ECMA-262. Furthermore, given the high disparity in regular expression constructs support, schema authors SHOULD limit themselves to the following regular expression tokens:

• individual Unicode characters, as defined by the JSON specification ();
• simple character classes ([abc]), range character classes ([a-z]);
• complemented character classes ([^abc], [^a-z]);
• simple quantifiers: "+" (one or more), "*" (zero or more), "?" (zero or one), and their lazy versions ("+?", "*?", "??");
• range quantifiers: "{x}" (exactly x occurrences), "{x,y}" (at least x, at most y, occurrences), {x,} (x occurrences or more), and their lazy versions;
• the beginning-of-input ("^") and end-of-input ("$") anchors;
• simple grouping ("(...)") and alternation ("|").

Finally, implementations MUST NOT take regular expressions to be anchored, neither at the beginning nor at the end. This means, for instance, the pattern "es" matches "expression".

IANA Considerations

application/schema+json The proposed MIME media type for JSON Schema is defined as follows:

• Type name: application
• Subtype name: schema+json
• Required parameters: N/A
• Encoding considerations: Encoding considerations are identical to those specified for the "application/json" media type. See JSON ().
• Security considerations: See above.
• Interoperability considerations: See , , and above.
• Fragment identifier considerations: See .

application/schema-instance+json The proposed MIME media type for JSON Schema Instances that require a JSON Schema-specific media type is defined as follows:

• Type name: application
• Subtype name: schema-instance+json
• Required parameters: N/A
• Encoding considerations: Encoding considerations are identical to those specified for the "application/json" media type. See JSON ().
• Security considerations: See above.
• Interoperability considerations: See , , and above.
• Fragment identifier considerations: See .

References Normative References European Computer Manufacturers Association IBM Corporation IBM Corporation Oracle Corporation Textuality Contivo, Inc. Microsoft University of Edinburgh University of Edinburgh and W3C In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. JavaScript Object Notation (JSON) is a lightweight, text-based, language-independent data interchange format. It was derived from the ECMAScript Programming Language Standard. JSON defines a small set of formatting rules for the portable representation of structured data. This document removes inconsistencies with other specifications of JSON, repairs specification errors, and offers experience-based interoperability guidance. A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK] A content media type name sometimes includes partitioned meta- information distinguished by a structured syntax to permit noting an attribute of the media as a suffix to the name. This document defines several structured syntax suffixes for use with media type registrations. In particular, it defines and registers the "+json", "+ber", "+der", "+fastinfoset", "+wbxml" and "+zip" structured syntax suffixes, and provides a media type structured syntax suffix registration form for the "+xml" structured syntax suffix. This document is not an Internet Standards Track specification; it is published for informational purposes. JSON Pointer defines a string syntax for identifying a specific value within a JavaScript Object Notation (JSON) document. This document defines a date and time format for use in Internet protocols that is a profile of the ISO 8601 standard for representation of dates and times using the Gregorian calendar. This document is a specification of the basic protocol for Internet electronic mail transport. It consolidates, updates, and clarifies several previous documents, making all or parts of most of them obsolete. It covers the SMTP extension mechanisms and best practices for the contemporary Internet, but does not provide details about particular extensions. Although SMTP was designed as a mail transport and delivery protocol, this specification also contains information that is important to its use as a "mail submission" protocol for "split-UA" (User Agent) mail reading systems and mobile environments. [STANDARDS-TRACK] This document specifies an SMTP extension for transport and delivery of email messages with internationalized email addresses or header information. [STANDARDS-TRACK] This RFC is an official specification for the Internet community. It incorporates by reference, amends, corrects, and supplements the primary protocol standards documents relating to hosts. [STANDARDS-TRACK] This document is the revised protocol definition for Internationalized Domain Names (IDNs). The rationale for changes, the relationship to the older specification, and important terminology are provided in other documents. This document specifies the protocol mechanism, called Internationalized Domain Names in Applications (IDNA), for registering and looking up IDNs in a way that does not require changes to the DNS itself. IDNA is only meant for processing domain names, not free text. [STANDARDS-TRACK] This document is one of a collection that, together, describe the protocol and usage context for a revision of Internationalized Domain Names for Applications (IDNA), superseding the earlier version. It describes the document collection and provides definitions and other material that are common to the set. [STANDARDS-TRACK] This document defines a "Bit-String Label" which may appear within domain names. This new label type compactly represents a sequence of "One-Bit Labels" and enables resource records to be stored at any bit- boundary in a binary-named section of the domain name tree. [STANDARDS-TRACK] This specification defines the addressing architecture of the IP Version 6 (IPv6) protocol. The document includes the IPv6 addressing model, text representations of IPv6 addresses, definition of IPv6 unicast addresses, anycast addresses, and multicast addresses, and an IPv6 node's required addresses. This document obsoletes RFC 3513, "IP Version 6 Addressing Architecture". [STANDARDS-TRACK] This document defines a new protocol element, the Internationalized Resource Identifier (IRI), as a complement of the Uniform Resource Identifier (URI). An IRI is a sequence of characters from the Universal Character Set (Unicode/ISO 10646). A mapping from IRIs to URIs is defined, which means that IRIs can be used instead of URIs, where appropriate, to identify resources. The approach of defining a new protocol element was chosen instead of extending or changing the definition of URIs. This was done in order to allow a clear distinction and to avoid incompatibilities with existing software. Guidelines are provided for the use and deployment of IRIs in various protocols, formats, and software components that currently deal with URIs. This specification defines a Uniform Resource Name namespace for UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally Unique IDentifier). A UUID is 128 bits long, and can guarantee uniqueness across space and time. UUIDs were originally used in the Apollo Network Computing System and later in the Open Software Foundation\'s (OSF) Distributed Computing Environment (DCE), and then in Microsoft Windows platforms. This specification is derived from the DCE specification with the kind permission of the OSF (now known as The Open Group). Information from earlier versions of the DCE specification have been incorporated into this document. [STANDARDS-TRACK] A URI Template is a compact sequence of characters for describing a range of Uniform Resource Identifiers through variable expansion. This specification defines the URI Template syntax and the process for expanding a URI Template into a URI reference, along with guidelines for the use of URI Templates on the Internet. [STANDARDS-TRACK] JSON Pointer is a syntax for specifying locations in a JSON document, starting from the document root. This document defines an extension to the JSON Pointer syntax, allowing relative locations from within the document. This document describes the commonly used base 64, base 32, and base 16 encoding schemes. It also discusses the use of line-feeds in encoded data, use of padding in encoded data, use of non-alphabet characters in encoded data, use of different encoding alphabets, and canonical encodings. [STANDARDS-TRACK] This initial document specifies the various headers used to describe the structure of MIME messages. [STANDARDS-TRACK] This second document defines the general structure of the MIME media typing system and defines an initial set of media types. [STANDARDS-TRACK] This specification defines a model for the relationships between resources on the Web ("links") and the type of those relationships ("link relation types"). It also defines the serialisation of such links in HTTP headers with the Link header field. Informative References JSONPath defines a string syntax for selecting and extracting JSON (RFC 8259) values from within a given JSON value. RFC 5988 specifies a way to define relationships between links on the web. This document describes a new type of such a relationship, "canonical", to designate an Internationalized Resource Identifier (IRI) as preferred over resources with duplicative content. This document is not an Internet Standards Track specification; it is published for informational purposes. The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes. This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230. This document describes the registration of media types for the ECMAScript and JavaScript programming languages and conformance requirements for implementations of these types. This memo provides information for the Internet community. JSON Schema is a JSON-based format for describing JSON data using various vocabularies. This document specifies a vocabulary for annotating JSON documents with hyperlinks. These hyperlinks include attributes describing how to manipulate and interact with remote resources through hypermedia environments such as HTTP, as well as determining whether the link is usable based on the instance value. The hyperlink serialization format described in this document is also usable independent of JSON Schema.

Schema identification examples Consider the following schema, which shows "$id" being used to identify both the root schema and various subschemas, and "$anchor" being used to define plain name fragment identifiers. The schemas at the following URI-encoded JSON Pointers (, relative to the root schema) have the following base URIs, and are identifiable by any listed URI in accordance with and above.

• # (document root)
  • canonical (and base) URI: https://example.com/root.json
  • canonical resource URI plus pointer fragment: https://example.com/root.json#
• #/$defs/A
  • base URI: https://example.com/root.json
  • canonical resource URI plus plain fragment: https://example.com/root.json#foo
  • canonical resource URI plus pointer fragment: https://example.com/root.json#/$defs/A
• #/$defs/B
  • canonical (and base) URI: https://example.com/other.json
  • canonical resource URI plus pointer fragment: https://example.com/other.json#
  • base URI of enclosing (root.json) resource plus fragment: https://example.com/root.json#/$defs/B
• #/$defs/B/$defs/X
  • base URI: https://example.com/other.json
  • canonical resource URI plus plain fragment: https://example.com/other.json#bar
  • canonical resource URI plus pointer fragment: https://example.com/other.json#/$defs/X
  • base URI of enclosing (root.json) resource plus fragment: https://example.com/root.json#/$defs/B/$defs/X
• #/$defs/B/$defs/Y
  • canonical (and base) URI: https://example.com/t/inner.json
  • canonical URI plus plain fragment: https://example.com/t/inner.json#bar
  • canonical URI plus pointer fragment: https://example.com/t/inner.json#
  • base URI of enclosing (other.json) resource plus fragment: https://example.com/other.json#/$defs/Y
  • base URI of enclosing (root.json) resource plus fragment: https://example.com/root.json#/$defs/B/$defs/Y
• #/$defs/C
  • canonical (and base) URI: urn:uuid:ee564b8a-7a87-4125-8c96-e9f123d6766f
  • canonical URI plus pointer fragment: urn:uuid:ee564b8a-7a87-4125-8c96-e9f123d6766f#
  • base URI of enclosing (root.json) resource plus fragment: https://example.com/root.json#/$defs/C

Note: The fragment part of the URI does not make it canonical or non-canonical, rather, the base URI used (as part of the full URI with any fragment) is what determines the canonical nature of the resulting full URI.Multiple "canonical" URIs? We Acknowledge this is potentially confusing, and direct you to read the CREF located in the JSON Pointer fragments and embedded schema resources section for further comments.

Manipulating schema documents and references Various tools have been created to rearrange schema documents based on how and where references ("$ref") appear. This appendix discusses which use cases and actions are compliant with this specification.

Bundling schema resources into a single document A set of schema resources intended for use together can be organized with each in its own schema document, all in the same schema document, or any granularity of document grouping in between. Numerous tools exist to perform various sorts of reference removal. A common case of this is producing a single file where all references can be resolved within that file. This is typically done to simplify distribution, or to simplify coding so that various invocations of JSON Schema libraries do not have to keep track of and load a large number of resources. This transformation can be safely and reversibly done as long as all static references (e.g. "$ref") use URI-references that resolve to URIs using the canonical resource URI as the base, and all schema resources have an absolute-URI as the "$id" in their root schema. With these conditions met, each external resource can be copied under "$defs", without breaking any references among the resources' schema objects, and without changing any aspect of validation or annotation results. The names of the schemas under "$defs" do not affect behavior, assuming they are each unique, as they do not appear in the canonical URIs for the embedded resources.

Reference removal is not always safe Attempting to remove all references and produce a single schema document does not, in all cases, produce a schema with identical behavior to the original form. Since "$ref" is now treated like any other keyword, with other keywords allowed in the same schema objects, fully supporting non-recursive "$ref" removal in all cases can require relatively complex schema manipulations. It is beyond the scope of this specification to determine or provide a set of safe "$ref" removal transformations, as they depend not only on the schema structure but also on the intended usage.

Example of recursive schema extension Consider the following two schemas describing a simple recursive tree structure, where each node in the tree can have a "data" field of any type. The first schema allows and ignores other instance properties. The second is more strict and only allows the "data" and "children" properties. An example input with "data" misspelled as "daat" is also shown. tree schema, extensible: strict-tree schema, guards against misspelled properties: input with misspelled field: When we load these two schemas, we will notice the "$dynamicAnchor" named "node" (note the lack of "#" as this is just the name) present in each, resulting in the following full schema URIs:

• "https://example.com/tree#node"
• "https://example.com/strict-tree#node"

In addition, JSON Schema implementations keep track of the fact that these fragments were created with "$dynamicAnchor". If we apply the "strict-tree" schema to the input, we will follow the "$ref" to the "tree" schema, examine its "children" subschema, and find the "$dynamicRef": to "#node" (note the "#" for URI fragment syntax) in its "items" subschema. That reference resolves to "https://example.com/tree#node", which is a URI with a fragment created by "$dynamicAnchor". Therefore we must examine the dynamic scope before following the reference. At this point, the dynamic path is "#/$ref/properties/children/items/$dynamicRef", with a dynamic scope containing (from the outermost scope to the innermost):

1. "https://example.com/strict-tree#"
2. "https://example.com/tree#"
3. "https://example.com/tree#/properties/children"
4. "https://example.com/tree#/properties/children/items"

Since we are looking for a plain name fragment, which can be defined anywhere within a schema resource, the JSON Pointer fragments are irrelevant to this check. That means that we can remove those fragments and eliminate consecutive duplicates, producing:

1. "https://example.com/strict-tree"
2. "https://example.com/tree"

In this case, the outermost resource also has a "node" fragment defined by "$dynamicAnchor". Therefore instead of resolving the "$dynamicRef" to "https://example.com/tree#node", we resolve it to "https://example.com/strict-tree#node". This way, the recursion in the "tree" schema recurses to the root of "strict-tree", instead of only applying "strict-tree" to the input root, but applying "tree" to input children. This example shows both "$dynamicAnchor"s in the same place in each schema, specifically the resource root schema. Since plain-name fragments are independent of the JSON structure, this would work just as well if one or both of the node schema objects were moved under "$defs". It is the matching "$dynamicAnchor" values which tell us how to resolve the dynamic reference, not any sort of correlation in JSON structure.

Implementing keyword dependencies As noted in , some keywords depend on the value or successful evaluation outcome of other keywords within the same schema evaluation or any of its successful sub-evaluations. The specifics of this mechanism are left up to each implementation. As an example, the value of the properties keyword includes a set of property names that is used by additionalProperties, and produces information about which properties were successfully evaluated, which is used in the implementation of unevaluatedProperties. With this schema: The value of properties includes the property names "X" and "Y", therefore regardless of the outcome of properties, the additionalProperties schema is never applied to those properties:

Input	"additionalProperties" applied to	valid
{"X": 1, "Y": 2}	(none)	true
{"X": 1, "Y": 2, "radius": 5}	"radius"	false by additionalProperties
{"X": "hello", "Y": "world"}	(none)	false by type in properties

Note that the additionalProperties subschema is never applied to "X" or "Y" even when they are rejected by properties. When using the point schema (without additionalProperties) via a reference, unevaluatedProperties is required to get the same validation outcomes, as shown in this schema: Since unevaluatedProperties cannot "see" through the reference (which could include a complex arrangement of references and conditionals that would be non-trivial to analyze, unlike this example), it depends on runtime evaluation results of properties rather than its static value. The following table shows the information produced by properties for three different inputs, and how unevaluatedProperties implementations could use that result. Note that unevaluatedProperties ends up applying to both properties in the third row, while additionalProperties never applied to either of them.

Input	successful "properties" evaluations	"unevaluatedProperties" applied to	valid
{"X": 1, "Y": 2}	"X", "Y"	(none)	true
{"X": 1, "Y": 2, "radius": 5}	"X", "Y"	"radius"	false by unevaluatedProperties
{"X": "hello", "Y": "world"}	(none)	"X", "Y"	false by both unevaluatedProperties and type in properties

Similarly, the length of the prefixItems keyword's value is used by items, and it produces information which is used by unevaluatedItems. Consider this schema for a structured log entry with a timestamp, action, and username fields, and preventing additional fields: The length of the prefixItems keyword is 3, so items is applied to items at index 3 or higher, as shown in table below:

Input	"items" applied to	valid
["2026-06-24T10:00:00Z", "created", "alice"]	(none)	true (no elements beyond index 2)
["2026-06-24T10:00:00Z", "created", "alice", "extra"]	"extra" (at index 3)	false by items applied to index 3
["2026-06-24T10:00:00Z", "created"]	(none)	true (not all prefixItems items need be applied)
["2026-06-24T10:00:00Z", 42]	(none)	false by type in prefixItems index 1
[]	(none)	true (no subschemas from either keyword applied)

As with our object properties example, using this schema (without items) via a reference requires using unevaluatedItems to get the same outcomes: This schema, when applied to the inputs in the table below, produces information from the prefixItems evaluation. Then, unevaluatedItems uses the prefixItems information to start where prefixItems left off, applying only to indices not covered by the prefixItems evaluation.

Input	length of successful "prefixItems" evaluations	"unevaluatedItems" applied	valid
["2026-06-24T10:00:00Z", "created", "alice"]	3	(none)	true (no elements beyond index 2)
["2026-06-24T10:00:00Z", "created", "alice", "extra"]	3	"extra" (at index 3)	false by unevaluatedItems applied to index 3
["2026-06-24T10:00:00Z", "created"]	1	(none)	true (no elements beyond index 1)
["2026-06-24T10:00:00Z", 42]	1	42 (at index 1)	false by both unevaluatedItems and type in prefixItems at index 1
[]	0	(none)	true (no subschemas from either keyword applied)

Note that in the fourth row, unevaluatedItems ends up applied to index 1, while items was not. The following table summarizes which keywords have static values on which adjacent keywords depend:

Keyword	Value Information	Depended on by
properties	set of property names	additionalProperties
patternProperties	set of property regular expressions	additionalProperties
prefixItems	length of value	items
minContains	minimum number of successful contains validations	contains
maxContains	maximum number of successful contains validations	contains

The following table summarizes which keywords, when successful, produce information on which other keywords depend:

Keyword	Information	Depended on by
properties	set of validated property names	unevaluatedProperties
patternProperties	set of validated property names	unevaluatedProperties
additionalProperties	all properties have been validated	unevaluatedProperties
unevaluatedProperties	all properties have been validated	unevaluatedProperties in parent schemas
prefixItems	validated prefix length	unevaluatedItems
items	all indices have been validated	unevaluatedItems
contains	validated indexes and/or index ranges	unevaluatedItems
unevaluatedItems	all indices have been validated	unevaluatedItems in parent schemas
if	subschema (not keyword) validation outcome	then, else

Note that certain keywords always validate all remaining properties or indices when successful, so there is no need for them to track individual locations.

Working with vocabularies

Best practices for vocabulary and meta-schema authors Vocabulary authors should take care to avoid keyword name collisions if the vocabulary is intended for broad use, and potentially combined with other vocabularies. JSON Schema does not provide any formal namespacing system, but also does not constrain keyword names, allowing for any number of namespacing approaches. Vocabularies may build on each other, such as by defining the behavior of their keywords with respect to the behavior of keywords from another vocabulary, or by using a keyword from another vocabulary with a restricted or expanded set of acceptable values. Not all such vocabulary re-use will result in a new vocabulary that is compatible with the vocabulary on which it is built. Vocabulary authors should clearly document what level of compatibility, if any, is expected. Meta-schema authors should not use "$vocabulary" to combine multiple vocabularies that define conflicting syntax or semantics for the same keyword. As semantic conflicts are not generally detectable through schema validation, implementations are not expected to detect such conflicts. If conflicting vocabularies are declared, the resulting behavior is undefined. Vocabulary authors SHOULD provide a meta-schema that validates the expected usage of the vocabulary's keywords on their own. Such meta-schemas SHOULD not forbid additional keywords, and MUST not forbid any keywords from the Core vocabulary. It is recommended that meta-schema authors reference each vocabulary's meta-schema using the "allOf" keyword, although other mechanisms for constructing the meta-schema may be appropriate for certain use cases. The recursive nature of meta-schemas makes the "$dynamicAnchor" and "$dynamicRef" keywords particularly useful for extending existing meta-schemas, as can be seen in the JSON Hyper-Schema () meta-schema which extends the Validation meta-schema. Meta-schemas may impose additional constraints, including describing keywords not present in any vocabulary, beyond what the meta-schemas associated with the declared vocabularies describe. This allows for restricting usage to a subset of a vocabulary, and for validating locally defined keywords not intended for re-use. However, meta-schemas should not contradict any vocabularies that they declare, such as by requiring a different JSON type than the vocabulary expects. The resulting behavior is undefined. Meta-schemas intended for local use, with no need to test for vocabulary support in arbitrary implementations, can safely omit "$vocabulary" entirely.

Example meta-schema with vocabulary declarations This meta-schema explicitly declares both the Core and Applicator vocabularies, together with an extension vocabulary, and combines their meta-schemas with an "allOf". The extension vocabulary's meta-schema, which describes only the keywords in that vocabulary, is shown after the main example meta-schema. The main example meta-schema also restricts the usage of the Unevaluated vocabulary by forbidding the keywords prefixed with "unevaluated", which are particularly complex to implement. This does not change the semantics or set of keywords defined by the other vocabularies. It just ensures that schemas using this meta-schema that attempt to use the keywords prefixed with "unevaluated" will fail validation against this meta-schema. Finally, this meta-schema describes the syntax of a keyword, "localKeyword", that is not part of any vocabulary. Presumably, the implementors and users of this meta-schema will understand the semantics of "localKeyword". JSON Schema does not define any mechanism for expressing keyword semantics outside of vocabularies, making them unsuitable for use except in a specific environment in which they are understood. This meta-schema combines several vocabularies for general use. This meta-schema describes only a single extension vocabulary. As shown above, even though each of the single-vocabulary meta-schemas referenced in the general-use meta-schema's "allOf" declares its corresponding vocabulary, this new meta-schema must re-declare them. The standard meta-schemas that combine all vocabularies defined by the Core and Validation specification, and that combine all vocabularies defined by those specifications as well as the Hyper-Schema specification (), demonstrate additional complex combinations. These URIs for these meta-schemas may be found in the Validation and Hyper-Schema specifications, respectively. While the general-use meta-schema can validate the syntax of "minDate", it is the vocabulary that defines the logic behind the semantic meaning of "minDate". Without an understanding of the semantics (in this example, that the input value must be a date equal to or after the date provided as the keyword's value in the schema), an implementation can only validate the syntactic usage. In this case, that means validating that it is a date-formatted string (using "pattern" to ensure that it is validated even when "format" functions purely as an annotation, as explained in ).

References and generative use cases While the presence of references is expected to be transparent to validation results, generative use cases such as code generators and UI renderers often consider references to be semantically significant. To make such use case-specific semantics explicit, the best practice is to create an annotation keyword for use in the same schema object alongside of a reference keyword such as "$ref". For example, here is a hypothetical keyword for determining whether a code generator should consider the reference target to be a distinct class, and how those classes are related. Note that this example is solely for illustrative purposes, and is not intended to propose a functional code generation keyword. Here, this schema represents some sort of object-oriented class. The first reference in the "allOf" is noted as the base class. The second is not assigned a class relationship, meaning that the code generator should combine the target's definition with this one as if no reference were involved. Looking at the properties, "foo" is flagged as object composition, while the "date" property is not. It is simply a field with sub-fields, rather than an instance of a distinct class. This style of usage requires the annotation to be in the same object as the reference, which must be recognizable as a reference.

Acknowledgments This draft is based on great amounts of superb work by creators and contributors to JSON Schema. The authors of the 2020-12 spec include Ben Hutton and Greg Dennis. Thanks also to Jason Desrosiers. Past contributors include, with thanks: Gary Court, Francis Galiegue, Kris Zyp, Geraint Luff Daniel Perrett, Erik Wilde, Evgeny Poberezkin, Brad Bowman, Gowry Sankar, Donald Pipowitch, Dave Finlay, Denis Laxalde, Phil Sturgeon, Shawn Silverman, and Karen Etheridge.

Change Log This section to be removed before leaving Internet-Draft status.

draft-ietf-jsonschema-json-schema-03

• Define and use "JSON text" and "JSON value" better.
• Add examples for the rest of keywords unless they're very similar to an existing example.
• Simplify the annotation model while keeping it functionally the same. Moved implementation advice regarding annotations to a more clearly optional appendix.
• Make vocabulary sections more obvious & consistently named.
• Simplify language around how a keyword should "validate" or "accept" input.

draft-ietf-jsonschema-json-schema-02

• Add a section near the front of the document explaining what sections are written for distinct readers
• Add examples for keywords up to the end of section 6 (up to "unevaluatedProperties")
• Move annotation implementation suggestions out of the normative core text and into an informative appendix, simplifying the main text for readers who are not implementing

draft-ietf-jsonschema-json-schema-01

• Clarify terminology by using JSON Text when talking about serialized JSON, and structured document when talking about what a schema operates on.
• Add examples for $anchor, $ref, $defs, $comment, allOf, if and then

draft-ietf-jsonschema-json-schema-00 Compared to the "2020-12" version of JSON Schema, this draft makes the following changes.

• Consolidate the 2020-12 core and validation documents
• Delevel headers for a more readable Table of Contents
• Shift terminology to a terminology section
• Reorder conceptually: intro, keywords, processing and output, extensibility.
• Define input and instance as different things.