Payload Validator

Tools

• validate_json

  Validate JSON

  Validates a JSON document and reports every problem in one pass with a 1-based line and column, a stable rule code and a fix hint. Reports the three things JSON.parse cannot: duplicate keys (accepted by every parser, which then disagree about which value wins), integer precision loss past 2^53-1 proved with exact BigInt arithmetic (any 64-bit ID is in the lossy range), and unpaired surrogates that parse here and fail on re-serialisation. Also trailing commas, comments, single quotes, unquoted keys, Python literals, leading zeros, hex numbers, raw control characters, byte order marks, and NDJSON being read as one document. Returns valid and parseable separately, because a duplicate key is parseable and still ambiguous.

  Direct endpoint: https://payload-validator.gumballtools.com/api/v1/validate?format=json

• validate_yaml

  Validate YAML

  Validates a YAML document, including the values that mean different things to different loaders — found by resolving each unquoted scalar under both spec versions and comparing, not by matching a list of words. In YAML 1.1 (PyYAML) the bare words no/yes/on/off/y/n are booleans, so a country list loses Norway and the "on:" key of every GitHub Actions workflow is really the key true; 0755 is 493 under 1.1 and 755 under 1.2, both numbers so nothing looks wrong; 1:30 is the base-60 integer 90. Also duplicate keys, tabs used as indentation, non-breaking spaces mistaken for indentation, aliases with no anchor, merge keys, multi-document streams, and alias bombs. Quoted values are never flagged.

  Direct endpoint: https://payload-validator.gumballtools.com/api/v1/validate?format=yaml

• validate_xml

  Validate XML

  Validates XML for well-formedness, namespace correctness and entity-based attacks. Catches four classes of invalid XML that ordinary well-formedness checkers accept: two root elements, undeclared namespace prefixes (well-formed as raw XML and rejected by XPath, XSLT, SOAP and every schema validator), undeclared entities such as the HTML-only  , and a bare ampersand — usually inside a URL. Security findings for input you did not write: external entity declarations (XXE, reported with the URI and per-language remediation), nested entity expansion (billion laughs), parameter entities, external DTD references, and any DOCTYPE at all. Nothing is ever resolved or fetched — that is the vulnerability, not a gap.

  Direct endpoint: https://payload-validator.gumballtools.com/api/v1/validate?format=xml

• validate_csv

  Validate CSV

  Validates CSV against RFC 4180 and reports ragged rows individually with both field counts, because "row 4813 has 6 fields, the header has 5" is the entire answer. A ragged row loads without complaint almost everywhere — pandas pads or throws by engine, Excel shifts the columns, split(",") mis-assigns every field after the extra one — so nobody notices until a figure is wrong. Sniffs the delimiter from the header ignoring quoted regions, and always reports it, because a semicolon-separated European export read as comma-separated yields one column and no error. Also unterminated quotes, duplicate and unnamed and space-padded column names, mixed line endings, and a byte order mark that makes the first column impossible to look up by name.

  Direct endpoint: https://payload-validator.gumballtools.com/api/v1/validate?format=csv

• validate_auto

  Detect the format and validate

  Detects whether a payload is JSON, YAML, XML or CSV, then validates it. Use it for a file with no extension, a clipboard paste, or a response body with an unhelpful content type. Detection is structural and the reason is always returned, so the assumption is visible: a leading "<" is XML, "{" or "[" is JSON, a %YAML directive or key: value lines are YAML, a consistent delimiter count across lines is CSV. JSON is checked before YAML deliberately, since JSON is a strict subset of YAML 1.2. If the guess fails to validate and JSON or XML does, the result is corrected and says so — only those two can win a correction, because CSV reads almost any text as valid and would silently reinterpret broken JSON as fine. Prefer the format-specific tool when you know the format.

  Direct endpoint: https://payload-validator.gumballtools.com/api/v1/validate?format=auto