JSON Validation policy

Updated 22 July 2026

The JSON Validation policy validates JSON payloads. It uses the JSON Schema Validator library, returning 400 BAD REQUEST when request validation fails and 500 INTERNAL ERROR when response validation fails, each with a custom error message body.

Timing

On Request	On Response	On Request Content	On Response Content
		X	X

Configuration

Property	Required	Description	Type	Default
scope	yes	Policy scope from which the policy executes. REQUEST_CONTENT and RESPONSE_CONTENT	policy scope	REQUEST_CONTENT
errorMessage	yes	Custom error message in JSON format. You can use Spel.	string	{"error":"Bad request"}
schema	yes	JSON schema.	string
deepCheck	no	Validates descendant even if the JSON parent container is invalid.	boolean	false
validateUnchecked	no	Unchecked validation means that conditions which would normally cause the processing to stop with an exception are instead inserted into the resulting report. Caution: This setting masks anomalous events such as unresolvable JSON Reference or an invalid schema.	boolean	false
straightRespondMode	no	Only for RESPONSE scope. If set to true, responses that fail to validate are sent to the user without replacement.	boolean	false

HTTP status Code

Code	Message
400 (request scope) and 500 (response scope)	In case of: Invalid payload Invalid JSON schema Invalid error message JSON format

Example

{
  "scope": "REQUEST_CONTENT",
  "errorMessage": "Any custom error message",
  "schema": "{\"$schema\": \"https://json-schema.org/draft-04/schema#\\",   \"type\": \"object\", \"properties\": { \"value1\": {\"type\": \"string\" },     \"value2\": {       \"type\": \"string\"}},  \"required\": [\"value1\", \"value2\"]}",
  "deepCheck": false,
  "validateUnchecked": false,
  "straightRespondMode": false
}