JSON Key Name Policy Check

Audit exact own JSON object member names against a caller allowlist at every object; array indexes are not object-key violations.

Description

Audit exact own JSON object member names against a caller allowlist at every object; array indexes are not object-key violations.

A key-name policy can apply recursively to every object while arrays remain traversal containers.

When to use this tool

Audit exact own JSON object member names against a caller allowlist at every object; array indexes are not object-key violations.

Prepare the supplied documentJson, allowedKeys fields for this operation.
Compare the complete example with the representation used by your own input before carrying the result into another step.

How to use the tool and how it works

Enter documentJson, allowedKeys. Use the exact text syntax, units and index conventions explained below.
Run the tool. If input validation fails, correct the supplied fields before interpreting any result.
Read result.violations. Interpret false, null and empty lists using the distinctions below; they can be valid outputs.

Parse documentJson, visit all nodes and, for every object, report each key absent from allowedKeys with its containing object's JSON Pointer path.^[1]

Input field	Meaning and representation	Accepted input
documentJson	JSON text, entered as one text field. The decoded structure is illustrated below; it is not a separate file.	Text
allowedKeys	allowed keys.	At most 128 strings, each at most 128 UTF-16 code units

For the JSON text fields, the following decoded structures show the example records before they are serialized into input strings. Keep field names, list nesting and value types as shown.

json

[
  {
    "field": "documentJson",
    "decoded": {
      "a": {
        "b": 1
      }
    }
  }
]

Output field	Interpretation
result	Object containing the named outputs below.
result.violations	Source positions or records that fail the specific screen above; an empty list means no such violation.

json

{
  "input": {
    "documentJson": "{\"a\":{\"b\":1}}",
    "allowedKeys": [
      "a"
    ]
  },
  "output": {
    "result": {
      "violations": [
        {
          "objectPath": "/a",
          "key": "b"
        }
      ]
    }
  }
}

Limitations and assumptions

Names compare exactly and keys are not removed. The same allowed set applies at every depth; no required-key or value-type policy is inferred.
Every declared top-level field is required and unexpected fields are rejected. Numeric inputs must be finite; ordinary text fields are bounded to 8,192 UTF-16 code units, with tighter operation-specific limits where stated.
String lists have at most 128 entries of at most 128 code units; matrices have at most 128 rows and columns. Larger numeric lists and parsed JSON have separate bounded budgets. Nonfinite results and excessively large serialized outputs are rejected.
Indexes are zero-based and spans have an exclusive end unless explicitly stated otherwise. A valid false, null or empty-list result is distinct from malformed input.

Alternative or Complementary methods

Use a full schema validator when several shape, type and value constraints must work together. These tools apply the one declared presence, name, length or leaf policy and return explicit evidence of its scope.

References

Tool behavior and example: JSON Key Name Policy Check — tool.io

Similar or alternative tools

JSON All Or None Key Presence Check
Check all-or-none own member presence for an explicit key group; absent versus null is preserved.
JSON Array Length Policy Check
Audit all JSON array lengths against inclusive bounds; no inferred schema or scalar-array coercion.