Validate XML against XSD

Overview

You send one XML document and the XSD schemas it should satisfy, and we validate it in a locked-down parser: no DTDs, no external entities, no fetching a schema from the network or the filesystem. An include or import inside your schemas resolves only to another schema you supplied, matched by the logical id you gave it, and anything else is refused rather than fetched. Problems come back with the line and column where they were found, so you can point straight at the offending element.

An ordinary XML validator will happily follow a reference in a hostile document and read a local file or call an internal service on the attacker's behalf. You get the same conformance answer from a parser that cannot leave the document you sent.

When to use it

Scope

Non-goals

• We never validate against a DTD, only against XSD
• We never transform the document; there is no XSLT here
• We never fetch a schema from the network or the filesystem
• We never repair the XML or work out a schema for you

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

File limits

Constraints this skill applies to your input and generated files. The “Limited by” column shows the static source of each cap; none of these can be raised by upgrading your plan.

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"schema.validate_xml_xsd","input":{"xmlSource":{"type":"inline","content":"<a/>"},"schemas":[{"id":"root.xsd","source":{"type":"inline","content":"<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\"><xs:element name=\"a\"/></xs:schema>"}}]}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("schema.validate_xml_xsd", {"xmlSource":{"type":"inline","content":"<a/>"},"schemas":[{"id":"root.xsd","source":{"type":"inline","content":"<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:element name='a'/></xs:schema>"}}]});

Errors

Other limits

Limitations

• We never validate against a DTD, only against XSD
• We never transform the document; there is no XSLT here
• We never fetch a schema from the network or the filesystem
• We never repair the XML or work out a schema for you
• Documents whose contract is a DTD rather than an XSD
• Transforming or rewriting XML rather than checking it

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "schema.validate_xml_xsd",
  "input": {
    "xmlSource": {
      "type": "inline",
      "content": "<a/>"
    },
    "schemas": [
      {
        "id": "root.xsd",
        "source": {
          "type": "inline",
          "content": "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:element name='a'/></xs:schema>"
        }
      }
    ]
  }
}

Examples

{
  "xmlSource": {
    "type": "inline",
    "content": "<a/>"
  },
  "schemas": [
    {
      "id": "root.xsd",
      "source": {
        "type": "inline",
        "content": "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:element name='a'/></xs:schema>"
      }
    }
  ]
}

{
  "document": {
    "rootElement": "a",
    "namespace": null
  },
  "_meta": {
    "validatorProfile": "offline-xsd-1",
    "xmlBytes": 4,
    "schemaBytes": 89
  },
  "errors": [],
  "valid": true,
  "schemas": {
    "rootSchemaId": null,
    "supplied": 1,
    "resolvedIncludes": []
  },
  "warnings": []
}

{
  "rootSchemaId": "root.xsd",
  "xmlSource": {
    "type": "inline",
    "content": "<note><wrong>x</wrong></note>"
  },
  "schemas": [
    {
      "id": "root.xsd",
      "source": {
        "type": "inline",
        "content": "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:element name='note'><xs:complexType><xs:sequence><xs:element name='to' type='xs:string'/></xs:sequence></xs:complexType></xs:element></xs:schema>"
      }
    }
  ]
}

{
  "document": {
    "rootElement": "note",
    "namespace": null
  },
  "_meta": {
    "validatorProfile": "offline-xsd-1",
    "xmlBytes": 29,
    "schemaBytes": 204
  },
  "errors": [
    {
      "code": "SCHEMA_VALIDATION_ERROR",
      "message": "cvc-complex-type.2.4.a: Invalid content was found starting with element 'wrong'. One of '{to}' is expected.",
      "path": null,
      "line": null,
      "column": null,
      "severity": "error",
      "details": {}
    }
  ],
  "valid": false,
  "schemas": {
    "rootSchemaId": "root.xsd",
    "supplied": 1,
    "resolvedIncludes": []
  },
  "warnings": []
}

Recommended use cases

• Check an incoming invoice or EDI document against its published XSD
• Hold a partner integration to its XML contract before you process the file
• Confirm a document is both well-formed and schema-conformant in one pass

Avoid for

• Documents whose contract is a DTD rather than an XSD
• Transforming or rewriting XML rather than checking it

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags