Enterprise grade OpenAPI validation tools for golang.

A validation module for libopenapi.

Document validation is explicitly covered for OpenAPI 3.0, 3.1, and 3.2.

libopenapi-validator will validate the following elements against an OpenAPI 3+ specification

• http.Request - Validates the request against the OpenAPI specification
• http.Response - Validates the response against the OpenAPI specification
• libopenapi.Document - Validates the OpenAPI document against the OpenAPI specification
• base.Schema - Validates a schema against a JSON or YAML blob / unmarshalled object

👉👉 Check out the full documentation 👈👈

Runtime validation features

The validator now includes a standalone OpenAPI router, authentication callbacks with route context and replayable bodies, immutable custom body codecs, opt-in request defaults, Parameter.content decoding, validation policy switches, and explicit OpenAPI 3.2 document validation.

Existing behavior remains the default. Strict server matching, non-JSON codecs, request mutation, and new rejection policies are opt-in:

v := validator.NewValidatorFromV3Model(&model.Model,
    config.WithStrictServerMatching(),
    config.WithStandardBodyDecoders(),
    config.WithRejectUnsupportedBodyContent(),
    config.WithRequestDefaults(),
)

Use router.NewRouter for routing without validation, WithBodyDecoder and WithBodyEncoder for proprietary formats, and WithAuthenticationFunc for application-owned security checks. See the complete validation guide for defaults, options, and examples.

---

Installation

go get github.com/pb33f/libopenapi-validator

Validate OpenAPI Document

go run github.com/pb33f/libopenapi-validator/cmd/validate@latest [--regexengine] [--yaml2json] <file>

Install pre-commit hook

To install the pre-commit hook, run the following command in your terminal:

pre-commit install

Options

--regexengine

🔍 Example: Use a custom regex engine/flag (e.g., ecmascript)

go run github.com/pb33f/libopenapi-validator/cmd/validate@latest --regexengine=ecmascript <file>

🔧 Supported --regexengine flags/values (ℹ️ Default: re2)

• none
• ignorecase
• multiline
• explicitcapture
• compiled
• singleline
• ignorepatternwhitespace
• righttoleft
• debug
• ecmascript
• re2
• unicode

--yaml2json

🔍 Convert YAML files to JSON before validation (ℹ️ Default: false)

libopenapi passes map[interface{}]interface{} structures for deeply nested objects or complex mappings in the OpenAPI specification, which are not allowed in JSON. These structures cannot be properly converted to JSON by libopenapi and cannot be validated by jsonschema, resulting in ambiguous errors.

This flag allows pre-converting from YAML to JSON to bypass this limitation of the libopenapi.

When does this happen?

• OpenAPI specs with deeply nested schema definitions
• Complex allOf, oneOf, or anyOf structures with multiple levels
• Specifications with intricate object mappings in examples or schema properties

Enabling this flag pre-converts the YAML document from YAML to JSON, ensuring a clean JSON structure before validation.

Example:

go run github.com/pb33f/libopenapi-validator/cmd/validate@latest --yaml2json <file>

Documentation

• The structure of the validator
  • Validation errors
  • Schema errors
  • High-level validation
• Validating http.Request
• Validating http.Request and http.Response
• Validating just http.Response
• Validating HTTP Parameters
• Validating an OpenAPI document
• Validating Schemas

libopenapi and libopenapi-validator are products of Princess Beef Heavy Industries, LLC