Validation · REST API

Input Validation API - Email, URL & Security Rules

Validate a string against configurable format, length and security rules through one REST endpoint without modifying the original input.

Free tier available. This endpoint requires a JWT Bearer Token.

Validation capabilities

Format checks

Check email, phone and URL formats, including additional email-domain rules.

Configurable rules

Combine required, length and regular-expression checks in one request.

Security checks

Detect potentially unsafe patterns with XSS and SQL injection checks.

Email and URL validation

Use the same endpoint with different rules to check email addresses and URLs. Email checks can also include disposable-domain and DNS-related rules.

Endpoint

POST /api/v1/data-protection/validate

Input: application/json · Output: application/json

Email request example

Input

{
  "input": "test@gmail.com",
  "rules": [
    "REQUIRED",
    "EMAIL",
    "NO_DISPOSABLE_EMAIL",
    "MX_EMAIL"
  ],
  "failFast": false
}

Output (when all rules pass)

{
  "valid": true,
  "errors": []
}

URL request example

{
  "input": "https://example.com",
  "rules": ["REQUIRED", "URL"],
  "failFast": false
}

EMAIL checks format; NO_DISPOSABLE_EMAIL checks known disposable domains; MX_EMAIL checks whether the domain is configured to receive email. These checks do not prove mailbox ownership.

Input and security validation

Combine required, length, regex and security rules to validate input without changing its value.

Security request example

Input

{
  "input": "<script>alert(1)</script>",
  "rules": ["REQUIRED", "NO_XSS"],
  "failFast": false
}

Example invalid response

{
  "valid": false,
  "errors": [
    {
      "rule": "NO_XSS",
      "message": "Potential XSS detected"
    }
  ]
}

Detection rules are an additional input check, not a substitute for contextual output encoding, parameterized queries or other application security controls.

Supported validation rules

Pass one or more rule strings in the rules array.

Available rules and their purpose
RulePurpose
REQUIREDReject null or empty input.
EMAILCheck email format.
NO_DISPOSABLE_EMAILCheck against known disposable email domains.
MX_EMAILCheck the domain's email-receiving DNS configuration.
PHONECheck phone number format.
URLCheck URL format.
MIN_LENGTH:nRequire a minimum length.
MAX_LENGTH:nEnforce a maximum length.
REGEX:patternApply a custom regular expression.
NO_XSSDetect potential XSS patterns.
NO_SQL_INJECTIONDetect potential SQL injection patterns.

Request fields

Validation request properties
FieldDescription
inputRaw string to validate.
rulesArray of rule strings to apply.
failFastBoolean; defaults to false. If true, stop at the first error.

A completed validation returns a valid boolean and an errors array. Each error includes rule and message. A failed validation can still return HTTP 200.

Input validation in Swagger

When to use this API

Form validation

Apply consistent format and length checks to form fields before processing.

Backend input checks

Reuse configurable checks across services and flag potentially unsafe input.

Explore more DevHub APIs

Browse the API catalog or consult the interactive reference for full request and response details.

loader