ValidateThis

API and response validators

Use these when the failure is in the payload or HTTP envelope you already have: SOAP Fault vs Body, webhook JSON, JWT exp/nbf, or a GraphQL query that will not parse. They do not replace a full REST client for status codes and latency — see the /api section for webhook tester and live GET checks.

Signature and replay tools check HMAC-style headers and timestamp windows. CORS preflight, Link, ETag, and Content-Type helpers inspect headers, not business logic. OpenAPI and GraphQL linters are syntax/structure only, not full spec conformance.

Response & webhook bodies(3)

API Response CheckerValidate API response body as JSON. Paste raw HTTP response or JSON only; get line/column errors.Webhook Payload ValidatorValidate webhook payload: valid JSON and optional required top-level keys.OpenAI Response Format CheckerHeuristics for OpenAI-style JSON envelopes (choices, error).

SOAP(1)

SOAP Response ValidatorValidate SOAP response: well-formed XML and valid Envelope with Body or Fault. Paste raw HTTP or SOAP XML.

Auth, signatures & replay(3)

Signature CheckerVerify HMAC signature (SHA-256 or SHA-1) of a payload against a secret.Replay TesterCheck if a timestamp is within an allowed time window (replay protection).JWT Claims InspectorDecode JWT header and payload (JWS). exp/nbf hints. Signature not verified.

HTTP mechanics(6)

CORS Preflight CheckerReview OPTIONS CORS headers against Origin and method — Allow-Origin, credentials, methods.HTTP Response Headers LintHeuristic lint for pasted response headers: caching, HSTS, MIME hints, duplicates.HTTP Link Header ParserParse Link header values: URLs in angle brackets and rel/type/title parameters.ETag Format ValidatorValidate weak/strong ETag tokens and comma-separated If-None-Match style lists.Content-Type vs Body SniffCompare declared MIME type to a simple first-bytes sniff of JSON, HTML, XML, or YAML.Multipart Boundary CheckerConfirm multipart boundary= matches dash delimiters in the raw body.

OpenAPI & GraphQL(2)

OpenAPI Snippet LintStructural checks on OpenAPI 3 or Swagger 2 YAML/JSON fragments.GraphQL Query Syntax LintParse GraphQL queries or SDL with the official graphql parser.

FAQ

JSON from curl still fails here?
Strip the HTTP status line and headers, or use API Response Checker which splits on the blank line then validates JSON. Non-JSON APIs will always fail this path — use SOAP or XML tools instead.
Does JWT Claims Inspector verify signatures?
It decodes header and payload and checks exp/nbf/iat. It does not verify JWS with a key. Use that for debugging claims, not for auth decisions.

Other validator groups