XML validation API & CLI

Choose local or server processing

The default browser engine checks XSD 1.0 locally. This API sends documents to XSDHub over HTTPS. Request content is not logged, and temporary files are removed after processing. Only submit files you are allowed to share. A request must explicitly contain "consent": true. Read the privacy policy.

Endpoint and request

POST https://xsdhub.com/api/validate
Content-Type: application/json

{
  "engine": "xsd11",
  "consent": true,
  "xml": "<quantity>2</quantity>",
  "xsd": "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'><xs:element name='quantity' type='xs:positiveInteger'/></xs:schema>"
}

Engines: xsd10, xsd11, schematron. For Schematron, send the rules as schematron instead of xsd. For an XSD project, send rootSchema and schemaFiles, an array of objects with path and content. All dependencies must be included. Validation does not fetch remote URLs. The workbench has a separate opt-in public HTTPS importer that produces a local snapshot.

Use the Python CLI

Download xsdhub-cli.py. It requires Python 3 and uses only its standard library. Read the short script before running it.

python3 xsdhub-cli.py order.xml \
  --schema schemas/main.xsd \
  --project-dir schemas \
  --engine xsd11 \
  --allow-upload \
  --output validation.json

Exit codes: 0 means validation passed; 1 means validation failed; 2 means a connection, input or service error. In CI, keep the JSON report as an artifact and fail the job on a nonzero exit code. The upload flag is required; no credentials are needed for this public early-access endpoint.

Ready-to-use CI workflow

Download the CI starter ZIP with the CLI, a GitHub Actions workflow and valid/invalid fixtures. Commit it to your repository, open Actions and run XML validation with upload consent enabled. Adapt the file paths before using your own documents. The workflow retains the JSON report for seven days and fails on validation or service errors. You can add a push trigger after deciding which documents may be uploaded.

Uses the official checkout and artifact actions. Inspect the workflow.

Limits and responses

• XML: up to 10 MB; each schema: 1 MB; schema project: up to 100 files and 10 MB total.
• 20 seconds per request, at most two concurrent server jobs, and 10 requests per minute per client address. Shared networks may share a rate limit.
• HTTP 200 contains ok, engine, stage, errors and warnings. A validation failure is ok: false, not a transport error.
• HTTP 429 means rate limited; 503 means busy; 422 means a timeout or resource failure. Never treat a service failure as a successful validation.
• At most 100 validation errors are returned. Line numbers or paths are shown when the engine supplies them.

Supported standards and boundaries

The server uses xmlschema 4.3.1 for XSD 1.0/1.1 and lxml 6.0.2 for ISO Schematron with XPath 1.0 / XSLT 1.0 binding. Schematron XPath 2.0/3.0 bindings, external includes and embedded XSLT are not accepted. DTDs and resource-reading XPath functions are disabled. Remote resources are never fetched implicitly during validation.

These are validation tools, not certification of compliance with a particular industry or legal standard. Test representative documents before depending on the service. For support, contact support@xsdhub.com.

Open-source components

The local engine uses libxml2-wasm; ZIP handling uses fflate. Server component source and license information: xmlschema, elementpath and lxml.