OpenAPI request and response validation for JavaScript and TypeScript. One validation call covers the HTTP frame (method, path, parameters, body, content type, status, headers) against OpenAPI 3.0, 3.1, and 3.2 documents, with structured errors and no framework lock-in.
import{createValidator}from"@oaverify/core";constvalidator=createValidator(document);// your parsed OpenAPI specconstresult=validator.validateRequest({method: "POST",path: "/pets",contentType: "application/json",body: {name: "Fido"},});if(!result.valid)console.log(result.errors);// [{ code: "required", path: ["body", "age"], message: "...", params: {}}]Everything is developed in the oaverify/oaverify monorepo and ships as seven packages:
| Package | What it is |
|---|---|
@oaverify/core | The library: createValidator, the schema compiler, the spec loader, overlays. Zero runtime dependencies. |
oaverify | The CLI: check (spec quality, CI gates, SARIF), validate (payloads), compile-spec (standalone validators for edge/serverless), stream-check (buffer budgets). |
@oaverify/yaml | YAML readers for specs on disk or over HTTP. |
@oaverify/stream | Streaming validation of large JSON bodies, plus the design-time buffer-budget analyzer. |
@oaverify/express4 / @oaverify/express5 | Express request-validation middleware. |
@oaverify/fastify | Fastify preValidation hook. |
Where to start:
- The main README: install matrix, quick starts, bundle cost, how it compares.
- Integration guide: Express, Fastify, Next.js, Hono, Bun, Deno, and cross-cutting recipes.
- Overlays: patch a spec you don't own before validating against it.
- Comparison: how it relates to Ajv, express-openapi-validator, Spectral, and Redocly.
Tested against the JSON Schema 2020-12 test suite, OpenAPI 3.0 / 3.1 / 3.2 fixtures, and real-world specs (Stripe, GitHub, Twilio, and more). MIT licensed.