Gate merges in CI
Validate the SSPs, profiles, and component definitions in your repository on every pull request. Branch on the valid field and jump straight to each issue via its RFC 6901 JSON Pointer.
POST an OSCAL 1.2.2 JSON document and get a machine-readable validation report from the same engine as the browser validator, built for CI pipelines, agents, and integrations. No account required.
Processed transiently, stored never. Your document is validated in memory on EU servers (Frankfurt) and discarded with the response. Secani does not persist, log, or reuse its contents; telemetry is aggregate only.
curl -sS -X POST https://secani.com/api/oscal/v1/validate \
-H "content-type: application/json" \
--data-binary @system-security-plan.jsonLarge artifacts compress extremely well, so send them gzipped to stay under the 4 MB wire limit:
gzip -c catalog.json | curl -sS -X POST https://secani.com/api/oscal/v1/validate \
-H "content-type: application/json" \
-H "content-encoding: gzip" \
--data-binary @-Validate the SSPs, profiles, and component definitions in your repository on every pull request. Branch on the valid field and jump straight to each issue via its RFC 6901 JSON Pointer.
Agents that generate or edit OSCAL can validate in a loop: produce a document, read the pointer-precise issues, patch, and re-validate, with no human in the repair cycle.
CORS is open, so internal web tools can POST documents directly from the browser, for example checking a partner's delivered component definition before accepting it.
POST raw OSCAL 1.2.2 JSON, no envelope, no account. All eight models are detected from the root key. A completed validation always returns HTTP 200; invalid documents report valid: false.
Up to 4 MB raw and 24 MB decompressed with gzip request bodies. The full NIST SP 800-53 catalog validates in well under 100 milliseconds.
Up to 200 issues with exact totals, stable RFC 9457 error codes, RateLimit headers, and an OpenAPI 3.1 contract for client generation.
10 requests per minute and 300 per day per client, surfaced through RateLimit response headers. API keys with higher, durable limits are planned; the anonymous tier stays.
Today the API runs strict OSCAL 1.2.2 JSON Schema validation with a documented profile compatibility patch. The contract reserves a deeper validation level with constraint and reference checks on top of Secani’s extended validation registry; responses will name exactly what was checked, so a stored report becomes a reproducible attestation.
The browser validator runs the same checks entirely locally; your document never leaves the browser there.