Gate merges in CI
Validate the SSPs, profiles, and component definitions in your repository on every pull request. Branch on the valid field and jump straight to each issue via its RFC 6901 JSON Pointer.
OSCAL Validation API
POST an OSCAL 1.2.2 JSON document and get a machine-readable validation report from the same engine as the browser validator, built for CI pipelines, agents, and integrations. No account required.
Processed transiently, stored never. Your document is validated in memory on EU servers (Frankfurt) and discarded with the response. Secani does not persist, log, or reuse its contents; telemetry is aggregate only.
curl -sS -X POST https://secani.com/api/oscal/v1/validate \
-H "content-type: application/json" \
--data-binary @system-security-plan.jsonLarge artifacts compress extremely well, so send them gzipped to stay under the 4 MB wire limit:
gzip -c catalog.json | curl -sS -X POST https://secani.com/api/oscal/v1/validate \
-H "content-type: application/json" \
-H "content-encoding: gzip" \
--data-binary @-What teams build with it
Self-correcting AI agents
Agents that generate or edit OSCAL can validate in a loop: produce a document, read the pointer-precise issues, patch, and re-validate, with no human in the repair cycle.
Browser tools without a backend
CORS is open, so internal web tools can POST documents directly from the browser, for example checking a partner's delivered component definition before accepting it.
How the v1 contract works
The document is the request
POST raw OSCAL 1.2.2 JSON, no envelope, no account. All eight models are detected from the root key. A completed validation always returns HTTP 200; invalid documents report valid: false.
Large documents welcome
Up to 4 MB raw and 24 MB decompressed with gzip request bodies. The full NIST SP 800-53 catalog validates in well under 100 milliseconds.
Machine-readable everything
Up to 200 issues with exact totals, stable RFC 9457 error codes, RateLimit headers, and an OpenAPI 3.1 contract for client generation.
Fair anonymous limits
10 requests per minute and 300 per day per client, surfaced through RateLimit response headers. API keys with higher, durable limits are planned; the anonymous tier stays.
Today the API runs strict OSCAL 1.2.2 JSON Schema validation with a documented profile compatibility patch. The contract reserves a deeper validation level with constraint and reference checks on top of Secani’s extended validation registry; responses will name exactly what was checked, so a stored report becomes a reproducible attestation.
Prefer to validate by hand?
The browser validator runs the same checks entirely locally; your document never leaves the browser there.