🦋 express-openapi-validator

An OpenApi validator for ExpressJS that automatically validates API requests and responses using an OpenAPI 3 specification.

🦋express-openapi-validator is an unopinionated library that integrates with new and existing API applications. express-openapi-validator lets you write code the way you want; it does not impose any coding convention or project layout. Simply, install the validator onto your express app, point it to your OpenAPI 3.0.x or 3.1.x specification, then define and implement routes the way you prefer. See an example.

Features:

• ✔️ request validation
• ✔️ response validation (json only)
• 👮 security validation / custom security functions
• 👽 3rd party / custom formats / custom data serialization-deserialization
• 🧵 optionally auto-map OpenAPI endpoints to Express handler functions
• ✂️ $ref support; split specs over multiple files
• 🎈 file upload
• ✏️ OpenAPI 3.0.x and 3.1.x spec support

Express 5 support is in progress--a subset of functionality is working. Try it out and provide feedback!

Express 5 support: (5 tests fail, 438 pass). Please contribute fixes to the express-5-support branch.

Docs:

• 📖 documentation

NestJS Koa and Fastify now available! 🚀 OAS 3.1 (beta) is available in >=v5.4.0!

Install

npm install express-openapi-validator

# for v6.0.0-alpha (for express-5 support)
npm install express-openapi-validator@alpha

Usage

1. Require/import the openapi validator

const OpenApiValidator = require('express-openapi-validator');

or

import * as OpenApiValidator from 'express-openapi-validator';

2. Install the middleware

app.use(
  OpenApiValidator.middleware({
    apiSpec: './openapi.yaml',
    validateRequests: true, // (default)
    validateResponses: true, // false by default
  }),
);

3. Register an error handler

app.use((err, req, res, next) => {
  // format error
  res.status(err.status || 500).json({
    message: err.message,
    errors: err.errors,
  });
});

Important: Ensure express is configured with all relevant body parsers. Body parser middleware functions must be specified prior to any validated routes. See an example.

Documentation

See the doc for complete documenation

deprecated legacy doc

License

MIT