Skip to content
Sarj Sarj Sarj Standards

prefer-schema-for-api-payload

Require Zod (or similar) schema validation on response.json() / JSON.parse() results before property access.

unparsedJsonAccess Rule source Tests Catalog JSON

Why

External JSON is untrusted at runtime even when its expected TypeScript shape is known statically.

Fix

For external payloads, parse through a schema or establish runtime validation before reading fields. Review validator implementations separately rather than recursively requiring another schema.

Examples

Before — flagged Do not trust response JSON directly
src/client.ts
async function load(response: Response) {
  const body = await response.json();
  return body.id;
}
After — preferred Validate before property access
src/client.ts
async function load(response: Response) {
  const body = UserSchema.parse(await response.json());
  return body.id;
}