---
title: "JSON Schema"
description: "3 posts about JSON Schema, summarised, each linking to the original."
---

# JSON Schema
> 3 posts about JSON Schema, summarised, each linking to the original.

## Articles

### [Saved by the Schema: Using JSON Schema to Document, Test, and Debug APIs](https://yomu.fyi/post/saved-by-the-schema-using-json-schema-to-document-test-and-debug-apis.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Jessie Young
- Published: Apr 9, 2019
- Type: Problem & solution

Heroku uses JSON Schema to define Platform API response structures, generate documentation, and validate endpoint behavior. A CI-invoked rake task detects schema changes and uses prmd to generate Markdown API reference material, while committee tests API responses with assert\_schema\_conform. Those tests exposed an edge case in Enterprise usage data: dyno values with many decimal places were parsed by Oj as BigDecimal and serialized as quoted strings, whereas integer and ordinary float values remained numbers. Heroku traced this behavior through MultiJson and configured Oj with bigdecimal\_load: :float, because the endpoint had sufficient precision at 15 decimal places and its schema required a number. The conforming test then passed, confirming that the schema and generated documentation matched returned API values.


### [Ten Ways to Secure your Applications](https://yomu.fyi/post/ten-ways-to-secure-your-applications.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Joe Kutner
- Published: Feb 21, 2019
- Type: Explainer

The post, adapted from Joe Kutner’s Devoxx 2018 talk, presents ten ways to strengthen web application security, with examples focused on Java but applicable to modern languages. It recommends keeping dependencies current, validating explicit payloads with schemas, checking regular expressions for ReDoS, throttling abusive requests, and keeping credentials outside the codebase. It also advises secure-first coding, certificate validation for outgoing connections, logging security-relevant actions without recording secrets, and monitoring suspicious behavior with tools such as AppSensor. The examples include Maven Versions Plugin, Snyk, Bucket4j, saferegex, environment variables, and EnvKeyStore, with a token-bucket algorithm proposed for request throttling. The conclusion is that security requires anticipating unintended functionality across network, platform, and physical domains, while these practices provide a starting point.


### [Introducing the Heroku HTTP API Toolkit](https://yomu.fyi/post/introducing-the-heroku-http-api-toolkit.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Wesley Beary
- Published: May 15, 2014
- Type: Announcement

Heroku is open sourcing the toolchain it uses to design, document, and consume HTTP APIs, covering a design guide, JSON Schema tooling, and generated Ruby and Go clients. The guide addresses versioning, resource structure, naming, serialization, errors, request IDs, pagination, and caching, while prmd can bootstrap schemas, verify completeness, and generate documentation. JSON Schemas also drive client generation through Heroics for Ruby and Schematic for Go, with examples showing access to the Heroku Platform API and generation from its schema. Heroku says the toolkit supports both user-facing and internal services, where shared schemas and generated documentation provide a common language for proposing APIs or changes and help align design practices.