Generate invalid request bodies from schemas
Missing rejection tests? Generate invalid payloads for supported schema rules and inspect each failing constraint.
Missing rejection tests? Generate invalid payloads for supported schema rules and inspect each failing constraint. Check locally in your browser. No upload. Jump to: What does it mean?, How to fix it, Break it, Ask your agent.
Example A synthetic order schema requires a short name and a quantity between one and five.
24 invalid payloads generated.
A bounded subset of JSON Schema is supported; unknown validation keywords are refused. Generated failures do not test authorization or application business rules.
The schema and payloads stay in your browser. Cases are generated and validated here and never uploaded.
Nothing is sent to our server. This tool has no server step.
Findings
Info Bounded schema subset
Unsupported validation keywords are refused. No requests are sent. Cases test structural validation, not authorization, business rules or server behavior.
Pass 24 invalid payloads generated
Each emitted case failed at least one supported rule; all detected violations are listed. Several rules may fail in one case.
Evidence
| Selected schema | JSON Schema | |
|---|---|---|
| Valid starting payload | ||
| name | aa | |
| quantity | 1 | |
Invalid payloads
Payload null
Violations $: type Payload false
Violations $: type Payload 0
Violations $: type Payload ""
Violations $: type Payload []
Violations $: type Payload None Violations $: required name $: required quantity Payload quantity 1 Violations $: required name Payload name aa Violations $: required quantity Show all 24 invalid payloads
Payload name aa quantity 1 __unexpected true Violations $: additionalProperties __unexpected Payload name Not checked quantity 1 Violations $/name: type Payload name false quantity 1 Violations $/name: type Payload name 0 quantity 1 Violations $/name: type Payload name Not set quantity 1 Violations $/name: minLength Payload name None quantity 1 Violations $/name: type Payload name None quantity 1 Violations $/name: type Payload name a quantity 1 Violations $/name: minLength Payload name aaaaaaaaa quantity 1 Violations $/name: maxLength Payload name aa quantity Not checked Violations $/quantity: type Payload name aa quantity false Violations $/quantity: type Payload name aa quantity 0 Violations $/quantity: minimum Payload name aa quantity Not set Violations $/quantity: type Payload name aa quantity None Violations $/quantity: type Payload name aa quantity None Violations $/quantity: type Payload name aa quantity 6 Violations $/quantity: maximum
Invalid payload cases
Show the invalid payload cases
[
{
"name": "$: alternate type or value",
"payload": null,
"violations": [
"$: type"
]
},
{
"name": "$: alternate type or value",
"payload": false,
"violations": [
"$: type"
]
},
{
"name": "$: alternate type or value",
"payload": 0,
"violations": [
"$: type"
]
}
]Take it further
What this result means
Written for the example.
Ask for a review of the findings and a test that verifies the proposed fix. Input values are not included automatically.
A synthetic order schema requires a short name and a quantity between one and five.
A synthetic order schema requires a short name and a quantity between one and five.
Check representative input and one deliberate failure. Confirm the result in the application that consumes it.
Read the findings before changing the input. Break it lets you inspect a failure, and Heal it restores the previous input.
A bounded subset of JSON Schema is supported; unknown validation keywords are refused. Generated failures do not test authorization or application business rules.
How it works
Negative Payload Generator reads json schema or openapi json locally and presents findings with the evidence behind them. A synthetic order schema requires a short name and a quantity between one and five. The full method, every rule and worked examples are on docs.tamperbox.dev.
Limits and interpretation
A bounded subset of JSON Schema is supported; unknown validation keywords are refused. Generated failures do not test authorization or application business rules. Inputs are limited to 1,000,000 characters per field. Nothing is fetched from addresses embedded in input. Explicit copies and downloads are under your control.
Frequently asked questions
Is my input uploaded?
No. Parsing and output generation run in your browser. Source values are not sent to a server.
What does the opening example demonstrate?
A synthetic order schema requires a short name and a quantity between one and five. It is synthetic data. Replace it with your own input to inspect a different case.
Does a passing result prove my application works?
No. A bounded subset of JSON Schema is supported; unknown validation keywords are refused. Generated failures do not test authorization or application business rules. Verify the result in your test environment before relying on it.
References
Are you an AI agent? You are in the right place.
Read this tool as plain text with its methods and limits. Use the website interface; no dedicated MCP operation is available.