Docs · Validators

`url` validator

Accept anything the WHATWG URL parser accepts.

One of 19 validator types · pure compute, no AI cost

Reference

Format

Accepts any string that does not throw inside `new URL(value)`. A scheme is required — bare hostnames like `example.com` fail.

Examples

https://example.com/path?q=1
http://localhost:3000
mailto:alice@example.com (passes — any scheme)

How it runs

Implementation

A faithful summary of lib/validators.ts. Validators are pure functions and run identically in the Worker, the Workbench and the MCP server — one implementation, so the three cannot disagree about whether a value is valid.

lib/validators.ts

function validUrl(value) {
  try { new URL(value); return OK }
  catch { return fail('url_invalid', 'not a valid URL') }
}

Config

Use in a template

Validators attach to a field on a custom template. The cascade runs them after mapping but before commit; failures surface in the per-row validation report.

template.yaml

fields:
  - column: website
    type: string
    validators:
      - type: url

Watch out

Common gotchas

Any scheme passes — `mailto:`, `javascript:`, `file:`. If you only want `https`, add a regex validator alongside.
Bare hostnames (`example.com`) fail. Templates that accept those should pre-prepend `https://` in transform.
No SSRF protection. The validator does not block private IPs, link-local, or localhost. Use `lib/ssrfGuard.ts` separately for webhook URLs.
Opt-in `strict: true` runs the value through the shared SSRF guard: only `http:` / `https:` schemes, no loopback / RFC1918 / link-local / metadata-service hosts (169.254.169.254 et al.). Failures return `ssrf_blocked`. Add `require_https: true` to reject `http://` as well, returning `url_scheme`. Default behavior is unchanged.

Where it runs

Three routes, no AI cost.

POST/v1/validate-rowValidate one row against a template. Stateless, no key, pure compute — the fastest way to try url against a real value.no key
POST/v1/uploads/:id/validateRun every field validator over the parsed upload, without committing. Returns errors and warnings per row.read
POST/v1/uploads/:id/commitValidates on the way out. skip_invalid_rows drops the failures instead of failing the commit.commit

Validators are pure functions, so they add nothing to the AI bill. Every map draws a small flat per-map fee from your prepaid token wallet ($10 minimum, shared across the phi-cloud suite); only columns that reach the metered LLM layer, plus any-to-any convert and structural reshape, bill real AI tokens. See pricing

Catalogue

Related templates

Accountsaccounts_v1
Company-level CRM records: domain, industry, headcount, country, ARR band.
Fields · domain

Explore

All 19 validator types

The complete list a template field can declare. There is no SNOMED validator — it required an affiliate licence, no template used it, and it was removed in 2026.

Back to the documentation index or browse the template catalogue.

Ready when you are

Validate every row — before it lands.

Attach checksum-strict validators to any field, and gate risky commits behind the requires_hitl flag. One key runs the whole cascade.

Get an API key See pricing

Prepaid token wallet · schema-only data-minimization mode · no free tier

url validator