AVAILABLE

Developer Tools

Safe XML Parse & Canonicalize

Inspect, parse, select, canonicalize, and compare bounded XML with DTD/entity rejection, namespace-aware ordered output, and no external resolution or payload storage.

Get an API key on RapidAPIOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/xml/inspect
MCP tool
inspect_xml_safety
Inputs
Up to 256 KiB of supplied XML for inspection, ordered parsing, exact structured selection, or canonicalization; comparison accepts two documents with a 384 KiB combined limit.
Returns
CLEAR, REVIEW_REQUIRED, or BLOCKED with safe construct evidence and limits; a namespace-aware ordered XML tree; exact root-to-child matches; or deterministic ElementTree C14N 2.0 output and SHA-256 comparison hashes.
Latency
Synchronous
Usage unit
XML operation

The focused suite also exposes /v1/xml/parse, /v1/xml/select, /v1/xml/canonicalize, and /v1/xml/compare plus the separate /mcp/xml server. DTD and entity declarations are rejected before parsing; no URL or file is resolved; caller-supplied XPath is never executed. The ordered-tree mapping preserves child order, attributes, text, and mixed-content tails instead of claiming one universal XML-to-JSON mapping. Canonical equality does not verify an XML signature or prove application-level semantic equivalence.

AGENT-READABLE EXCEPTIONS

XML_INPUT_TOO_LARGEXML_DTD_OR_ENTITY_REJECTEDXML_NOT_WELL_FORMEDXML_STRUCTURE_LIMIT_EXCEEDEDXML_OUTPUT_TOO_LARGEXML_CANONICALIZATION_FAILEDXML_COMPARISON_INPUT_TOO_LARGE
HTTP request
POST /v1/xml/compare
Authorization: Bearer apc_...
Content-Type: application/json

{
  "left_xml": "<order b=\"2\" a=\"1\"><item>x</item></order>",
  "right_xml": "<order a=\"1\" b=\"2\"><item>x</item></order>",
  "with_comments": false,
  "strip_text": false,
  "rewrite_prefixes": true
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/xml/compare' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "left_xml": "<order b=\"2\" a=\"1\"><item>x</item></order>",
  "right_xml": "<order a=\"1\" b=\"2\"><item>x</item></order>",
  "with_comments": false,
  "strip_text": false,
  "rewrite_prefixes": true
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "exact_equal": false,
  "canonical_equal": true,
  "left_source_sha256": "20ef...",
  "right_source_sha256": "4797...",
  "left_canonical_sha256": "a0ac...",
  "right_canonical_sha256": "a0ac...",
  "algorithm": "PYTHON_ELEMENTTREE_C14N2",
  "options": {
    "with_comments": false,
    "strip_text": false,
    "rewrite_prefixes": true
  },
  "ruleset_version": "2026-08-10",
  "next_action": "Treat the documents as canonically equal under the selected options; XML signature verification remains separate."
}
No external resolutionDTD and entity declarations are rejected before parsing; no URL or file is opened and XInclude remains inert evidence.
Structure preservedThe ordered tree keeps namespaces, sorted attributes, child order, element text, and mixed-content tails; structured selection never executes caller XPath.
Canonicalization boundaryCanonical hashes use explicit options but do not verify XML signatures or prove application-level semantic equivalence.

Use Safe XML Parse & Canonicalize through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPICompare marketplace controls →