| RFC 9535 | JSONPath | February 2024 |
| Gössner, et al. | Standards Track | [Page] |
JSONPath defines a string syntax for selecting and extracting JSON (RFC 8259) values from within a given JSON value.¶
This is an Internet Standards Track document.¶
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc9535.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
JSON[RFC8259] is a popular representationformat for structured data values.JSONPath defines a string syntax for selecting and extracting JSON valuesfrom within a given JSON value.¶
In relation to JSON Pointer[RFC6901], JSONPath is not intended as a replacement but as a more powerfulcompanion. SeeAppendix C.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶
The grammatical rules in this document are to be interpreted as ABNF,as described in[RFC5234].ABNF terminal values in this document define Unicode scalar values rather thantheir UTF-8 encoding.For example, the Unicode PLACE OF INTEREST SIGN (U+2318) would be definedin ABNF as%x2318.¶
Functions are referred to using the function name followed by a pairof parentheses, as infname().¶
The terminology of[RFC8259] applies except where clarified below.The terms "primitive" and "structured" are used to groupdifferent kinds of values as inSection 1 of [RFC8259]. JSON objects and arrays arestructured; all other values are primitive.Definitions for "object", "array", "number", and "string" remainunchanged.Importantly, "object" and "array" in particular do not take on ageneric meaning, such as they would in a general programming context.¶
The terminology of[RFC9485] applies.¶
Additional terms used in this document are defined below.¶
As per[RFC8259], a data item conforming to the generic data model of JSON, i.e.,primitive data (numbers, text strings, and the specialvalues null, true, and false), or structured data (JSON objects and arrays).[RFC8259] focuses on the textual representation of JSON values anddoes not fully define the value abstraction assumed here.¶
A name/value pair in an object. (A member is not itself a value.)¶
The name (a string) in a name/value pair constituting a member.This is also used in[RFC8259], but that specification does notformally define it.It is included here for completeness.¶
A value in a JSON array.¶
An integer that identifies a specific element in an array.¶
Short name for a JSONPath expression.¶
Short name for the value a JSONPath expression is applied to.¶
The position of a value within the query argument. This can be thought ofas a sequence of names and indexes navigating to the value throughthe objects and arrays in the query argument, with the empty sequenceindicating the query argument itself.A location can be represented as a Normalized Path (defined below).¶
The pair of a value along with its location within the query argument.¶
The unique node whose value is the entire query argument.¶
The expression$, which refers to the root node of the query argument.¶
The expression@, which refers to the current node in the contextof the evaluation of a filter expression (described later).¶
If the node is an array, the nodes of its elements; if the node is an object, the nodes of its member values.If the node is neither an array nor an object, it has no children.¶
The children of the node, together with the children of its children, and so forthrecursively. More formally, the "descendants" relation between nodes is the transitiveclosure of the "children" relation.¶
The number of ancestors of the node within the value. The root node of the value has depth zero,the children of the root node have depth one, their children have depth two, and so forth.¶
A list of nodes.While a nodelist can be represented in JSON, e.g., as an array, this documentdoes not require or assume any particular representation.¶
Formal parameter (of a function) that can take a function argument(an actual parameter) in a function expression.¶
A form of JSONPath expression that identifies a node in a value byproviding a query that results in exactly that node. Each node in aquery argument is identified by exactly one Normalized Path (we say that theNormalized Path is "unique" for that node), and to be a NormalizedPath for a specific query argument, the Normalized Path needs to identifyexactly one node. This is similarto, but syntactically different from, a JSON Pointer[RFC6901].Note: This definition is based on the syntactical definition inSection 2.7;JSONPath expressions that identify a node in a value but do not conform to thatsyntax are not Normalized Paths.¶
Any Unicode[UNICODE] code point except high-surrogate and low-surrogate code points (in other words, integers in the inclusive base 16 ranges, either 0 to D7FF orE000 to 10FFFF). JSONPath queries are sequences of Unicode scalar values.¶
One of the constructs that selects children ([<selectors>])or descendants (..[<selectors>]) of an input value.¶
A single item within a segment that takes the input value and produces a nodelistconsisting of child nodes of the input value.¶
A JSONPath expression built from segments that have been syntactically restricted ina certain way (Section 2.3.5.1) so that, regardless of the inputvalue, the expression produces a nodelist containing at most one node.Note: JSONPath expressions that always produce a singular nodelist but do notconform to the syntax inSection 2.3.5.1 are not singular queries.¶
This document models the query argument as a tree of JSON values, eachwith its own node.A node is either the root node or one of its descendants.¶
This document models the result of applying a query to thequery argument as a nodelist (a list of nodes).¶
Nodes are the selectable parts of the query argument.The only parts of an object that can be selected by a query are themember values. Member names and members (name/value pairs) cannot beselected.Thus, member values have nodes, but members and member names do not.Similarly, member values are children of an object, but members andmember names are not.¶
This document is based onStefan Gössner's popular JSONPath proposal (dated 2007-02-21)[JSONPath-orig], builds on the experience from the widespreaddeployment of its implementations, and provides a normative specification for it.¶
Appendix B describes how JSONPath was inspired by XML's XPath[XPath].¶
JSONPath was intended as a lightweight companion to JSONimplementations in programming languages such as PHP and JavaScript,so instead of defining its own expression language, like XPath did,JSONPath delegated parts of a query to the underlyingruntime, e.g., JavaScript'seval() function.As JSONPath was implemented in more environments, JSONPathexpressions became decreasingly portable.For example, regular expression processing was often delegated to aconvenient regular expression engine.¶
This document aims to remove such implementation-specific dependencies andserve as a common JSONPath specification that can be used acrossprogramming languages and environments.This means that backwards compatibility isnot always achieved; a design principle of this document is togo with a "consensus" between implementations even if it is rough, aslong as that does not jeopardize the objective of obtaining a usable,stable JSON query language.¶
The termJSONPath was chosen because of the XPath inspiration and also becausethe outcome of a query consists ofpaths identifying nodes in theJSON query argument.¶
The JSON value a JSONPath query is applied to is, by definition, avalid JSON value. A JSON value is often constructed by parsinga JSON text.¶
The parsing of a JSON text into a JSON value and what happens if a JSONtext does not represent valid JSON are not defined by this document.Sections4 and8 of[RFC8259] identify specific situations that mayconform to the grammar for JSON texts but are not interoperable usesof JSON, as they may cause unpredictable behavior.This document does not attempt to define predictablebehavior for JSONPath queries in these situations.¶
Specifically, the "Semantics" subsections of Sections2.3.1,2.3.2,2.3.5, and2.5.2 describe behavior thatbecomes unpredictable when the JSON value for one of the objectsunder consideration was constructed out of JSON text that exhibitsmultiple members for a single object that share the same member name("duplicate names"; seeSection 4 of [RFC8259]).Also, when selecting a child by name (Section 2.3.1) and comparing strings(Section 2.3.5.2.2), it is assumed thesestrings are sequences of Unicode scalar values; the behavior becomes unpredictableif they are not (Section 8.2 of [RFC8259]).¶
A JSONPath expression is applied to a JSON value, known as the query argument.The output is a nodelist.¶
A JSONPath expression consists of an identifier followed by a seriesof zero or more segments, each of which contains one or more selectors.¶
The root node identifier$ refers to the root node of the query argument,i.e., to the argument as a whole.¶
The current node identifier@ refers to the current node in the contextof the evaluation of a filter expression (Section 2.3.5).¶
Segments select children ([<selectors>]) or descendants (..[<selectors>]) of an input value.¶
Segments can usebracket notation, for example:¶
$['store']['book'][0]['title']¶
or the more compactdot notation, for example:¶
$.store.book[0].title¶
Bracket notation contains one or more (comma-separated) selectors of any kind.Selectors are detailed in the next section.¶
A JSONPath expression may use a combination of bracket and dot notations.¶
This document treats the bracket notations as canonical and defines the shorthand dot notation in termsof bracket notation. Examples and descriptions use shorthand where convenient.¶
A name selector, e.g.,'name', selects a named child of an object.¶
An index selector, e.g.,3, selects an indexed child of an array.¶
In the expression[*], a wildcard* (Section 2.3.2) selects all children of anode, and in the expression..[*], it selects all descendants of a node.¶
An array slicestart:end:step (Section 2.3.4) selects a series ofelements from an array, giving a start position, an end position, andan optional step value that moves the position from the start to the end.¶
A filter expression?<logical-expr> selects certain children of an object or array, as in:¶
$.store.book[?@.price < 10].title¶
Table 1 provides a brief overview of JSONPath syntax.¶
| Syntax Element | Description |
|---|---|
$ | root node identifier (Section 2.2) |
@ | current node identifier (Section 2.3.5) (valid only within filter selectors) |
[<selectors>] | child segment (Section 2.5.1): selects zero or more children of a node |
.name | shorthand for['name'] |
.* | shorthand for[*] |
..[<selectors>] | descendant segment (Section 2.5.2): selects zero or more descendants of a node |
..name | shorthand for..['name'] |
..* | shorthand for..[*] |
'name' | name selector (Section 2.3.1): selects a named child of an object |
* | wildcard selector (Section 2.3.2): selects all children of a node |
3 | index selector (Section 2.3.3): selects an indexed child of an array (from 0) |
0:100:5 | array slice selector (Section 2.3.4): start:end:step for arrays |
?<logical-expr> | filter selector (Section 2.3.5): selects particular children using a logical expression |
length(@.foo) | function extension (Section 2.4): invokes a function in a filter expression |
This section is informative. It provides examples of JSONPath expressions.¶
The examples are based on the simple JSON value shown inFigure 1, representing a bookstore (which also has a bicycle).¶
{ "store": { "book": [ { "category": "reference", "author": "Nigel Rees", "title": "Sayings of the Century", "price": 8.95 }, { "category": "fiction", "author": "Evelyn Waugh", "title": "Sword of Honour", "price": 12.99 }, { "category": "fiction", "author": "Herman Melville", "title": "Moby Dick", "isbn": "0-553-21311-3", "price": 8.99 }, { "category": "fiction", "author": "J. R. R. Tolkien", "title": "The Lord of the Rings", "isbn": "0-395-19395-8", "price": 22.99 } ], "bicycle": { "color": "red", "price": 399 } }}Table 2 shows some JSONPath queries that might be applied to this example and their intended results.¶
| JSONPath | Intended Result |
|---|---|
$.store.book[*].author | the authors of all books in the store |
$..author | all authors |
$.store.* | all things in the store, which are some books and a red bicycle |
$.store..price | the prices of everything in the store |
$..book[2] | the third book |
$..book[2].author | the third book's author |
$..book[2].publisher | empty result: the third book does not have a "publisher" member |
$..book[-1] | the last book in order |
$..book[0,1]$..book[:2] | the first two books |
$..book[?@.isbn] | all books with an ISBN number |
$..book[?@.price<10] | all books cheaper than 10 |
$..* | all member values and array elements contained in the input value |
A JSONPathexpression is a string that, when applied to a JSON value(thequery argument), selects zero or more nodes of the argument and outputsthese nodes as a nodelist.¶
A queryMUST be encoded using UTF-8.The grammar for queries given in this document assumes that its UTF-8 form is first decoded intoUnicode scalar values as describedin[RFC3629]; implementation approaches that lead to an equivalentresult are possible.¶
A string to be used as a JSONPath query needs to bewell-formed andvalid.A string is a well-formed JSONPath query if it conforms to the ABNF syntax in this document.A well-formed JSONPath query is valid if it also fulfills both semanticrequirements posed by this document, which are as follows:¶
A JSONPath implementationMUST raise an error for any query that is notwell-formed and valid.The well-formedness and the validity of JSONPath queries are independent ofthe JSON value the query is applied to. No further errors relating to thewell-formedness and the validity of a JSONPath query can beraised during application of the query to a value.This clearly separates well-formedness/validity errors in the queryfrom mismatches that may actually stem from flaws in the data.¶
Mismatches between the structure expected by a valid queryand the structure found in the data can lead to empty query results,which may be unexpected and indicate bugs in either.JSONPath implementations might therefore want to provide diagnosticsto the application developer that aid in finding the cause of emptyresults.¶
Obviously, an implementation can still fail when executing a JSONPathquery, e.g., because of resource depletion, but this is not modeled inthis document. However, the implementationMUST NOTsilently malfunction. Specifically, if a valid JSONPath query isevaluated against a structured value whose size is too large toprocess the query correctly (for instance, requiring the processing ofnumbers that fall outside the range of exact values), the implementationMUST provide an indication of overflow.¶
(Readers familiar with the HTTP error model may be reminded of 400type errors when pondering well-formedness and validity, and they mayrecognize resource depletion and related errors as comparable to 500 typeerrors.)¶
Syntactically, a JSONPath query consists of a root identifier ($), whichstands for a nodelist that contains the root node of the query argument,followed by a possibly empty sequence ofsegments.¶
jsonpath-query = root-identifier segmentssegments = *(S segment)B = %x20 / ; Space %x09 / ; Horizontal tab %x0A / ; Line feed or New line %x0D ; Carriage returnS = *B ; optional blank space¶
The syntax and semantics of segments are defined inSection 2.5.¶
In this document, the semantics of a JSONPath query define therequired results and do not prescribe the internal workings of animplementation. This document may describe semantics in a proceduralstep-by-step fashion; however, such descriptions are normative only in the sense that any implementationMUST produce an identical result but not in the sense that implementers are required to use the same algorithms.¶
The semantics are that a valid query is executed against a value(thequery argument) and produces a nodelist (i.e., a list of zero or more nodes of the value).¶
The query is a root identifier followed by a sequence of zero or more segments, each ofwhich is applied to the result of the previous root identifier or segment and providesinput to the next segment.These results and inputs take the form of nodelists.¶
The nodelist resulting from the root identifier contains a single node(the query argument).The nodelist resulting from the last segment is presented as theresult of the query. Depending on the specific API, it might bepresented as an array of the JSON values at the nodes, an array ofNormalized Paths referencing the nodes, or both -- or some otherrepresentation as desired by the implementation.Note: An empty nodelist is a valid query result.¶
A segment operates on each of the nodes in its input nodelist in turn,and the resultant nodelists are concatenated in the order of the inputnodelist they were derived from to producethe result of the segment. A node may be selected more than once andappears that number of times in the nodelist. Duplicate nodes are not removed.¶
A syntactically valid segmentMUST NOT produce errors when executing the query.This means that someoperations that might be considered erroneous, such as using an indexlying outside the range of an array,simply result in fewer nodes being selected.(Additional discussion of this property can be found in the introduction ofSection 2.1.)¶
As a consequence of this approach, if any of the segments produces an empty nodelist, then the whole query produces an empty nodelist.¶
If the semantics of a query give an implementation a choice of producing multiple possible orderings, a particular implementationmay produce distinct orderings in successive runs of the query.¶
Consider this example. With the query argument{"a":[{"b":0},{"b":1},{"c":2}]}, thequery$.a[*].b selects the following list of nodes (denoted here by their values):0,1.¶
The query consists of$ followed by three segments:.a,[*], and.b.¶
First,$ produces a nodelist consisting of just the query argument.¶
Next,.a selects from any object input node and selects thenode of anymember value of the inputnode corresponding to the member name"a".The result is again a list containing a single node:[{"b":0},{"b":1},{"c":2}].¶
Next,[*] selects all the elementsfrom the input array node.The result is a list of three nodes:{"b":0},{"b":1}, and{"c":2}.¶
Finally,.b selects from any object input node with a member nameb and selects the node of the member value of the input node corresponding to that name.The result is a list containing0,1.This is the concatenation of three lists: two of length one containing0,1, respectively, and one of length zero.¶
Every JSONPath query (except those inside filter expressions; seeSection 2.3.5)MUST begin with the root identifier$.¶
root-identifier = "$"¶
The root identifier$ represents the root node of the query argumentand produces a nodelist consisting of that root node.¶
Note: In this example and the following examples in Sections2.2 and2.3, except forTable 11, we will present aJSON text to show the JSON value used as the query argument to thequeries in the examples and then a table with the following columns:¶
JSON:¶
{"k": "v"}¶Queries:¶
| Query | Result | Result Path | Comment |
|---|---|---|---|
$ | {"k": "v"} | $ | Root node |
Selectors appear only insidechild segments (Section 2.5.1) anddescendant segments (Section 2.5.2).¶
A selector produces a nodelist consisting of zero or more children of the input value.¶
There are various kinds of selectors that produce children of objects, children of arrays,or children of either objects or arrays.¶
selector = name-selector / wildcard-selector / slice-selector / index-selector / filter-selector¶
The syntax and semantics of each kind of selector are defined below.¶
A name selector'<name>' selects at most one object member value.¶
In contrast to JSON,the JSONPath syntax allows strings to be enclosed insingle ordouble quotes.¶
name-selector = string-literalstring-literal = %x22 *double-quoted %x22 / ; "string" %x27 *single-quoted %x27 ; 'string'double-quoted = unescaped / %x27 / ; ' ESC %x22 / ; \" ESC escapablesingle-quoted = unescaped / %x22 / ; " ESC %x27 / ; \' ESC escapableESC = %x5C ; \ backslashunescaped = %x20-21 / ; see RFC 8259 ; omit 0x22 " %x23-26 / ; omit 0x27 ' %x28-5B / ; omit 0x5C \ %x5D-D7FF / ; skip surrogate code points %xE000-10FFFFescapable = %x62 / ; b BS backspace U+0008 %x66 / ; f FF form feed U+000C %x6E / ; n LF line feed U+000A %x72 / ; r CR carriage return U+000D %x74 / ; t HT horizontal tab U+0009 "/" / ; / slash (solidus) U+002F "\" / ; \ backslash (reverse solidus) U+005C (%x75 hexchar) ; uXXXX U+XXXXhexchar = non-surrogate / (high-surrogate "\" %x75 low-surrogate)non-surrogate = ((DIGIT / "A"/"B"/"C" / "E"/"F") 3HEXDIG) / ("D" %x30-37 2HEXDIG )high-surrogate = "D" ("8"/"9"/"A"/"B") 2HEXDIGlow-surrogate = "D" ("C"/"D"/"E"/"F") 2HEXDIGHEXDIG = DIGIT / "A" / "B" / "C" / "D" / "E" / "F"¶Notes:¶
Double-quoted strings follow the JSON string syntax (Section 7 of [RFC8259]);single-quoted strings follow an analogous pattern.No attempt was made to improve on this syntax, so if it is desired toescape characters withscalar values above 0xFFFF, such asU+1F041 ("🁁", DOMINO TILE HORIZONTAL-02-02),they need to be representedby a pair of surrogate escapes ("\uD83C\uDC41" in this case).¶\u escapes (as specified in rulesreferenced byhexchar) can be either lowercase or uppercase,while theu in\u needs to be lowercase (indicated as%x75).¶Aname-selector stringMUST be converted to amember nameM by removing the surrounding quotes andreplacing each escape sequence with its equivalent Unicode character, asshown inTable 4:¶
| Escape Sequence | Unicode Character | Description |
|---|---|---|
\b | U+0008 | BS backspace |
\t | U+0009 | HT horizontal tab |
\n | U+000A | LF line feed |
\f | U+000C | FF form feed |
\r | U+000D | CR carriage return |
\" | U+0022 | quotation mark |
\' | U+0027 | apostrophe |
\/ | U+002F | slash (solidus) |
\\ | U+005C | backslash (reverse solidus) |
\uXXXX | seeSection 2.3.1.1 | hexadecimal escape |
Applying thename-selector to an object nodeselects a member value whose name equals the member nameMor selects nothing if there is no such member value.Nothing is selected from a value that is not an object.¶
Note: Processing the name selector requires comparing the member name stringMwith member name strings in the JSON to which the selector is being applied.Two stringsMUST be considered equal if and only if they are identicalsequences of Unicode scalar values. In other words, normalization operationsMUST NOT be applied to either the member name stringM from the JSONPath orthe member name strings in the JSON prior to comparison.¶
JSON:¶
{ "o": {"j j": {"k.k": 3}}, "'": {"@": 2}}¶Queries:¶
The examples inTable 5 show the name selector in use by child segments.¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$.o['j j'] | {"k.k": 3} | $['o']['j j'] | Named value in a nested object |
$.o['j j']['k.k'] | 3 | $['o']['j j']['k.k'] | Nesting further down |
$.o["j j"]["k.k"] | 3 | $['o']['j j']['k.k'] | Different delimiter in the query, unchanged Normalized Path |
$["'"]["@"] | 2 | $['\'']['@'] | Unusual member names |
A wildcard selector selects the nodes of all children of an object or array.The order in which the children of an object appear in the resultant nodelist is not stipulated,since JSON objects are unordered. Children of an array appear in array order in the resultant nodelist.¶
Note that the children of an object are its member values, not its member names.¶
The wildcard selector selects nothing from a primitive JSON value (that is,a number, a string,true,false, ornull).¶
JSON:¶
{ "o": {"j": 1, "k": 2}, "a": [5, 3]}¶Queries:¶
The examples inTable 6 show the wildcard selector in use by a child segment.¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$[*] | {"j": 1, "k": 2}[5, 3] | $['o']$['a'] | Object values |
$.o[*] | 12 | $['o']['j']$['o']['k'] | Object values |
$.o[*] | 21 | $['o']['k']$['o']['j'] | Alternative result |
$.o[*, *] | 1221 | $['o']['j']$['o']['k']$['o']['k']$['o']['j'] | Non-deterministic ordering |
$.a[*] | 53 | $['a'][0]$['a'][1] | Array members |
The example above with the query$.o[*, *] shows that the wildcard selector may produce nodelists in distinctorders each time it appears in the child segment when it is applied to an object node with two or moremembers (but not when it is applied to object nodes with fewer than two members or to array nodes).¶
An index selector<index> matches at most one array element value.¶
index-selector = int ; decimal integerint = "0" / (["-"] DIGIT1 *DIGIT) ; - optionalDIGIT1 = %x31-39 ; 1-9 non-zero digit¶
Applying the numericalindex-selector selects the correspondingelement. JSONPath allows it to be negative (seeSection 2.3.3.2).¶
To be valid, the index selector valueMUST be in the I-JSONrange of exact values (seeSection 2.1).¶
Notes:¶
A non-negativeindex-selector applied to an array selects an array element using a zero-based index.For example, the selector0 selects the first, and the selector4 selects the fifth element of a sufficiently long array.Nothing is selected, and it is not an error, if the index lies outside the range of the array. Nothing is selected from a value that is not an array.¶
A negativeindex-selector counts from the array end backwards,obtaining an equivalent non-negativeindex-selector by adding thelength of the array to the negative index.For example, the selector-1 selects the last, and the selector-2 selects the penultimate element of an array with at least two elements.As with non-negative indexes, it is not an error if such an element doesnot exist; this simply means that no element is selected.¶
The array slice selector has the form<start>:<end>:<step>.It matches elements from arrays starting at index<start> and ending at (butnot including)<end>, while incrementing bystep with a default of1.¶
slice-selector = [start S] ":" S [end S] [":" [S step ]]start = int ; included in selectionend = int ; not included in selectionstep = int ; default: 1¶
The slice selector consists of three optional decimal integers separated by colons.The second colon can be omitted when the third integer is omitted.¶
To be valid, the integers providedMUST be in the I-JSONrange of exact values (seeSection 2.1).¶
The slice selector was inspired by the slice operator that was proposed for ECMAScript 4 (ES4), which was never released, and that of Python.¶
This section is informative.¶
Array slicing is inspired by the behavior of theArray.prototype.slice methodof the JavaScript language, as defined by the ECMA-262 standard[ECMA-262],with the addition of thestep parameter, which is inspired by the Python slice expression.¶
The array slice expressionstart:end:step selects elements at indices starting atstart,incrementing bystep, and ending withend (which is itself excluded).So, for example, the expression1:3 (wherestep defaults to1)selects elements with indices1 and2 (in that order), whereas1:5:2 selects elements with indices1 and3.¶
Whenstep is negative, elements are selected in reverse order. Thus,for example,5:1:-2 selects elements with indices5 and3 (inthat order), and::-1 selects all the elements of an array inreverse order.¶
Whenstep is0, no elements are selected.(This is the one case that differs from the behavior of Python, whichraises an error in this case.)¶
The following section specifies the behavior fully, without depending onJavaScript or Python behavior.¶
A slice expression selects a subset of the elements of the input array inthe same orderas the array or the reverse order, depending on the sign of thestep parameter.It selects no nodes from a node that is not an array.¶
A slice is defined by the two slice parameters,start andend, andan iteration delta,step.Each of these parameters isoptional. In the rest of this section,len denotes the length of the input array.¶
The default value forstep is1.The default values forstart andend depend on the sign ofstep,as shown inTable 8.¶
| Condition | start | end |
|---|---|---|
| step >= 0 | 0 | len |
| step < 0 | len - 1 | -len - 1 |
Slice expression parametersstart andend are not directly usableas slice bounds and must first be normalized.Normalization for this purpose is defined as:¶
FUNCTION Normalize(i, len): IF i >= 0 THEN RETURN i ELSE RETURN len + i END IF¶
The result of the array index expressioni applied to an arrayof lengthlen is the result of the arrayslicing expressionNormalize(i, len):Normalize(i, len)+1:1.¶
Slice expression parametersstart andend are used to derive slice boundslower andupper.The direction of the iteration, definedby the sign ofstep, determines which of the parameters is the lower bound and whichis the upper bound:¶
FUNCTION Bounds(start, end, step, len): n_start = Normalize(start, len) n_end = Normalize(end, len) IF step >= 0 THEN lower = MIN(MAX(n_start, 0), len) upper = MIN(MAX(n_end, 0), len) ELSE upper = MIN(MAX(n_start, -1), len-1) lower = MIN(MAX(n_end, -1), len-1) END IF RETURN (lower, upper)¶
The slice expression selects elements with indices between the lower andupper bounds.In the following pseudocode,a(i) is thei+1th element of the arraya(i.e.,a(0) is the first element,a(1) the second, and so forth).¶
IF step > 0 THEN i = lower WHILE i < upper: SELECT a(i) i = i + step END WHILEELSE if step < 0 THEN i = upper WHILE lower < i: SELECT a(i) i = i + step END WHILEEND IF¶
Whenstep = 0, no elements are selected, and the result array is empty.¶
JSON:¶
["a", "b", "c", "d", "e", "f", "g"]¶
Queries:¶
The examples inTable 9 show the array slice selector in use by a child segment.¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$[1:3] | "b""c" | $[1]$[2] | Slice with default step |
$[5:] | "f""g" | $[5]$[6] | Slice with no end index |
$[1:5:2] | "b""d" | $[1]$[3] | Slice with step 2 |
$[5:1:-2] | "f""d" | $[5]$[3] | Slice with negative step |
$[::-1] | "g""f""e""d""c""b""a" | $[6]$[5]$[4]$[3]$[2]$[1]$[0] | Slice in reverse order |
Filter selectors are used to iterate over the elements or members ofstructured values, i.e., JSON arrays and objects.The structured values are identified in the nodelist offered by thechild or descendant segment using the filter selector.¶
For each iteration (element/member), a logical expression (thefilter expression)is evaluated, which decides whether the node ofthe element/member is selected.(While a logical expression evaluates to what mathematically is aBoolean value, this specification uses the termlogical to maintain a distinction fromthe Boolean values that JSON can represent.)¶
During the iteration process, the filter expression receives the nodeof each array element or object member value of the structured value beingfiltered; this element or member value is then known as thecurrent node.¶
The current node can be used as the start of one or more JSONPathqueries in subexpressions of the filter expression, notatedvia the current-node-identifier@.Each JSONPath query can be used either for testing existence of aresult of the query, for obtaining a specific JSON value resultingfrom that query that can then be used in a comparison, or as afunction argument.¶
Filter selectors may use function extensions, which are covered inSection 2.4.Within the logical expression for a filter selector, functionexpressions can be used to operate on nodelists and values.The set of available functions is extensible, with a number offunctions predefined (seeSection 2.4) and the ability to register furtherfunctions provided by the "Function Extensions" subregistry (Section 3.2).When a function is defined, it is given a unique name, and its return value and each of its parameters are given adeclared type.The type system is limited in scope; its purpose is to expressrestrictions that, without functions, are implicit in the grammar offilter expressions.The type system also guides conversions (Section 2.4.2) that mimic theway different kinds of expressions are handled in the grammar whenfunction expressions are not in use.¶
The filter selector has the form?<logical-expr>.¶
filter-selector = "?" S logical-expr¶
As the filter expression is composed of constituents free of side effects,the order of evaluation does not need to be (and is not) defined.Similarly, for conjunction (&&) and disjunction (||) (defined later),both a short-circuiting and a fully evaluatingimplementation will lead to the same result; both implementationstrategies are therefore valid.¶
The current node is accessible via the current node identifier@.This identifier addresses the current node of the filter-selector thatis directly enclosing the identifier. Note: Within nestedfilter-selectors, there is no syntax to address the current node ofany other than the directly enclosing filter-selector (i.e., offilter-selectors enclosing the filter-selector that is directlyenclosing the identifier).¶
Logical expressions offer the usual Boolean operators (|| for OR,&& for AND, and! for NOT).They have the normal semantics of Boolean algebra and obey its laws(for example, see[BOOLEAN-LAWS]).ParenthesesMAY be used withinlogical-expr for grouping.¶
It is not required thatlogical-expr consist ofa parenthesized expression (which was required in[JSONPath-orig]),although it can be, and the semantics are the sameas without the parentheses.¶
logical-expr = logical-or-exprlogical-or-expr = logical-and-expr *(S "||" S logical-and-expr) ; disjunction ; binds less tightly than conjunctionlogical-and-expr = basic-expr *(S "&&" S basic-expr) ; conjunction ; binds more tightly than disjunctionbasic-expr = paren-expr / comparison-expr / test-exprparen-expr = [logical-not-op S] "(" S logical-expr S ")" ; parenthesized expressionlogical-not-op = "!" ; logical NOT operator¶A test expressioneither tests the existence of a nodedesignated by an embedded query (seeSection 2.3.5.2.1) or tests theresult of a function expression (seeSection 2.4).In the latter case, if the function's declared result type isLogicalType (seeSection 2.4.1), it tests whether the resultisLogicalTrue; if the function's declared result type isNodesType, it tests whether the result is non-empty.If the function's declared result type isValueType, its use in atest expression is not well-typed (seeSection 2.4.3).¶
test-expr = [logical-not-op S] (filter-query / ; existence/non-existence function-expr) ; LogicalType or NodesTypefilter-query = rel-query / jsonpath-queryrel-query = current-node-identifier segmentscurrent-node-identifier = "@"¶
Comparison expressions are available for comparisons between primitivevalues (that is, numbers, strings,true,false, andnull).These can be obtained via literal values; singular queries, each ofwhich selects at most one node, the value of which is then used; orfunction expressions (seeSection 2.4) of typeValueType.¶
comparison-expr = comparable S comparison-op S comparableliteral = number / string-literal / true / false / nullcomparable = literal / singular-query / ; singular query value function-expr ; ValueTypecomparison-op = "==" / "!=" / "<=" / ">=" / "<" / ">"singular-query = rel-singular-query / abs-singular-queryrel-singular-query = current-node-identifier singular-query-segmentsabs-singular-query = root-identifier singular-query-segmentssingular-query-segments = *(S (name-segment / index-segment))name-segment = ("[" name-selector "]") / ("." member-name-shorthand)index-segment = "[" index-selector "]"¶Literals can be notated in the way that is usual for JSON (with theextension that strings can use single-quote delimiters).¶
Note: Alphabetic characters in quoted strings are case-insensitive in ABNF, so within afloating point number, the ABNF expression "e" can be either the character'e' or 'E'.¶
true,false, andnull are lowercase only (case-sensitive).¶
number = (int / "-0") [ frac ] [ exp ] ; decimal numberfrac = "." 1*DIGIT ; decimal fractionexp = "e" [ "-" / "+" ] 1*DIGIT ; decimal exponenttrue = %x74.72.75.65 ; truefalse = %x66.61.6c.73.65 ; falsenull = %x6e.75.6c.6c ; null¶
Table 10 lists filter expression operators in order of precedence from highest (binds most tightly) to lowest (binds least tightly).¶
| Precedence | Operator type | Syntax |
|---|---|---|
| 5 | Grouping Function Expressions | (...)name (...) |
| 4 | Logical NOT | ! |
| 3 | Relations | ==!=<<=>>= |
| 2 | Logical AND | && |
| 1 | Logical OR | || |
The filter selector works with arrays and objects exclusively. Its result is a list of (zero,one,multiple, orall) their array elements or member values, respectively.Applied to a primitive value, it selects nothing (and therefore doesnot contribute to the result of the filter selector).¶
In the resultant nodelist, children of an array are ordered by their position in the array.The order in which the children of an object (as opposed to an array)appear in the resultant nodelist is not stipulated,since JSON objects are unordered.¶
A query by itself in a logical context is an existence test that yields true if the query selects at least one node and yields false if the query does not select any nodes.¶
Existence tests differ from comparisons in that:¶
To examine the value of a node selected by a query, an explicit comparison is necessary.For example, to test whether the node selected by the query@.foo has the valuenull, use@.foo == null (seeSection 2.6)rather than the negated existence test!@.foo (which yields false if@.foo selects a node, regardless of the node's value).Similarly,@.foo == false yields true only if@.foo selects a node andthe value of that node isfalse.¶
The comparison operators== and< are defined first, and then these are used to define!=,<=,>, and>=.¶
When either side of a comparison results in an empty nodelist or thespecial resultNothing (seeSection 2.4.1):¶
== yields true if and only theother side also results in an empty nodelist or the special resultNothing.¶< yields false.¶When any query or function expression on either side of a comparison results in a nodelist consisting of a single node, that side isreplaced by the value of its node and then:¶
A comparison using the operator== yields true if and only if the comparisonis between:¶
equal objects with no duplicate names, that is, where:¶
A comparison using the operator< yields true if and only ifthe comparison is between values that are both numbers or both strings and that satisfy the comparison:¶
!=,<=,>, and>= are defined in terms of the other comparison operators. For anya andb:¶
a != b yields true if and only ifa == b yields false.¶a <= b yields true if and only ifa < b yields true ora == b yields true.¶a > b yields true if and only ifb < a yields true.¶a >= b yields true if and only ifb < a yields true ora == b yields true.¶The first set of examples shows some comparison expressions and theirresult with a given JSON value as input.¶
JSON:¶
{ "obj": {"x": "y"}, "arr": [2, 3]}¶Comparisons:¶
| Comparison | Result | Comment |
|---|---|---|
$.absent1 == $.absent2 | true | Empty nodelists |
$.absent1 <= $.absent2 | true | == implies<= |
$.absent == 'g' | false | Empty nodelist |
$.absent1 != $.absent2 | false | Empty nodelists |
$.absent != 'g' | true | Empty nodelist |
1 <= 2 | true | Numeric comparison |
1 > 2 | false | Numeric comparison |
13 == '13' | false | Type mismatch |
'a' <= 'b' | true | String comparison |
'a' > 'b' | false | String comparison |
$.obj == $.arr | false | Type mismatch |
$.obj != $.arr | true | Type mismatch |
$.obj == $.obj | true | Object comparison |
$.obj != $.obj | false | Object comparison |
$.arr == $.arr | true | Array comparison |
$.arr != $.arr | false | Array comparison |
$.obj == 17 | false | Type mismatch |
$.obj != 17 | true | Type mismatch |
$.obj <= $.arr | false | Objects and arrays do not offer< comparison |
$.obj < $.arr | false | Objects and arrays do not offer< comparison |
$.obj <= $.obj | true | == implies<= |
$.arr <= $.arr | true | == implies<= |
1 <= $.arr | false | Arrays do not offer< comparison |
1 >= $.arr | false | Arrays do not offer< comparison |
1 > $.arr | false | Arrays do not offer< comparison |
1 < $.arr | false | Arrays do not offer< comparison |
true <= true | true | == implies<= |
true > true | false | Booleans do not offer< comparison |
The second set of examples shows some complete JSONPath queries that make useof filter selectors and the results of evaluating these queries on agiven JSON value as input.(Note: Two of the queries employ function extensions; please seeSections2.4.6 and2.4.7 for details about these.)¶
JSON:¶
{ "a": [3, 5, 1, 2, 4, 6, {"b": "j"}, {"b": "k"}, {"b": {}}, {"b": "kilo"} ], "o": {"p": 1, "q": 2, "r": 3, "s": 5, "t": {"u": 6}}, "e": "f"}¶Queries:¶
The examples inTable 12 show the filter selector in use by a child segment.¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$.a[?@.b == 'kilo'] | {"b": "kilo"} | $['a'][9] | Member value comparison |
$.a[?(@.b == 'kilo')] | {"b": "kilo"} | $['a'][9] | Equivalent query with enclosing parentheses |
$.a[?@>3.5] | 546 | $['a'][1]$['a'][4]$['a'][5] | Array value comparison |
$.a[?@.b] | {"b": "j"}{"b": "k"}{"b": {}}{"b": "kilo"} | $['a'][6]$['a'][7]$['a'][8]$['a'][9] | Array value existence |
$[?@.*] | [3, 5, 1, 2, 4, 6, {"b": "j"}, {"b": "k"}, {"b": {}}, {"b": "kilo"}]{"p": 1, "q": 2, "r": 3, "s": 5, "t": {"u": 6}} | $['a']$['o'] | Existence of non-singular queries |
$[?@[?@.b]] | [3, 5, 1, 2, 4, 6, {"b": "j"}, {"b": "k"}, {"b": {}}, {"b": "kilo"}] | $['a'] | Nested filters |
$.o[?@<3, ?@<3] | 1221 | $['o']['p']$['o']['q']$['o']['q']$['o']['p'] | Non-deterministic ordering |
$.a[?@<2 || @.b == "k"] | 1{"b": "k"} | $['a'][2]$['a'][7] | Array value logical OR |
$.a[?match(@.b, "[jk]")] | {"b": "j"}{"b": "k"} | $['a'][6]$['a'][7] | Array value regular expression match |
$.a[?search(@.b, "[jk]")] | {"b": "j"}{"b": "k"}{"b": "kilo"} | $['a'][6]$['a'][7]$['a'][9] | Array value regular expression search |
$.o[?@>1 && @<4] | 23 | $['o']['q']$['o']['r'] | Object value logical AND |
$.o[?@>1 && @<4] | 32 | $['o']['r']$['o']['q'] | Alternative result |
$.o[?@.u || @.x] | {"u": 6} | $['o']['t'] | Object value logical OR |
$.a[?@.b == $.x] | 351246 | $['a'][0]$['a'][1]$['a'][2]$['a'][3]$['a'][4]$['a'][5] | Comparison of queries with no values |
$.a[?@ == @] | 351246{"b": "j"}{"b": "k"}{"b": {}}{"b": "kilo"} | $['a'][0]$['a'][1]$['a'][2]$['a'][3]$['a'][4]$['a'][5]$['a'][6]$['a'][7]$['a'][8]$['a'][9] | Comparisons of primitive and of structured values |
The example above with the query$.o[?@<3, ?@<3] shows that a filter selector may produce nodelists in distinctorders each time it appears in the child segment.¶
Beyond the filter expression functionality defined in the precedingsubsections, JSONPath defines an extension point that can be used toadd filter expression functionality: "Function Extensions".¶
This section defines the extension point and some functionextensions that use this extension point.While these mechanisms are designed to use the extension point,they are an integral part of the JSONPath specification and areexpected to be implemented like any other integral part of thisspecification.¶
A function extension defines a registered name (seeSection 3.2) thatcan be applied to a sequence of zero or more arguments, producing aresult. Each registered function name is unique.¶
A function extensionMUST be defined such that its evaluation isfree of side effects, i.e., all possible orders of evaluation and choicesof short-circuiting or full evaluation of an expression containing itMUST lead to the same result.(Note: Memoization or logging are not side effects in this senseas they are visible at the implementation level only -- they do notinfluence the result of the evaluation.)¶
function-name = function-name-first *function-name-charfunction-name-first = LCALPHAfunction-name-char = function-name-first / "_" / DIGITLCALPHA = %x61-7A ; "a".."z"function-expr = function-name "(" S [function-argument *(S "," S function-argument)] S ")"function-argument = literal / filter-query / ; (includes singular-query) logical-expr / function-expr¶Any function expressions in a query must be well-formed (by conforming to the above ABNF)and well-typed;otherwise, the JSONPath implementationMUST raise an error(seeSection 2.1).To define which function expressions are well-typed,a type system is first introduced.¶
Each parameter and the result of a function extension must have a declared type.¶
Declared types enable checking a JSONPath query for well-typednessindependent of any query argument the JSONPath query is applied to.¶
Table 13 defines the available types in terms of the instances they contain.¶
| Type | Instances |
|---|---|
ValueType | JSON values orNothing |
LogicalType | LogicalTrue orLogicalFalse |
NodesType | Nodelists |
Notes:¶
ValueType expressed as literals (which, in JSONPath, are limited to primitive values).¶Nothing represents the absence of a JSON value and is distinct from any JSON value, includingnull.¶LogicalTrue andLogicalFalse are unrelated to the JSON values expressed by theliteralstrue andfalse.¶Just as queries can be used in logical expressions by testing for theexistence of at least one node (Section 2.3.5.2.1), a function expression ofdeclared typeNodesType can be used as a function argument for aparameter of declared typeLogicalType, with the equivalent conversion rule:¶
LogicalTrue.¶LogicalFalse.¶Notes:¶
NodesType toValueTypemay be surprising and has therefore not been defined.¶NodesType canindirectly be used as an argument for a parameter of declared typeValueType by wrapping the expression in a call to a function extension,such asvalue() (seeSection 2.4.8),that takes a parameter of typeNodesType and returns aresult of typeValueType.¶The well-typedness of function expressions can now be defined in terms of this type system.¶
For a function expression to be well-typed:¶
Its declared type must be well-typed in the context in which it occurs.¶
As per the grammar, a function expression can occur in three different immediate contexts, which lead to the following conditions for well-typedness:¶
test-expr in a logical expression:The function's declared result type isLogicalType or (giving rise to conversion as perSection 2.4.2)NodesType.¶
comparable in a comparison:The function's declared result type isValueType.¶
function-argument in another function expression:The function's declared result type fulfills the following rules for the corresponding parameter of the enclosing function.¶
Its arguments must be well-typed for the declared type of the corresponding parameters.¶
The arguments of the function expression are well-typed wheneach argument of the function can be used for the declared type of thecorresponding parameter, according to one of the followingconditions:¶
When the declared type of the parameter isLogicalType and the argument is one of the following:¶
NodesType.In this case, the argument is converted to LogicalType as perSection 2.4.2.¶logical-expr that is not a function expression.¶NodesType and the argument is a query(which includes singular query).¶When the declared type of the parameter isValueType and the argument is one of the following:¶
length() Function ExtensionThelength() function extension provides a way to compute the lengthof a value and make that available for further processing in thefilter expression:¶
$[?length(@.authors) >= 5]¶
Its only argument is an instance ofValueType (possibly taken from asingular query, as in the example above). The result is also aninstance ofValueType: an unsigned integer or the special resultNothing.¶
Nothing.¶count() Function ExtensionThecount() function extension provides a way to obtain the number ofnodes in a nodelist and make that available for further processing inthe filter expression:¶
$[?count(@.*.author) >= 5]¶
Its only argument is a nodelist.The result is a value (an unsigned integer) that gives the number ofnodes in the nodelist.¶
Notes:¶
match() Function ExtensionThematch() function extension provides a way to check whether (theentirety of; seeSection 2.4.7) a givenstring matches a given regular expression, which is in the form described in[RFC9485].¶
$[?match(@.date, "1974-05-..")]¶
Its arguments are instances ofValueType (possibly taken from asingular query, as for the first argument in the example above).If the first argument is not a string or the second argument is not astring conforming to[RFC9485], the result isLogicalFalse.Otherwise, the string that is the first argument is matched againstthe I-Regexp contained in the string that is the second argument;the result isLogicalTrue if the string matches the I-Regexp and isLogicalFalse otherwise.¶
search() Function ExtensionThesearch() function extension provides a way to check whether agiven string contains a substring that matches a given regularexpression, which is in the form described in[RFC9485].¶
$[?search(@.author, "[BR]ob")]¶
Its arguments are instances ofValueType (possibly taken from asingular query, as for the first argument in the example above).If the first argument is not a string or the second argument is not astring conforming to[RFC9485], the result isLogicalFalse.Otherwise, the string that is the first argument is searched for asubstring that matches the I-Regexp contained in the stringthat is the second argument; the result isLogicalTrue if atleast one such substring exists and isLogicalFalse otherwise.¶
value() Function ExtensionThevalue() function extension provides a way to convert an instance ofNodesType to a value andmake that available for further processing in the filter expression:¶
$[?value(@..color) == "red"]¶
Its only argument is an instance ofNodesType (possibly taken from afilter-query, as in the example above). The result is aninstance ofValueType.¶
Nothing.¶Note: A singular query may be used anywhere where a ValueType is expected,so there is no need to use thevalue() function extension with a singular query.¶
| Query | Comment |
|---|---|
$[?length(@) < 3] | well-typed |
$[?length(@.*) < 3] | not well-typed since@.* is a non-singular query |
$[?count(@.*) == 1] | well-typed |
$[?count(1) == 1] | not well-typed since1 is not a query or function expression |
$[?count(foo(@.*)) == 1] | well-typed, wherefoo() is a function extension with a parameter of typeNodesType and result typeNodesType |
$[?match(@.timezone, 'Europe/.*')] | well-typed |
$[?match(@.timezone, 'Europe/.*') == true] | not well-typed asLogicalType may not be used in comparisons |
$[?value(@..color) == "red"] | well-typed |
$[?value(@..color)] | not well-typed asValueType may not be used in a test expression |
$[?bar(@.a)] | well-typed for any functionbar() with a parameter of any declared type and result typeLogicalType |
$[?bnl(@.*)] | well-typed for any functionbnl() with a parameter of declared typeNodesType orLogicalType and result typeLogicalType |
$[?blt(1==1)] | well-typed, whereblt() is a function with a parameter of declared typeLogicalType and result typeLogicalType |
$[?blt(1)] | not well-typed for the same functionblt(), as1 is not a query,logical-expr, or function expression |
$[?bal(1)] | well-typed, wherebal() is a function with a parameter of declared typeValueType and result typeLogicalType |
For each node in an input nodelist,segments apply one or more selectors to the node and concatenate theresults of each selector into per-input-node nodelists, which are thenconcatenated in the order of the input nodelist to form a singlesegment result nodelist.¶
It turns out that the more segments there are in a query, the greater the depth in the input value of thenodes of the resultant nodelist:¶
There are two kinds of segments: child segments and descendant segments.¶
segment = child-segment / descendant-segment¶
The syntax and semantics of each kind of segment are defined below.¶
The child segment consists of a non-empty, comma-separatedsequence of selectors enclosed in square brackets.¶
Shorthand notations are also provided for when there is a singlewildcard or name selector.¶
child-segment = bracketed-selection / ("." (wildcard-selector / member-name-shorthand))bracketed-selection = "[" S selector *(S "," S selector) S "]"member-name-shorthand = name-first *name-charname-first = ALPHA / "_" / %x80-D7FF / ; skip surrogate code points %xE000-10FFFFname-char = name-first / DIGITDIGIT = %x30-39 ; 0-9ALPHA = %x41-5A / %x61-7A ; A-Z / a-z¶.*, achild-segment directly built from awildcard-selector, isshorthand for[*].¶
.<member-name>, achild-segment built from amember-name-shorthand, is shorthand for['<member-name>'].Note: This can only be used with member names that are composed of certaincharacters, as specified in the ABNF rulemember-name-shorthand.Thus, for example,$.foo.bar is shorthand for$['foo']['bar'] (but not for$['foo.bar']).¶
A child segment contains a sequence of selectors, each of whichselects zero or more children of the input value.¶
Selectors of different kinds may be combined within a single child segment.¶
For each node in the input nodelist,the resulting nodelist of a child segment is the concatenation ofthe nodelists from each of its selectors in the order that the selectorsappear in the list.Note: Any node matched by more than one selector is keptas many times in the nodelist.¶
Where a selector can produce a nodelist in more than one possible order,each occurrence of the selector in the child segment may produce a nodelist in a distinct order.¶
In summary, a child segment drills down one more level into the structure of the input value.¶
The descendant segment consists of a double dot..followed by a child segment (using bracket notation).¶
Shorthand notations are also provided that correspond to the shorthand forms of the child segment.¶
descendant-segment = ".." (bracketed-selection / wildcard-selector / member-name-shorthand)¶
..*, thedescendant-segment directly built from awildcard-selector, is shorthand for..[*].¶
..<member-name>, adescendant-segment built from amember-name-shorthand, is shorthand for..['<member-name>'].Note: As with the similar shorthand of achild-segment, this canonly be used with member names that are composed of certaincharacters, as specified in the ABNF rulemember-name-shorthand.¶
Note: On its own,.. is not a valid segment.¶
A descendant segment produces zero or more descendants of an input value.¶
For each node in the input nodelist,a descendant selector visits the input node and each ofits descendants such that:¶
The order in which the children of an object are visited is not stipulated, sinceJSON objects are unordered.¶
Suppose the descendant segment is of the form..[<selectors>] (after converting any shorthandform to bracket notation),and the nodes, in the order visited, areD1, ...,Dn (wheren >= 1).Note:D1 is the input value.¶
For eachi such that1 <= i <= n, the nodelistRi is defined to be a result of applyingthe child segment[<selectors>] to the nodeDi.¶
For each node in the input nodelist,the result of the descendant segment is the concatenation ofR1,...,Rn (in that order).These results are then concatenated in input nodelist order to formthe result of the segment.¶
In summary, a descendant segment drills down one or more levels into the structure of each input value.¶
JSON:¶
{ "o": {"j": 1, "k": 2}, "a": [5, 3, [{"j": 4}, {"k": 6}]]}¶Queries:¶
(Note that the fourth example can be expressed in two equivalentqueries, shown inTable 16 in one table row instead of two almost-identical rows.)¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$..j | 14 | $['o']['j']$['a'][2][0]['j'] | Object values |
$..j | 41 | $['a'][2][0]['j']$['o']['j'] | Alternative result |
$..[0] | 5{"j": 4} | $['a'][0]$['a'][2][0] | Array values |
$..[*]or $..* | {"j": 1, "k": 2}[5, 3, [{"j": 4}, {"k": 6}]]1253[{"j": 4}, {"k": 6}]{"j": 4}{"k": 6}46 | $['o']$['a']$['o']['j']$['o']['k']$['a'][0]$['a'][1]$['a'][2]$['a'][2][0]$['a'][2][1]$['a'][2][0]['j']$['a'][2][1]['k'] | All values |
$..o | {"j": 1, "k": 2} | $['o'] | Input value is visited |
$.o..[*, *] | 1221 | $['o']['j']$['o']['k']$['o']['k']$['o']['j'] | Non-deterministic ordering |
$.a..[0, 1] | 53{"j": 4}{"k": 6} | $['a'][0]$['a'][1]$['a'][2][0]$['a'][2][1] | Multiple segments |
Note: The ordering of the results for the$..[*] and$..* examples above is not guaranteed, except that:¶
{"j": 1, "k": 2} must appear before1 and2,¶[5, 3, [{"j": 4}, {"k": 6}]] must appear before5,3, and[{"j": 4}, {"k": 6}],¶5 must appear before3, which must appear before[{"j": 4}, {"k": 6}],¶5 and3 must appear before{"j": 4},4,{"k": 6}, and6,¶[{"j": 4}, {"k": 6}] must appear before{"j": 4} and{"k": 6},¶{"j": 4} must appear before{"k": 6},¶{"k": 6} must appear before4, and¶4 must appear before6.¶The example above with the query$.o..[*, *] shows that a selector may produce nodelists in distinct orderseach time it appears in the descendant segment.¶
The example above with the query$.a..[0, 1] shows that the child segment[0, 1] is applied to each nodein turn (rather than the nodes being visited once per selector, which is the case for some JSONPath implementationsthat do not conform to this specification).¶
nullNote: JSONnull is treated the same as any other JSON value, i.e., it is not taken to mean "undefined" or "missing".¶
JSON:¶
{"a": null, "b": [null], "c": [{}], "null": 1}¶Queries:¶
| Query | Result | Result Paths | Comment |
|---|---|---|---|
$.a | null | $['a'] | Object value |
$.a[0] | null used as array | ||
$.a.d | null used as object | ||
$.b[0] | null | $['b'][0] | Array value |
$.b[*] | null | $['b'][0] | Array value |
$.b[?@] | null | $['b'][0] | Existence |
$.b[?@==null] | null | $['b'][0] | Comparison |
$.c[?@.d==null] | Comparison with "missing" value | ||
$.null | 1 | $['null'] | Not JSONnull at all, just a member name string |
A Normalized Path is a unique representation of the location of a node in a value thatuniquely identifies the node in the value.Specifically, a Normalized Path is a JSONPath query with restricted syntax (defined below),e.g.,$['book'][3], which when applied to the value, results in a nodelist consistingof just the node identified by the Normalized Path.Note: A Normalized Path represents the identity of a nodein a specific value.There is precisely one Normalized Path identifying any particular node in a value.¶
A nodelist may be represented compactly in JSON as an array of strings, where the strings areNormalized Paths.¶
Normalized Paths provide a predictable format that simplifies testing and post-processingof nodelists, e.g., to remove duplicate nodes.Normalized Paths are used in this document as result paths in examples.¶
Normalized Paths use the canonical bracket notation, rather than dot notation.¶
Single quotes are used in Normalized Paths to delimit string member names. This reduces thenumber of characters that need escaping when Normalized Paths appear instrings delimited by double quotes, e.g., in JSON texts.¶
Certain characters are escaped in Normalized Paths in one and only one way; all other characters are unescaped.¶
Note: Normalized Paths are singular queries, but not all singular queries are Normalized Paths.For example,$[-3] is a singular query but is not a Normalized Path.The Normalized Path equivalent to$[-3] would have an index equal to the array length minus3. (The array length must be at least3 if$[-3] is to identify a node.)¶
normalized-path = root-identifier *(normal-index-segment)normal-index-segment = "[" normal-selector "]"normal-selector = normal-name-selector / normal-index-selectornormal-name-selector = %x27 *normal-single-quoted %x27 ; 'string'normal-single-quoted = normal-unescaped / ESC normal-escapablenormal-unescaped = ; omit %x0-1F control codes %x20-26 / ; omit 0x27 ' %x28-5B / ; omit 0x5C \ %x5D-D7FF / ; skip surrogate code points %xE000-10FFFFnormal-escapable = %x62 / ; b BS backspace U+0008 %x66 / ; f FF form feed U+000C %x6E / ; n LF line feed U+000A %x72 / ; r CR carriage return U+000D %x74 / ; t HT horizontal tab U+0009 "'" / ; ' apostrophe U+0027 "\" / ; \ backslash (reverse solidus) U+005C (%x75 normal-hexchar) ; certain values u00xx U+00XXnormal-hexchar = "0" "0" ( ("0" %x30-37) / ; "00"-"07" ; omit U+0008-U+000A BS HT LF ("0" %x62) / ; "0b" ; omit U+000C-U+000D FF CR ("0" %x65-66) / ; "0e"-"0f" ("1" normal-HEXDIG) )normal-HEXDIG = DIGIT / %x61-66 ; "0"-"9", "a"-"f"normal-index-selector = "0" / (DIGIT1 *DIGIT) ; non-negative decimal integer¶Since there can only be one Normalized Path identifying a given node, the syntaxstipulates which characters are escaped and which are not.So the definition ofnormal-hexchar is designed for hex escaping of charactersthat are not straightforwardly printable, for example, U+000B LINE TABULATION, butfor which no standard JSON escape, such as\n, is available.¶
| Path | Normalized Path | Comment |
|---|---|---|
$.a | $['a'] | Object value |
$[1] | $[1] | Array index |
$[-3] | $[2] | Negative array index for an array of length 5 |
$.a.b[1:2] | $['a']['b'][1] | Nested structure |
$["\u000B"] | $['\u000b'] | Unicode escape |
$["\u0061"] | $['a'] | Unicode character |
IANA has registered the following media type[RFC6838]:¶
application¶
jsonpath¶
N/A¶
N/A¶
binary (UTF-8)¶
See the Security Considerations section of RFC 9535.¶
N/A¶
RFC 9535¶
Applications that need to convey queries in JSON data¶
N/A¶
COMMON¶
N/A¶
JSONPath WG¶
IETF¶
Per this specification, IANA has created a new "Function Extensions" subregistry ina new "JSONPath" registry. The "Function Extensions" subregistry has the policy "Expert Review"(Section 4.5 of [RFC8126]).¶
The experts are instructed to be frugal in the allocation of functionextension names that are suggestive of generally applicable semantics,keeping them in reserve for functions that are likely to enjoy wideuse and can make good use of their conciseness.The expert is also instructed to direct the registrant to provide aspecification (Section 4.6 of [RFC8126]) but can make exceptions,for instance, when a specification is not available at the time ofregistration but is likely forthcoming.If the expert becomes aware of function extensions that are deployed andin use, they may also initiate a registration on their own ifthey deem such a registration can avert potential future collisions.¶
Each entry in the subregistry must include the following:¶
A lowercase ASCII[RFC0020] string that starts with a letter and cancontain letters, digits, and underscore characters afterwards([a-z][_a-z0-9]*). No other entry in the subregistry can have thesame function name.¶
A brief description¶
A comma-separated list of zero or more declared types, one for each of thearguments expected for this function extension¶
The declared type of the result for this function extension¶
SeeSection 2.3 of [RFC8126].¶
A reference document that provides a description of the functionextension¶
The initial entries in this subregistry are listed inTable 19; theentries in the "Change Controller" column all have the value "IETF",and the entries in the"Reference" column all have the value "Section 2.4 of RFC 9535":¶
| Function Name | Brief Description | Parameters | Result |
|---|---|---|---|
| length | length of string, array, or object | ValueType | ValueType |
| count | size of nodelist | NodesType | ValueType |
| match | regular expression full match | ValueType,ValueType | LogicalType |
| search | regular expression substring match | ValueType,ValueType | LogicalType |
| value | value of the single node in nodelist | NodesType | ValueType |
Security considerations for JSONPath can stem from:¶
Historically, JSONPath has often been implemented by feeding parts ofthe query to an underlying programming language engine, e.g.,JavaScript'seval() function.This approach is well known to lead to injection attacks and wouldrequire perfect input validation to prevent these attacks (seeSection 12 of [RFC8259] for similar considerations for JSON itself).Instead, JSONPath implementations need to implement the entire syntaxof the query without relying on the parsers of programming languageengines.¶
Attacks on availability may attempt to trigger unusually expensiveruntime performance exhibited by certain implementations in certaincases.(SeeSection 10 of [RFC8949] for issues in hash-table implementationsandSection 8 of [RFC9485] for performance issues in regularexpression implementations.)Implementers need to be aware that good average performance is notsufficient as long as an attacker can choose to submit speciallycrafted JSONPath queries or query arguments that trigger surprisingly high, possiblyexponential, CPU usage or, for example, via a naive recursive implementation of the descendant segment,stack overflow. Implementations need to have appropriate resource managementto mitigate these attacks.¶
JSONPath queries are often not static but formed from variables thatprovide index values, member names, or values to compare with in afilter expression.These variables need to be validated (e.g., only allowing specific constructssuch as .name to be formed when the given values allow that) and translated(e.g., by escaping string delimiters).Not performing these validations and translations correctly can lead to unexpectedfailures, which can lead to availability, confidentiality, andintegrity breaches, in particular, if an adversary has control over thevalues (e.g., by entering them into a web form).The resulting class of attacks,injections (e.g., SQL injections),is consistently found among the top causes of application securityvulnerabilities and requires particular attention.¶
Where JSONPath is used as a part of a security mechanism, attackerscan attempt to provoke unexpected or unpredictable behavior ortake advantage of differences in behavior between JSONPath implementations.¶
Unexpected or unpredictable behavior can arise from a query argument with certainconstructs described as unpredictable by[RFC8259].Predictable behavior can be expected, except in relation to the orderingof objects, for any query argument conforming with[RFC7493].¶
Other attacks can target the behavior of underlying technologies, such as UTF-8 (seeSection 10 of [RFC3629]) and the Unicode character set.¶
This appendix collects the ABNF grammar from the ABNF passages usedthroughout the document.¶
Figure 2 contains the collected ABNF grammar that defines thesyntax of a JSONPath query.¶
jsonpath-query = root-identifier segmentssegments = *(S segment)B = %x20 / ; Space %x09 / ; Horizontal tab %x0A / ; Line feed or New line %x0D ; Carriage returnS = *B ; optional blank spaceroot-identifier = "$"selector = name-selector / wildcard-selector / slice-selector / index-selector / filter-selectorname-selector = string-literalstring-literal = %x22 *double-quoted %x22 / ; "string" %x27 *single-quoted %x27 ; 'string'double-quoted = unescaped / %x27 / ; ' ESC %x22 / ; \" ESC escapablesingle-quoted = unescaped / %x22 / ; " ESC %x27 / ; \' ESC escapableESC = %x5C ; \ backslashunescaped = %x20-21 / ; see RFC 8259 ; omit 0x22 " %x23-26 / ; omit 0x27 ' %x28-5B / ; omit 0x5C \ %x5D-D7FF / ; skip surrogate code points %xE000-10FFFFescapable = %x62 / ; b BS backspace U+0008 %x66 / ; f FF form feed U+000C %x6E / ; n LF line feed U+000A %x72 / ; r CR carriage return U+000D %x74 / ; t HT horizontal tab U+0009 "/" / ; / slash (solidus) U+002F "\" / ; \ backslash (reverse solidus) U+005C (%x75 hexchar) ; uXXXX U+XXXXhexchar = non-surrogate / (high-surrogate "\" %x75 low-surrogate)non-surrogate = ((DIGIT / "A"/"B"/"C" / "E"/"F") 3HEXDIG) / ("D" %x30-37 2HEXDIG )high-surrogate = "D" ("8"/"9"/"A"/"B") 2HEXDIGlow-surrogate = "D" ("C"/"D"/"E"/"F") 2HEXDIGHEXDIG = DIGIT / "A" / "B" / "C" / "D" / "E" / "F"wildcard-selector = "*"index-selector = int ; decimal integerint = "0" / (["-"] DIGIT1 *DIGIT) ; - optionalDIGIT1 = %x31-39 ; 1-9 non-zero digitslice-selector = [start S] ":" S [end S] [":" [S step ]]start = int ; included in selectionend = int ; not included in selectionstep = int ; default: 1filter-selector = "?" S logical-exprlogical-expr = logical-or-exprlogical-or-expr = logical-and-expr *(S "||" S logical-and-expr) ; disjunction ; binds less tightly than conjunctionlogical-and-expr = basic-expr *(S "&&" S basic-expr) ; conjunction ; binds more tightly than disjunctionbasic-expr = paren-expr / comparison-expr / test-exprparen-expr = [logical-not-op S] "(" S logical-expr S ")" ; parenthesized expressionlogical-not-op = "!" ; logical NOT operatortest-expr = [logical-not-op S] (filter-query / ; existence/non-existence function-expr) ; LogicalType or NodesTypefilter-query = rel-query / jsonpath-queryrel-query = current-node-identifier segmentscurrent-node-identifier = "@"comparison-expr = comparable S comparison-op S comparableliteral = number / string-literal / true / false / nullcomparable = literal / singular-query / ; singular query value function-expr ; ValueTypecomparison-op = "==" / "!=" / "<=" / ">=" / "<" / ">"singular-query = rel-singular-query / abs-singular-queryrel-singular-query = current-node-identifier singular-query-segmentsabs-singular-query = root-identifier singular-query-segmentssingular-query-segments = *(S (name-segment / index-segment))name-segment = ("[" name-selector "]") / ("." member-name-shorthand)index-segment = "[" index-selector "]"number = (int / "-0") [ frac ] [ exp ] ; decimal numberfrac = "." 1*DIGIT ; decimal fractionexp = "e" [ "-" / "+" ] 1*DIGIT ; decimal exponenttrue = %x74.72.75.65 ; truefalse = %x66.61.6c.73.65 ; falsenull = %x6e.75.6c.6c ; nullfunction-name = function-name-first *function-name-charfunction-name-first = LCALPHAfunction-name-char = function-name-first / "_" / DIGITLCALPHA = %x61-7A ; "a".."z"function-expr = function-name "(" S [function-argument *(S "," S function-argument)] S ")"function-argument = literal / filter-query / ; (includes singular-query) logical-expr / function-exprsegment = child-segment / descendant-segmentchild-segment = bracketed-selection / ("." (wildcard-selector / member-name-shorthand))bracketed-selection = "[" S selector *(S "," S selector) S "]"member-name-shorthand = name-first *name-charname-first = ALPHA / "_" / %x80-D7FF / ; skip surrogate code points %xE000-10FFFFname-char = name-first / DIGITDIGIT = %x30-39 ; 0-9ALPHA = %x41-5A / %x61-7A ; A-Z / a-zdescendant-segment = ".." (bracketed-selection / wildcard-selector / member-name-shorthand)Figure 3 contains the collected ABNF grammar thatdefines the syntax of a JSONPath Normalized Path while also using the rulesroot-identifier,ESC,DIGIT, andDIGIT1 fromFigure 2.¶
normalized-path = root-identifier *(normal-index-segment)normal-index-segment = "[" normal-selector "]"normal-selector = normal-name-selector / normal-index-selectornormal-name-selector = %x27 *normal-single-quoted %x27 ; 'string'normal-single-quoted = normal-unescaped / ESC normal-escapablenormal-unescaped = ; omit %x0-1F control codes %x20-26 / ; omit 0x27 ' %x28-5B / ; omit 0x5C \ %x5D-D7FF / ; skip surrogate code points %xE000-10FFFFnormal-escapable = %x62 / ; b BS backspace U+0008 %x66 / ; f FF form feed U+000C %x6E / ; n LF line feed U+000A %x72 / ; r CR carriage return U+000D %x74 / ; t HT horizontal tab U+0009 "'" / ; ' apostrophe U+0027 "\" / ; \ backslash (reverse solidus) U+005C (%x75 normal-hexchar) ; certain values u00xx U+00XXnormal-hexchar = "0" "0" ( ("0" %x30-37) / ; "00"-"07" ; omit U+0008-U+000A BS HT LF ("0" %x62) / ; "0b" ; omit U+000C-U+000D FF CR ("0" %x65-66) / ; "0e"-"0f" ("1" normal-HEXDIG) )normal-HEXDIG = DIGIT / %x61-66 ; "0"-"9", "a"-"f"normal-index-selector = "0" / (DIGIT1 *DIGIT) ; non-negative decimal integerThis appendix is informative.¶
At the time JSONPath was invented, XML was noted for the availability ofpowerful tools to analyze, transform, and selectively extract data fromXML documents.[XPath] is one of these tools.¶
In 2007, the need for something solving the same class of problems forthe emerging JSON community became apparent, specifically for:¶
(Note: XPath has evolved since 2007, and recent versions evennominally support operating inside JSON values.This appendix only discusses the more widely used version of XPaththat was available in 2007.)¶
JSONPath picks up the overall feeling of XPath but maps the conceptsto syntax (and partially semantics) that would be familiar to someoneusing JSON in a dynamic language.¶
For example, in popular dynamic programming languages such as JavaScript,Python, and PHP, the semantics of the XPath expression:¶
/store/book[1]/title¶
can be realized in the expression:¶
x.store.book[0].title¶
or in bracket notation:¶
x['store']['book'][0]['title']¶
with the variable x holding the query argument.¶
The JSONPath language was designed to:¶
JSONPath expressions apply to JSON values in the same wayas XPath expressions are used in combination with an XML document.JSONPath uses$ to refer to the root node of the query argument, similarto XPath's/ at the front.¶
JSONPath expressions move further down the hierarchy usingdot notation($.store.book[0].title)or thebracket notation($['store']['book'][0]['title']); both replace XPath's/ within query expressions, wheredot notation serves as a lightweight but limited syntax whilebracket notation is aheavyweight but more general syntax.¶
Both JSONPath and XPath use* for a wildcard.JSONPath's descendant segment notation, starting with.., borrowed from[E4X], is similar to XPath's//.The array slicing construct[start:end:step] is unique to JSONPath,inspired by[SLICE] from ECMASCRIPT 4.¶
Filter expressions are supported via the syntax?<logical-expr> as in:¶
$.store.book[?@.price < 10].title¶
Table 20 extendsTable 1 by providing a comparisonwith similar XPath concepts.¶
| XPath | JSONPath | Description |
|---|---|---|
/ | $ | the root XML element |
. | @ | the current XML element |
/ | . or[] | child operator |
.. | n/a | parent operator |
// | ..name,..[index],..*, or..[*] | descendants (JSONPath borrows this syntax from E4X) |
* | * | wildcard: All XML elements regardless of their names |
@ | n/a | attribute access: JSON values do not have attributes |
[] | [] | subscript operator used to iterate over XML element collections and for predicates |
| | [,] | Union operator (results in a combination of node sets); called list operator in JSONPath, allows combining member names, array indices, and slices |
| n/a | [start:end:step] | array slice operator borrowed from ES4 |
[] | ? | applies a filter (script) expression |
| seamless | n/a | expression engine |
() | n/a | grouping |
For further illustration,Table 21 shows some XPath expressionsand their JSONPath equivalents.¶
| XPath | JSONPath | Result |
|---|---|---|
/store/book/author | $.store.book[*].author | the authors of all books in the store |
//author | $..author | all authors |
/store/* | $.store.* | all things in store, which are some books and a red bicycle |
/store//price | $.store..price | the prices of everything in the store |
//book[3] | $..book[2] | the third book |
//book[last()] | $..book[-1] | the last book in order |
//book[position()<3] | $..book[0,1]$..book[:2] | the first two books |
//book[isbn] | $..book[?@.isbn] | filter all books with an ISBN number |
//book[price<10] | $..book[?@.price<10] | filter all books cheaper than 10 |
//* | $..* | all elements in an XML document; all member values and array elements contained in input value |
XPath has a lot more functionality (location paths in unabbreviated syntax,operators, and functions) than listed in this comparison. Moreover, there aresignificant differences in how the subscript operator works in XPath andJSONPath:¶
This appendix is informative.¶
In relation to JSON Pointer[RFC6901], JSONPath is not intended as a replacement but as a more powerfulcompanion. The purposes of the two standardsare different.¶
JSON Pointer is for identifying a single value within a JSON value whosestructure is known.¶
JSONPath can identify a single value within a JSON value, for example, byusing a Normalized Path. But JSONPath is also a query syntax that can be usedto search for and extract multiple values from JSON values whose structureis known only in a general way.¶
A Normalized JSONPath can be converted into a JSON Pointer by converting the syntax,without knowledge of any JSON value. The inverse is not generally true, i.e., a numericreference token (path component) in a JSON Pointer may identify a member value of an object or an element of an array.For conversion to a JSONPath query, knowledge of the structure of the JSON value isneeded to distinguish these cases.¶
This document is based onStefan Gössner'soriginal online article defining JSONPath[JSONPath-orig].¶
The books example was taken from course material that Bielefeld University, Germany used in 2002.¶
This work is indebted toChristoph Burgmer for the superbJSONPath comparison project[COMPARISON] that details the behavior of over forty JSONPathimplementations applied to numerous queries.¶