JSONPath: Query expressions for JSON

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The grammatical rules in this document are to be interpreted as ABNF, as described in [RFC5234]. ABNF terminal values in this document define Unicode code points rather than their UTF-8 encoding. For example, the Unicode PLACE OF INTEREST SIGN (U+2318) would be defined in ABNF as %x2318.¶

The terminology of [RFC8259] applies except where clarified below. The terms "Primitive" and "Structured" are used to group the types as in Section 1 of [RFC8259]. Definitions for "Object", "Array", "Number", and "String" remain unchanged. Importantly "object" and "array" in particular do not take on a generic meaning, such as they would in a general programming context.¶

Additional terms used in this specification are defined below.¶

Value:

As per [RFC8259], a structure complying to the generic data model of JSON, i.e., composed of components such as structured values, namely JSON objects and arrays, and primitive data, namely numbers and text strings as well as the special values null, true, and false.¶

Member:

A name/value pair in an object. (Not itself a value.)¶

Name:

The name in a name/value pair constituting a member. (Also known as "key", "tag", or "label".) This is also used in [RFC8259], but that specification does not formally define it. It is included here for completeness.¶

Element:

A value in an array. (Not to be confused with XML element.)¶

Index:

A non-negative integer that identifies a specific element in an array. Note that the term indexing is also used for accessing elements using negative integers (Section "Semantics"), and for accessing member values in an object using their member name.¶

Query:

Short name for JSONPath expression.¶

Argument:

Short name for the value a JSONPath expression is applied to.¶

Node:

The pair of a value along with its location within the argument.¶

Root Node:

The unique node whose value is the entire argument.¶

Children (of a node):

If the node is an array, each of its elements, or if the node is an object, each its member values (but not its member names). If the node is neither an array nor an object, it has no descendants.¶

Descendants (of a node):

The children of the node, together with the children of its children, and so forth recursively. More formally, the descendants relation between nodes is the transitive closure of the children relation.¶

Nodelist:

A list of nodes. The output of applying a query to an argument is manifested as a list of nodes. While this list can be represented in JSON, e.g. as an array, the nodelist is an abstract concept unrelated to JSON values.¶

Normalized Path:

A simple form of JSONPath expression that identifies a node by providing a query that results in exactly that node. Similar to, but syntactically different from, a JSON Pointer [RFC6901].¶

Singular Path:

A JSONPath expression built from selectors which each select at most one node.¶

For the purposes of this specification, a value as defined by [RFC8259] is also viewed as a tree of nodes. Each node, in turn, holds a value. Further nodes within each value are the elements of arrays and the member values of objects and are themselves values. (The type of the value held by a node may also be referred to as the type of the node.)¶

A query is applied to an argument, and the output is a nodelist.¶

1.2. History

This document picks up Stefan Goessner's popular JSONPath proposal dated 2007-02-21 [JSONPath-orig] and provides a normative definition for it.¶

Appendix A describes how JSONPath was inspired by XML's XPath [XPath].¶

JSONPath was intended as a light-weight companion to JSON implementations on platforms such as PHP and JavaScript, so instead of defining its own expression language like XPath did, JSONPath delegated this to the expression language of the platform. While the languages in which JSONPath is used do have significant commonalities, over time this caused non-portability of JSONPath expressions between the ensuing platform-specific dialects.¶

The present specification intends to remove platform dependencies and serve as a common JSONPath specification that can be used across platforms. Obviously, this means that backwards compatibility could not always be achieved; a design principle of this specification is to go with a "consensus" between implementations even if it is rough, as long as that does not jeopardize the objective of obtaining a usable, stable JSON query language.¶

1.3. Overview of JSONPath Expressions

JSONPath expressions are applied to a JSON value, the argument. Within the JSONPath expression, the abstract name $ is used to refer to the root node of the argument, i.e., to the argument as a whole.¶

JSONPath expressions can use the dot notation¶

$.store.book[0].title

or the more general bracket notation¶

$['store']['book'][0]['title']

to build paths that are input to a JSONPath implementation.¶

JSONPath allows the wildcard symbol * to select any member of an object or any element of an array (Section 3.5.3). The descendant operator .. selects all the descendants (Section 3.5.7) of a node. The array slice syntax [start:end:step] allows selecting a regular selection of an element from an array, giving a start position, an end position, and possibly a step value that moves the position from the start to the end (Section 3.5.6).¶

Filter expressions are supported via the syntax ?(<boolean expr>) as in¶

$.store.book[?(@.price < 10)].title

Table 1 provides a quick overview of the JSONPath syntax elements.¶

3.1. Overview

A JSONPath query is a string which selects zero or more nodes of a piece of JSON.¶

A query MUST be encoded using UTF-8. The grammar for queries given in this document assumes that its UTF-8 form is first decoded into Unicode code points as described in [RFC3629]; implementation approaches that lead to an equivalent result are possible.¶

A string to be used as a JSONPath query needs to be well-formed and valid. A string is a well-formed JSONPath query if it conforms to the ABNF syntax in this document. A well-formed JSONPath query is valid if it also fulfills all semantic requirements posed by this document.¶

To be valid, integer numbers in the JSONPath query that are relevant to the JSONPath processing (e.g., index values and steps) MUST be within the range of exact values defined in I-JSON [RFC7493], namely within the interval [-(2⁵³)+1, (2⁵³)-1]).¶

To be valid, strings on the right hand side of the =~ regex matching operator need to conform to [I-D.draft-bormann-jsonpath-iregexp].¶

The well-formedness and the validity of JSONPath queries are independent of the JSON value the query is applied to; no further errors can be raised during application of the query to a value.¶

Obviously, an implementation can still fail when executing a JSONPath query, e.g., because of resource depletion, but this is not modeled in the present specification. However, the implementation MUST NOT silently malfunction. Specifically, if a valid JSONPath query is evaluated against a structured value whose size doesn't fit in the range of exact values, interfering with the correct interpretation of the query, the implementation MUST provide an indication of overflow.¶

(Readers familiar with the HTTP error model may be reminded of 400 type errors when pondering well-formedness and validity, while resource depletion and related errors are comparable to 500 type errors.)¶

3.2. Processing Model

In this specification, the semantics of a JSONPath query are defined in terms of a processing model. That model is not prescriptive of the internal workings of an implementation: Implementations may wish (or need) to design a different process that yields results that are consistent with this model.¶

In the processing model, a valid query is executed against a value, the argument, and produces a list of zero or more nodes of the value.¶

The query is a sequence of zero or more selectors, each of which is applied to the result of the previous selector and provides input to the next selector. These results and inputs take the form of a nodelist, i.e., a sequence of zero or more nodes.¶

The nodelist going into the first selector contains a single node, the argument. The nodelist resulting from the last selector is presented as the result of the query; depending on the specific API, it might be presented as an array of the JSON values at the nodes, an array of Normalized Paths referencing the nodes, or both -- or some other representation as desired by the implementation. Note that the API must be capable of presenting an empty nodelist as the result of the query.¶

A selector performs its function on each of the nodes in its input nodelist, during such a function execution, such a node is referred to as the "current node". Each of these function executions produces a nodelist, which are then concatenated into the result of the selector.¶

The processing within a selector may execute nested queries, which are in turn handled with the processing model defined here. Typically, the argument to that query will be the current node of the selector or a set of nodes subordinate to that current node.¶

3.3. Syntax

Syntactically, a JSONPath query consists of a root selector ($), which stands for a nodelist that contains the root node of the argument, followed by a possibly empty sequence of selectors.¶

json-path = root-selector *(S (dot-selector        /
                               dot-wild-selector   /
                               index-selector      /
                               index-wild-selector /
                               slice-selector      /
                               descendant-selector /
                               filter-selector     /
                               list-selector))

The syntax and semantics of each selector is defined below.¶

3.4. Semantics

The root selector $ not only selects the root node of the argument, but it also produces as output a list consisting of one node: the argument itself.¶

A selector may select zero or more nodes for further processing. A syntactically valid selector MUST NOT produce errors. This means that some operations that might be considered erroneous, such as indexing beyond the end of an array, simply result in fewer nodes being selected.¶

But a selector doesn't just act on a single node: a selector acts on each of the nodes in its input nodelist and concatenates the resultant nodelists to form the result nodelist of the selector.¶

For each node in the list, the selector selects zero or more nodes, each of which is a descendant of the node or the node itself.¶

For instance, with the argument {"a":[{"b":0},{"b":1},{"c":2}]}, the query $.a[*].b selects the following list of nodes: 0, 1 (denoted here by their value). Let's walk through this in detail.¶

The query consists of $ followed by three selectors: .a, [*], and .b.¶

Firstly, $ selects the root node which is the argument. So the result is a list consisting of just the root node.¶

Next, .a selects from any input node of type object and selects the node of any member value of the input node corresponding to the member name "a". The result is again a list of one node: [{"b":0},{"b":1},{"c":2}].¶

Next, [*] selects from an input node of type array all its elements (if the input note were of type object, it would select all its member values, but not the member names). The result is a list of three nodes: {"b":0}, {"b":1}, and {"c":2}.¶

Finally, .b selects from any input node of type object with a member name b and selects the node of the member value of the input node corresponding to that name. The result is a list containing 0, 1. This is the concatenation of three lists, two of length one containing 0, 1, respectively, and one of length zero.¶

As a consequence of this approach, if any of the selectors selects no nodes, then the whole query selects no nodes.¶

In what follows, the semantics of each selector are defined for each type of node.¶

3.5. Selectors

A JSONPath query consists of a sequence of selectors. Valid selectors are¶

• Root selector $ (used at the start of a query and in expressions)¶
• Dot selector .<name>, used with object member names exclusively.¶
• Dot wildcard selector .*.¶
• Index selector [<index>], where <index> is either a (possibly negative, see Section "Semantics") array index or an object member name.¶
• Index wildcard selector [*].¶
• Array slice selector [<start>:<end>:<step>], where the optional values <start>, <end>, and <step> are integer literals.¶
• Descendants selector ...¶
• List selector [<sel1>,<sel2>,...,<selN>], holding a comma separated list of index and slice selectors.¶
• Filter selector [?(<expr>)]¶
• Current item selector @ (used in expressions)¶

root-selector  = "$"

{"k": "v"}

dot-selector    = "." dot-member-name
dot-member-name = name-first *name-char
name-first      =
                      ALPHA /
                      "_"   /           ; _
                      %x80-10FFFF       ; any non-ASCII Unicode character
name-char = DIGIT / name-first

DIGIT           =  %x30-39              ; 0-9
ALPHA           =  %x41-5A / %x61-7A    ; A-Z / a-z

{"j": {"k": 3}}

dot-wild-selector    = "." "*"            ;  dot followed by asterisk

{
  "o": {"j": 1, "k": 2},
  "a": [5, 3]
}

index-selector      = "[" S (quoted-member-name / element-index) S "]"

quoted-member-name  = string-literal

string-literal      = %x22 *double-quoted %x22 /       ; "string"
                      %x27 *single-quoted %x27         ; 'string'

double-quoted       = unescaped /
                      %x27      /                       ; '
                      ESC %x22  /                       ; \"
                      ESC escapable

single-quoted       = unescaped /
                      %x22      /                       ; "
                      ESC %x27  /                       ; \'
                      ESC escapable

ESC                 = %x5C                              ; \  backslash

unescaped           = %x20-21 /                         ; s. RFC 8259
                      %x23-26 /                         ; omit "
                      %x28-5B /                         ; omit '
                      %x5D-10FFFF                       ; omit \

escapable           = ( %x62 / %x66 / %x6E / %x72 / %x74 / ; \b \f \n \r \t
                          ; b /         ;  BS backspace U+0008
                          ; t /         ;  HT horizontal tab U+0009
                          ; n /         ;  LF line feed U+000A
                          ; f /         ;  FF form feed U+000C
                          ; r /         ;  CR carriage return U+000D
                          "/" /          ;  /  slash (solidus) U+002F
                          "\" /          ;  \  backslash (reverse solidus) U+005C
                          (%x75 hexchar) ;  uXXXX      U+XXXX
                      )

hexchar = non-surrogate / (high-surrogate "\" %x75 low-surrogate)
non-surrogate = ((DIGIT / "A"/"B"/"C" / "E"/"F") 3HEXDIG) /
                 ("D" %x30-37 2HEXDIG )
high-surrogate = "D" ("8"/"9"/"A"/"B") 2HEXDIG
low-surrogate = "D" ("C"/"D"/"E"/"F") 2HEXDIG

HEXDIG = DIGIT / "A" / "B" / "C" / "D" / "E" / "F"

; Task from 2021-06-15 interim: update ABNF later

element-index   = int                             ; decimal integer

int             = ["-"] ( "0" / (DIGIT1 *DIGIT) ) ; -  optional
DIGIT1          = %x31-39                         ; 1-9 non-zero digit

{
  "o": {"j j": {"k.k": 3}},
  "a": ["a","b"]
}

index-wild-selector    = "[" "*" "]"  ;  asterisk enclosed by brackets

{
  "o": {"j": 1, "k": 2},
  "a": [5, 3]
}

slice-selector = "[" S slice-index S "]"

slice-index    =  [start S] ":" S [end S] [":" [S step ]]

start          = int       ; included in selection
end            = int       ; not included in selection
step           = int       ; default: 1

B              =    %x20 / ; Space
                    %x09 / ; Horizontal tab
                    %x0A / ; Line feed or New line
                    %x0D   ; Carriage return
S              = *B        ; optional blank space
RS             = 1*B       ; required blank space

FUNCTION Normalize(i, len):
  IF i >= 0 THEN
    RETURN i
  ELSE
    RETURN len + i
  END IF

FUNCTION Bounds(start, end, step, len):
  n_start = Normalize(start, len)
  n_end = Normalize(end, len)

  IF step >= 0 THEN
    lower = MIN(MAX(n_start, 0), len)
    upper = MIN(MAX(n_end, 0), len)
  ELSE
    upper = MIN(MAX(n_start, -1), len-1)
    lower = MIN(MAX(n_end, -1), len-1)
  END IF

  RETURN (lower, upper)

IF step > 0 THEN

  i = lower
  WHILE i < upper:
    SELECT a(i)
    i = i + step
  END WHILE

ELSE if step < 0 THEN

  i = upper
  WHILE lower < i:
    SELECT a(i)
    i = i + step
  END WHILE

END IF

["a", "b", "c", "d", "e", "f", "g"]

descendant-selector = ".." ( dot-member-name      /  ; ..<name>
                             index-selector       /  ; ..[<index>]
                             index-wild-selector  /  ; ..[*]
                             "*"                     ; ..*
                           )

{
  "o": {"j": 1, "k": 2},
  "a": [5, 3, [{"j": 4}]]
}

filter-selector    = "[" S filter S "]"
filter             = "?" S boolean-expr

boolean-expr     = logical-or-expr
logical-or-expr  = logical-and-expr *(S "||" S logical-and-expr)
                                                      ; disjunction
                                                      ; binds less tightly than conjunction
logical-and-expr = basic-expr *(S "&&" S basic-expr)  ; conjunction
                                                      ; binds more tightly than disjunction

basic-expr        = exist-expr /
                    paren-expr /
                    relation-expr
exist-expr        = [neg-op S] singular-path          ; path existence or non-existence

singular-path     = rel-singular-path / abs-singular-path
rel-singular-path = "@" *(S (dot-selector / index-selector))
abs-singular-path = root-selector *(S (dot-selector / index-selector))

paren-expr        = [neg-op S] "(" S boolean-expr S ")" ; parenthesized expression
neg-op            = "!"                               ; not operator

relation-expr = comp-expr /                           ; comparison test
                regex-expr                            ; regular expression test

comp-expr    = comparable S comp-op S comparable
comparable   = number / string-literal /              ; primitive ...
               true / false / null /                  ; values only
               singular-path                          ; Singular Path value
comp-op      = "==" / "!=" /                          ; comparison ...
               "<"  / ">"  /                          ; operators
               "<=" / ">="

number       = int [ frac ] [ exp ]                   ; decimal number
frac         = "." 1*DIGIT                            ; decimal fraction
exp          = "e" [ "-" / "+" ] 1*DIGIT              ; decimal exponent
true         = %x74.72.75.65                          ; true
false        = %x66.61.6c.73.65                       ; false
null         = %x6e.75.6c.6c                          ; null

regex-expr   = (singular-path / string-literal) S regex-op S regex
regex-op     = "=~"                                   ; regular expression match
regex        = string-literal                         ; I-Regexp

{
  "a": [3, 5, 1, 2, 4, 6, {"b": "ij"}, {"b": "ik"}],
  "o": {"p": 1, "q": 2, "r": 3, "s": 5, "t": {"u": 6}}
}

list-selector  = "[" S list-entry 1*(S "," S list-entry) S "]"

list-entry     =  ( quoted-member-name /
                    element-index      /
                    slice-index /
                    filter
                  )

["a", "b", "c", "d", "e", "f", "g"]

3.6. Semantics of null

Note that JSON null is treated the same as any other JSON value: it is not taken to mean "undefined" or "missing".¶

{"a": null, "b": [null], "c": [{}], "null": 1}

3.7. Normalized Paths

A Normalized Path is a JSONPath with restricted syntax that identifies a node by providing a query that results in exactly that node. For example, the JSONPath expression $.book[?(@.price<10)] could select two values with Normalized Paths $['book'][3] and $['book'][5]. For a given JSON document, there is a one to one correspondence between the document's nodes and the Normalized Paths that identify these nodes.¶

A JSONPath implementation may output Normalized Paths instead of, or in addition to, the values identified by these paths.¶

Since bracket notation is more general than dot notation, it is used to construct Normalized Paths. Single quotes are used to delimit string member names. This reduces the number of characters that need escaping when Normalized Paths appear as strings (which are delimited with double quotes) in JSON documents.¶

The syntax of Normalized Paths is restricted so that there is one and only one way of representing any given Normalized Path. Putting this another way, for any two distinct Normalized Paths, a JSON document exists that will yield distinct results when the Normalized Paths are applied to it.¶

Certain characters are escaped, in one and only one way; all other characters are unescaped.¶

Normalized Paths are Singular Paths. Not all Singular Paths are Normalized Paths: $[-3], for example, is a Singular Path, but not a Normalized Path.¶

normalized-path           = root-selector *(normal-index-selector)
normal-index-selector     = "[" (normal-quoted-member-name / normal-element-index) "]"
normal-quoted-member-name = %x27 *normal-single-quoted %x27 ; 'string'
normal-single-quoted      = normal-unescaped /
                            ESC normal-escapable
normal-unescaped          = %x20-26 /                       ; omit control codes
                            %x28-5B /                       ; omit '
                            %x5D-10FFFF                     ; omit \
normal-escapable          = ( %x62 / %x66 / %x6E / %x72 / %x74 / ; \b \f \n \r \t
                                ; b /         ;  BS backspace U+0008
                                ; t /         ;  HT horizontal tab U+0009
                                ; n /         ;  LF line feed U+000A
                                ; f /         ;  FF form feed U+000C
                                ; r /         ;  CR carriage return U+000D
                                "'" /         ;  ' apostrophe U+0027
                                "\" /         ;  \ backslash (reverse solidus) U+005C
                                (%x75 normal-hexchar) ;  certain values u00XX U+00XX
                            )
normal-hexchar            = "0" "0"
                            (
                              ("0" %x30-37) / ; "00"-"07"
                              ("0" %x62) /    ; "0b"      ; omit U+0008-U+000A
                              ("0" %x65-66) /  ; "0e"-"0f" ; omit U+000C-U+000D
                              ("1" normal-HEXDIG)
                            )
normal-HEXDIG             = DIGIT / %x61-66   ; "0"-"9", "a"-"f"
normal-element-index      = "0" / (DIGIT1 *DIGIT) ; non-negative decimal integer

4.1. Registration of Media Type application/jsonpath

IANA is requested to register the following media type [RFC6838]:¶

Type name:

application¶

Subtype name:

jsonpath¶

Required parameters:

N/A¶

Optional parameters:

N/A¶

Encoding considerations:

binary (UTF-8)¶

Security considerations:

See the Security Considerations section of RFCXXXX.¶

Interoperability considerations:

N/A¶

Published specification:

RFCXXXX¶

Applications that use this media type:

Applications that need to convey queries in JSON data¶

Fragment identifier considerations:

N/A¶

Additional information:

Deprecated alias names for this type:

N/A¶

Magic number(s):

N/A¶

File extension(s):

N/A¶

Macintosh file type code(s):

N/A¶

Person & email address to contact for further information: iesg@ietf.org¶

Intended usage:

COMMON¶

Restrictions on usage:

N/A¶

Author:

JSONPath WG¶

Change controller:

IESG¶

Provisional registration? (standards tree only):

no¶

5.1. Attack vectors on JSONPath Implementations

Historically, JSONPath has often been implemented by feeding parts of the query to an underlying programming language engine, e.g., JavaScript. This approach is well known to lead to injection attacks and would require perfect input validation to prevent these attacks (see Section 12 of [RFC8259] for similar considerations for JSON itself). Instead, JSONPath implementations need to implement the entire syntax of the query without relying on the parsers of programming language engines.¶

Attacks on availability may attempt to trigger unusually expensive runtime performance exhibited by certain implementations in certain cases. (See Section 10 of [RFC8949] for issues in hash-table implementations, and Section 8 of [I-D.draft-bormann-jsonpath-iregexp] for performance issues in regular expression implementations.) Implementers need to be aware that good average performance is not sufficient as long as an attacker can choose to submit specially crafted JSONPath queries that trigger surprisingly high, possibly exponential, CPU usage.¶

5.2. Attacks on Security Mechanisms that Employ JSONPath

Where JSONPath is used as a part of a security mechanism, attackers can attempt to evoke unexpected behavior, or take advantage of differences in behavior between JSONPath implementations.¶

This also applies to underlying technologies such as UTF-8 (see Section 10 of [RFC3629]), the Unicode character set, and JSON. A characteristic of JSON that can lead to varying results is the fact that JSON objects are unordered; therefore, the order in which results of a JSONPath query reflect the presence of JSON object members can vary with implementations.¶

A.1. JSONPath and XPath

JSONPath expressions apply to JSON values in the same way as XPath expressions are used in combination with an XML document. JSONPath uses $ to refer to the root node of the argument, similar to XPath's / at the front.¶

JSONPath expressions move further down the hierarchy using dot notation ($.store.book[0].title) or the bracket notation ($['store']['book'][0]['title']), a lightweight/limited, and a more heavyweight syntax replacing XPath's / within query expressions.¶

Both JSONPath and XPath use * for a wildcard. The descendant operator .., borrowed from [E4X], is similar to XPath's //. The array slicing construct [start:end:step] is unique to JSONPath, inspired by [SLICE] from ECMASCRIPT 4.¶

Filter expressions are supported via the syntax ?(<boolean expr>) as in¶

$.store.book[?(@.price < 10)].title

Table 17 extends Table 1 by providing a comparison with similar XPath concepts.¶

For further illustration, Table 18 shows some XPath expressions and their JSONPath equivalents.¶

XPath has a lot more functionality (location paths in unabbreviated syntax, operators and functions) than listed in this comparison. Moreover, there are significant differences in how the subscript operator works in XPath and JSONPath:¶

• Square brackets in XPath expressions always operate on the node set resulting from the previous path fragment. Indices always start at 1.¶
• With JSONPath, square brackets operate on the object or array addressed by the previous path fragment. Array indices always start at 0.¶