Validate data and payload limits

# Validate data and payload limits

Canonical: https://docs.flowrelay.app/setup/validation/
Markdown: https://docs.flowrelay.app/setup/validation.md

Catch missing or incorrectly typed values before they reach your Shopify Flow workflow. FlowRelay supports a bounded set of validation rules, not the full JSON Schema standard.

## Steps
Complete these in order.
1. Choose when to validate
   In Endpoint setup, expand Validation rules. Before mapping checks the incoming JSON; After mapping checks the custom data object.
2. Declare rules
   Each rule needs a path and type. Add required, nullable, enum, numeric bounds, string lengths, or list sizes where appropriate. A missing optional value is skipped; explicit null needs nullable: true.
3. Preview good and bad samples
   Use synthetic data to verify each rule. A failed preview identifies the stage and rule without delivering an event. Review and confirm before saving.

## Rule examples
Use at most 25 rules before mapping and 25 after mapping. Numeric limits apply to number/integer, length limits to string, and item limits to array. Remote schemas, arbitrary validators, and regex constraints are unsupported.

### Before mapping

```json
[
  {
    "path": "customer.email",
    "type": "string",
    "required": true,
    "minLength": 3,
    "maxLength": 200
  },
  {
    "path": "items",
    "type": "array",
    "required": true,
    "minItems": 1,
    "maxItems": 50
  }
]
```

### After mapping

```json
[
  {
    "path": "total",
    "type": "number",
    "required": true,
    "minimum": 0
  },
  {
    "path": "status",
    "type": "string",
    "enum": [
      "paid",
      "pending"
    ]
  }
]
```


## Payload budgets
Sizes are measured on UTF-8 bytes. The final Flow budget includes field names, ordinary trigger fields, custom JSON, and escaping; it is not just the visible custom-data length.


- Item: Input to custom processing; Limit: 65,536 bytes
- Item: Custom data JSON; Limit: 20,000 bytes
- Item: Complete serialized Flow payload; Limit: 49,000 bytes
- Item: Declared top-level outputs; Limit: 20
- Item: Array length / JSON depth; Limit: 1,000 items / 16 levels
- Item: Input/output inspection; Limit: 8,192 nodes; 100,000 cumulative inspections during evaluation
- Item: Expression execution; Limit: 10,000 evaluator steps; 100 stack frames; 100 ms evaluator timeout
- Item: Generated Run code output schema / code; Limit: 5,000 / 50,000 bytes

## Understand a rejected event
FLR_VALIDATION_FAILED means the input or custom output did not meet the declared rules. FLR_TRANSFORMATION_FAILED means the expression could not produce valid data. FLR_TRANSFORMATION_LIMIT means processing exceeded a bound. FLR_FLOW_PAYLOAD_TOO_LARGE means the complete trigger payload exceeded its size budget. Reduce the data or correct the configuration; nothing is silently truncated.


## Preview, usage, and privacy
Sample previews do not consume live-event quota or run actions in Shopify. Saving configuration follows the existing action-intent and execution allowances. Per-installation abuse limits apply separately. Samples are ephemeral; exports include your mapping literals and defaults, so review them before sharing. Retained delivery data follows the existing plan retention policy.


## Related
- [Trigger variants and mapping](https://docs.flowrelay.app/setup/trigger-variants-and-event-mapping.md)
- [Authenticate requests](https://docs.flowrelay.app/setup/authentication.md)
- [Send your first test event](https://docs.flowrelay.app/getting-started/first-event.md)

## Safety Boundary
Do not share endpoint secrets, authentication headers, HMAC values, tokens, raw event bodies, customer records, Shopify sessions, store passwords, or database URLs in public examples.