---
name: "X-Up-Validate"
area: "API"
kind: "HTTP header"
parent: "up.protocol module"
url: "https://unpoly.com/api/X-Up-Validate"
---
<nav aria-label="Unpoly docs">[All docs](https://unpoly.com/index.md) · [up.protocol module](https://unpoly.com/api/up.protocol.md)</nav>

# X-Up-Validate

This request header contains the names of the [form fields being validated](https://unpoly.com/api/up-validate.md).

When seeing this header, the server is [expected](https://unpoly.com/api/up-validate.md#backend-protocol) to validate (but not save) the form submission and render a new form state with validation errors. See the documentation for [`[up-validate]`](https://unpoly.com/api/up-validate.md) for more information on how server-side validation works in Unpoly.

<nav aria-label="Contents">

#### Contents

- [Example](#example)
- [Batched validations](#batched-validations)
- [When no origin field is known](#when-no-origin-field-is-known)
- [When too many fields are validated](#when-too-many-fields-are-validated)

</nav>

## Example {#example}

Let's look at a registration form that uses [`[up-validate]`](https://unpoly.com/api/up-validate.md) to validate form groups as the user completes fields:

```html
<form action="/users">

  <fieldset>
    <label for="email">E-mail</label>
    <input type="text" id="email" name="email" up-validate>
  </fieldset>

  <fieldset>
    <label for="password">Password</label>
    <input type="password" id="password" name="password" up-validate>
  </fieldset>

  <button type="submit">Register</button>

</form>
```

When the `email` input is changed, Unpoly will submit the form with an additional `X-Up-Validate` header:

```http
X-Up-Validate: email
X-Up-Target: fieldset:has(#email)
```

## Batched validations {#batched-validations}

If multiple validations are [batched](https://unpoly.com/api/up.validate.md#batching) into a single request, `X-Up-Validate` contains a space-separated list of all validating field names:

```http
X-Up-Validate: email password
X-Up-Target: fieldset:has(#password), fieldset:has(#email)
```

## When no origin field is known {#when-no-origin-field-is-known}

When [`up.validate()`](https://unpoly.com/api/up.validate.md) is called with a non-field element, Unpoly might not know which element triggered the validation. In that case the header value will be `:unknown`:

```http
X-Up-Validate: :unknown
X-Up-Target: .preview
```

## When too many fields are validated {#when-too-many-fields-are-validated}

Validating a long form may cause the `X-Up-Validate` header to become excessively long. This may cause web infrastructure to reject the request with a `413 Entity Too Large` error.

To prevent this, the header value is set to `:unknown` if its length exceeds [`up.protocol.config.maxHeaderSize`](https://unpoly.com/api/up.protocol.config.md#config.maxHeaderSize).