n8n workflow JSON audit
Read the exported graph before it runs.
Inspect one sanitized n8n workflow export for broken connection references, duplicate node names, unauthenticated webhooks, credential references, disabled nodes, external-action types, and visible failure-control gaps.
Audit a sanitized exportBrowser-local workflow audit
Inspect the exported graph.
Paste one sanitized n8n workflow export or open a local JSON file. Parsing and checks run in this browser. The file is not uploaded, stored, or sent to n8n.
Remove secrets, customer data, production URLs, tokens, and credential values before using any diagnostic tool.
Sample loadedStructural result
Structural review needed
Sample webhook to APIWebhook authentication is not visible
These Webhook nodes use the exported default or explicit none value. Verify caller controls before activation.
Order webhookExternal-action nodes have no exported retry setting
Retry behavior is not the same as idempotency, but each external action should have an explicit failure and replay plan.
Create orderNo error workflow is referenced
The export does not identify an error workflow. Verify how failures are surfaced and triaged.
This browser-only structural audit does not import or execute the workflow, verify credentials, inspect expressions at runtime, contact n8n, or prove production safety.
What the check actually reads
Structure, references, and visible settings.
The audit intentionally avoids claims it cannot prove from an export. It identifies deterministic structural facts and leaves import, credentials, expressions, connected systems, and runtime behavior for direct testing.
- 01
Graph integrity
Node names, node types, and connection destinations.
- 02
Activation boundary
Active state, disabled nodes, and credential references.
- 03
Caller boundary
Webhook nodes whose exported authentication is none.
- 04
Failure boundary
Visible retry settings and an exported error-workflow reference.
Need a human root-cause review?
Start with the free written fit check.
If the export belongs to one failing automation path, describe the expected behavior, observed behavior, and a sanitized error. You receive the exact diagnostic boundary before any payment decision.
Safe-use boundaries
What the JSON audit can and cannot prove.
Does the workflow leave my browser?
No. Pasted text and opened JSON files are parsed locally in the current browser tab. The tool has no upload, account connection, form submission, or storage step.
Does a clean result prove that the workflow can be imported?
No. This tool does not run n8n, resolve community nodes, validate credentials, evaluate expressions, or execute the workflow. Import and runtime tests remain necessary.
Why does it flag credential references?
Credential references are normal in many exports. The flag is a reminder to confirm that every imported node maps to the intended account and environment before activation.
What should I remove before pasting an export?
Remove secrets, customer data, tokens, sensitive URLs, sample payloads, and any credential values. A sanitized workflow structure is enough for this check.