Developer API · read-only · no Excel, no macros run

XLSX Inspector API

Inspect the structure of any .xlsx / .xlsm workbook before you ingest it — sheets, hidden tabs, formula counts, cached errors, merged ranges, external links, and macro presence. One POST, one JSON answer. It never opens Excel, recalculates formulas, or executes VBA.

LIVE · try it below

Developer guide: command-line recipes →

What it returns

Sheets & visibilitycount, names, visible / hidden / veryHidden
Formulas & errorsper-sheet + total formula and cached-error counts
Macros & linksvbaProject.bin presence, external-link parts
Merged rangesper-sheet merged-cell region counts
Defined namesnamed-range count and calc settings
Safe by designstdlib-only parsing, 15 MiB cap, zip-bomb bounds

Live demo

POST /inspect · multipart file

How it works

  1. The API reads an XLSX or XLSM OOXML package and returns the uploaded filename, compressed size, expanded size, sheet count, and sheet names.
  2. Each sheet includes its visibility state plus formula, cached error-cell, and merged-range counts; the totals object aggregates those counts.
  3. The report flags external-link package parts and the presence of xl/vbaProject.bin, and it includes shared-string, defined-name, and calculation-setting fields.
  4. It does not launch Excel, recalculate formulas, execute VBA, inspect macro code, or fetch external-link targets.

Frequently asked questions

Does XLSX Inspector open Excel or run VBA?

No. It reads OOXML ZIP and XML structures and reports whether xl/vbaProject.bin is present; it does not execute or analyze VBA.

Which spreadsheet formats are supported?

It supports XLSX and XLSM OOXML workbooks. Legacy binary XLS files and password-encrypted packages are not supported.

What does it report about formulas?

It returns per-sheet and total formula counts, cached error-cell counts, and workbook calculation settings. It does not recalculate formulas, so cached values may be stale.

Can this report prove that a workbook is safe?

No. This is a structural report, not a malware verdict. External links are detected by package-part presence, and their targets are not fetched or validated.

What upload limits and safety checks apply?

Uploads are limited to 15 MiB. The parser also bounds ZIP entries and expanded sizes and rejects encrypted entries, unsafe paths, ambiguous duplicates, and oversized XML members.

Use it from the command line

curl --fail-with-body \
  -F '[email protected];type=application/vnd.ms-excel.sheet.macroEnabled.12' \
  https://api.lifestep.io/inspect | jq '{filename,sheet_count,sheet_names,totals,has_external_links,has_vba_project}'

Response sample from the checked two-sheet sample workbook:

{
  "filename": "sample.xlsm",
  "sheet_count": 2,
  "sheet_names": ["Data", "Hidden Calc"],
  "totals": {
    "formula_count": 3,
    "cached_error_cells_count": 1,
    "merged_range_count": 2
  },
  "has_external_links": true,
  "has_vba_project": true
}

Privacy

The application has no workbook storage or persistence layer. It reads the request, returns a structural report, and does not retain the uploaded workbook after request handling.

Automating spreadsheet intake? Make the validation gate explicit.

Use the agent verification guide to design file-inspection pipelines with clear acceptance checks, failure handling, and human review before downstream processing.