Declarative Onboarding is the sibling of AS3, and the split between them is the cleanest way to hold both in your head: AS3 configures the Layer 4-7 application services on a BIG-IP that is already on the network, and DO does the Layer 1-3 onboarding that gets it there. Licensing, module provisioning, DNS and NTP, VLANs and self IPs and routes, user accounts, and the clustering that joins boxes into a high-availability pair are all DO's job. This tool renders each declaration back to you the way the docs describe it.
Paste the JSON you POST to /mgmt/shared/declarative-onboarding and it first tells you what kind of document it is: a bare Device declaration, which is what you send straight to a BIG-IP, or a class DO request wrapper carrying a targetHost, which is what you send to a BIG-IQ to onboard a device remotely. It reads the top-level options, the schemaVersion, async, webhook, and label, and then walks the one tenant a DO declaration is allowed to have, which the schema requires be named Common.
The walk is grouped by the phase DO effectively onboards in, because the order is the intuition worth carrying: licensing and provisioning gate the modules that everything else depends on, system identity like hostname and DNS and NTP and users is foundational, networking builds the data plane of VLANs and self IPs and routes, and clustering joins the onboarded box to its peers. Every class is named and explained from F5's schema reference, and a class this tool does not recognize is still reported rather than dropped.
Three documented gotchas are enforced mechanically rather than left to a footnote. The hostname may be set on Common or inside a System class, but not both, and declaring it twice is flagged. A SelfIp that omits allowService is flagged with the version note that matters: DO 1.36 changed that default from default to none, so a self IP that used to inherit management-plus-default-services now allows nothing until you say otherwise. And a root user without its oldPassword is flagged, because DO cannot change the root password without the existing one. The tool also surfaces the async behavior: async: true returns a 202 with a task id immediately, and you poll that task with GET until it completes.
This is a structure explainer and sanity checker, not a full JSON-Schema validator; F5 publishes the DO schema for VS Code validation, and a declaration that passes here can still be rejected by DO itself. Everything runs locally, nothing you paste leaves the page, and nothing here ever contacts a BIG-IP or a BIG-IQ.