code: public static String validateServices(ToolConsumer consumer, JSONObject providerProfile) 
  	{
  		// Mostly to catch casting errors from bad JSON
  		try {
  			JSONObject security_contract = (JSONObject) providerProfile.get(LTI2Constants.SECURITY_CONTRACT);
  			if ( security_contract == null  ) {
  				return "JSON missing security_contract";
  			}
  			JSONArray tool_services = (JSONArray) security_contract.get(LTI2Constants.TOOL_SERVICE);
  
  			List<ServiceOffered> services_offered = consumer.getService_offered();
  
  			if ( tool_services != null ) for (Object o : tool_services) {
  				JSONObject tool_service = (JSONObject) o;
  				String json_service = (String) tool_service.get(LTI2Constants.SERVICE);
  
  				boolean found = false;
  				for (ServiceOffered service : services_offered ) {
  					String service_endpoint = service.getEndpoint();
  					if ( service_endpoint.equals(json_service) ) {
  						found = true;
  						break;
  					}
  				}
  				if ( ! found ) return "Service not allowed: "+json_service;
  			}
  			return null;
  		}
  		catch (Exception e) {
  			return "Exception:"+ e.getLocalizedMessage();
  		}
  	}
docs: Validate the incoming tool_services against a tool consumer