Description
In OpenAPI 2.0, consumes lists request body media types. If neither a global nor an operation-level definition exists for a POST, PUT, or PATCH operation that accepts a body, clients may not know which format to send.
Potential impact
Clients may use the wrong Content-Type, causing rejected requests or failures to process the body.
Remediation
List the media types the server actually accepts in global or operation-level consumes. The operation's value overrides the global value. Use application/json for a JSON body and formData parameters for form data.
Examples
The excerpt adds application/json to an operation that accepts a JSON object body.
Before
yaml
swagger: "2.0"
paths:
/users/{id}:
put:
parameters:
- in: body
name: body
schema:
type: object
responses:
"200":
description: ok
After
yaml
swagger: "2.0"
paths:
/users/{id}:
put:
consumes:
- application/json
parameters:
- in: body
name: body
schema:
type: object
responses:
"200":
description: ok