Description
Empty arrays have different meanings in OpenAPI 3.0. enum: [] contains no allowed values, while operation-level security: [] validly removes global security requirements. Do not insert arbitrary values merely because an array is empty.
Potential impact
- Leaving an array empty when values are needed can disrupt validation or client generation.
- Confusing intentional empty values with omissions can change documented authentication requirements or data contracts incorrectly.
Remediation
Check the field’s purpose and its OpenAPI 3.0 meaning. Add values reflecting actual behavior where values are needed, and retain intentional empty arrays. When changing security declarations, also check the actual access policy and server-side authentication.
Examples
The first example provides no allowed values in the status response enum.
Before
json
{
"openapi": "3.0.0",
"info": {"title": "Status API", "version": "1.0.0"},
"paths": {
"/status": {
"get": {
"responses": {
"200": {
"description": "Current status",
"content": {
"application/json": {
"schema": {"type": "string", "enum": []}
}
}
}
}
}
}
}
}
After
json
{
"openapi": "3.0.0",
"info": {"title": "Status API", "version": "1.0.0"},
"paths": {
"/status": {
"get": {
"responses": {
"200": {
"description": "Current status",
"content": {
"application/json": {
"schema": {"type": "string", "enum": ["ready", "busy"]}
}
}
}
}
}
}
}
}
The second example lists status values matching the actual response contract. This corrects the enum; it does not mean every empty array needs entries.