Schema property has conflicting readOnly and writeOnly settings

Do not set both readOnly and writeOnly to true on the same property.

Description

In OpenAPI 3.0, readOnly: true describes a property for responses, while writeOnly: true describes a property for requests. Setting both to true on the same property creates conflicting directions and violates the specification.

Potential impact

  • API consumers may be unsure whether to send the property in a request or receive it in a response.
  • Code generators or validators may reject the definition or build incorrect request and response models.

Remediation

Set only readOnly to true for response-only properties, or only writeOnly to true for request-only properties. For properties used in both directions, omit both flags or set them to false. Check that server input handling and response serialization follow this contract.

Examples

These examples compare the integer id property of an object schema. The requests or responses using GeneralError are omitted.

Before

json
{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0",
    "contact": {
      "name": "contact",
      "url": "https://www.google.com/",
      "email": "user@gmail.c"
    }
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "examples": {
                  "foo": {
                    "value": {
                      "versions": [
                        {
                          "status": "CURRENT",
                          "updated": "2011-01-21T11:33:21Z",
                          "id": "v2.0",
                          "links": [
                            {
                              "href": "http://127.0.0.1:8774/v2/",
                              "rel": "self"
                            }
                          ]
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "GeneralError": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "writeOnly": true,
            "readOnly": true
          },
          "code": {
            "type": "integer",
            "format": "int32"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ]
      }
    }
  }
}

After

json
{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0",
    "contact": {
      "name": "contact",
      "url": "https://www.google.com/",
      "email": "user@gmail.c"
    }
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "examples": {
                  "foo": {
                    "value": {
                      "versions": [
                        {
                          "status": "CURRENT",
                          "updated": "2011-01-21T11:33:21Z",
                          "id": "v2.0",
                          "links": [
                            {
                              "href": "http://127.0.0.1:8774/v2/",
                              "rel": "self"
                            }
                          ]
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "GeneralError": {
        "type": "object",
        "properties": {
          "id": {
            "type": "integer",
            "readOnly": true
          },
          "code": {
            "type": "integer",
            "format": "int32"
          },
          "message": {
            "type": "string"
          }
        },
        "required": [
          "name"
        ]
      }
    }
  }
}

The revised id keeps only readOnly: true to identify it as a response property. Changing the schema alone does not change server input handling or access controls.

References