XEIZE
/Vulnerability documentation/IaC/OpenAPI/Shared topics

Shared topics

Guidance on shared security settings, parameters, responses, schemas and references in OpenAPI 2.0 and 3.0.

Documentation

Article Path
DELETE success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_delete_operation
GET success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_get_operation
HEAD success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_head_operation
Object schema without defined properties openAPI/general/json_object_schema_without_properties
Object schema without a type constraint openAPI/general/json_object_schema_without_type
PATCH success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_patch_operation
POST success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_post_operation
PUT success response is undefined (OpenAPI 3.0) openAPI/general/success_response_code_undefined_put_operation
Empty Schema Object openAPI/general/schema_object_empty
Review additional properties on reference objects openAPI/general/json_ref_alongside_properties
Review the OpenAPI contact URL openAPI/general/invalid_contact_url
Review the OpenAPI contact email openAPI/general/invalid_contact_email
Default value does not match the type (OpenAPI 3.0) openAPI/general/default_invalid
Review enum and additional schema constraints openAPI/general/object_using_enum_with_keyword
Example value does not match the schema type (OpenAPI 3.0) openAPI/general/example_not_compliant_with_schema_type
Review an Accept header parameter definition openAPI/general/header_parameter_named_as_accept
Review an Authorization header parameter definition openAPI/general/header_parameter_named_as_authorization
Review a Content-Type header parameter definition openAPI/general/header_parameter_named_as_content_type
Review the OpenAPI license URL openAPI/general/invalid_license_url
Schema minimum exceeds its maximum openAPI/general/property_defining_maximum_not_greater_than_minimum
Review the operation’s external documentation URL openAPI/general/invalid_operation_external_documentation_url
Review schema definitions for required properties openAPI/general/properties_missing_required_property
Review response header definitions and HTTP semantics openAPI/general/header_response_name_is_invalid
Review the schema’s external documentation URL openAPI/general/invalid_schema_external_documentation_url
Review tag external documentation URLs openAPI/general/invalid_tag_external_documentation_url
Path placeholder has no corresponding path parameter openAPI/general/template_path_parameter_with_no_corresponding_path_parameter
Path parameter has no matching path placeholder openAPI/general/path_parameter_with_no_corresponding_template_path
Ambiguous path definitions openAPI/general/path_ambiguous
String pattern is undefined (OpenAPI 3.0) openAPI/general/pattern_undefined
Maximum string length is undefined (OpenAPI 3.0) openAPI/general/maximum_length_undefined
String pattern is too broad (OpenAPI 3.0) openAPI/general/string_schema_with_broad_pattern
Review discriminator value types and mappings openAPI/general/schema_discriminator_property_not_string
Array without an item limit openAPI/general/array_without_maximum_number_items
Array item definition is missing openAPI/general/items_undefined
Array item type is undefined (OpenAPI 3.0) openAPI/general/array_items_has_no_type
A body is defined for a bodyless response (OpenAPI 3.0) openAPI/general/response_operations_body_schema_incorrect_defined
Review schema type and items usage openAPI/general/non_array_schema_with_items
An operation-level security array is empty openAPI/general/security_operations_empty_array
Review the paths published in OpenAPI openAPI/general/paths_object_empty
Review OpenAPI response definitions openAPI/general/responses_object_is_empty
The global security array is empty openAPI/general/security_empty_array
An operation-level security value contains an empty object openAPI/general/security_operations_empty_object_definition
Global security contains an empty object openAPI/general/security_empty_object_definition
Path placeholder has an empty name openAPI/general/path_template_empty
Review normal operation response definitions openAPI/general/operation_without_successful_http_status_code
Review discriminator property definitions openAPI/general/schema_discriminator_mismatch_defined_properties
Numeric format is unspecified (OpenAPI 3.0) openAPI/general/numeric_schema_without_format
Maximum numeric value is undefined (OpenAPI 3.0) openAPI/general/numeric_schema_without_maximum
Minimum numeric value is undefined (OpenAPI 3.0) openAPI/general/numeric_schema_without_minimum
Response body without a documented schema openAPI/general/response_operations_body_schema_undefined
Review direct self-references in schema composition openAPI/general/schema_object_with_circular_ref
Default response is undefined (OpenAPI 3.0) openAPI/general/default_response_undefined_operations
Review transport security for operation API keys (OpenAPI 3.0) openAPI/general/api_key_exposed_in_operation_security
Review operation visibility for an OpenAPI path openAPI/general/path_without_operation
Invalid HTTP response status code openAPI/general/responses_wrong_http_status_code
allowEmptyValue is used in an unsupported location openAPI/general/property_allow_empty_value_improperly_defined
Review the global external documentation URL openAPI/general/invalid_global_external_documentation_url
An OpenAPI document has no global authentication requirement openAPI/general/global_security_field_undefined
An OpenAPI operation has no declared authentication requirement openAPI/general/no_global_and_operation_security_defined
Review transport security for global API keys (OpenAPI 3.0) openAPI/general/api_key_exposed_in_global_security
Review type definitions for required properties openAPI/general/schema_required_property_undefined
Duplicate operationId values openAPI/general/operation_id_not_unique
Review property constraints in composed schemas openAPI/general/schema_object_properties_with_duplicated_keys
Review parameter identities and usage locations openAPI/general/parameters_name_in_not_unique
Review duplicate header parameter names openAPI/general/parameter_objects_headers_dup_name
Review enum values against the schema type openAPI/general/schema_enum_invalid
Numeric format does not match the type (OpenAPI 3.0) openAPI/general/invalid_format
Review schema constraints for the declared type openAPI/general/type_has_invalid_keyword
Review required properties and default-value behavior openAPI/general/required_property_default_value
Expected response code is missing (OpenAPI 3.0) openAPI/general/response_code_missing
Discriminator property is not required openAPI/general/schema_discriminator_not_required
Path parameter is not marked as required openAPI/general/path_parameter_not_required

Related pages72

DELETE success response is undefined (OpenAPI 3.0)

The OpenAPI responses omit the successful outcome of a deletion request

GET success response is undefined (OpenAPI 3.0)

The documentation omits the status code returned for a successful retrieval

HEAD success response is undefined (OpenAPI 3.0)

A HEAD operation lacks a success response for retrieving metadata without a body

Object schema without defined properties

Use properties to describe objects with a fixed set of fields.

Object schema without a type constraint

Specify an object type constraint when a schema should accept only objects.

PATCH success response is undefined (OpenAPI 3.0)

The documentation omits the successful outcome of a partial resource update

POST success response is undefined (OpenAPI 3.0)

The documentation omits the successful result of a creation or processing request

PUT success response is undefined (OpenAPI 3.0)

A resource creation or replacement operation lacks a success response

Empty Schema Object

Add necessary constraints to an empty schema when the data structure must be restricted.

Review additional properties on reference objects

Check whether properties beside a reference apply under the specification version in use.

Review the OpenAPI contact URL

Check that the contact link leads to the correct support page.

Review the OpenAPI contact email

Check the contact address and whether its mailbox can receive mail.

Default value does not match the type (OpenAPI 3.0)

A default value conflicts with its declared data type

Review enum and additional schema constraints

Review enum values together with other constraints to make the actual allowed values clear.

Example value does not match the schema type (OpenAPI 3.0)

A documented example uses a different type from its associated schema

Review an Accept header parameter definition

Separate response-format negotiation from ordinary input parameters.

Review an Authorization header parameter definition

Express authentication requirements through security schemes.

Review a Content-Type header parameter definition

Describe the request media type in the body definition.

Review the OpenAPI license URL

Check that the license link identifies the correct terms document.

Schema minimum exceeds its maximum

Keep minimum numeric values, string lengths and array sizes within their corresponding maximums.

Review the operation’s external documentation URL

Check that an operation’s detailed guide is linked correctly.

Review schema definitions for required properties

Separate required presence from value constraints and define both to match the API contract.

Review response header definitions and HTTP semantics

Document response formats separately from actual response headers.

Review the schema’s external documentation URL

Connect the data model to the correct supporting documentation.

Review tag external documentation URLs

Check that each tag links to the intended supporting documentation.

Path placeholder has no corresponding path parameter

Define a required path parameter with the matching name at path or operation level.

Path parameter has no matching path placeholder

Match every path parameter to a placeholder with the same name in the path template.

Ambiguous path definitions

Do not treat identical path patterns with different variable names as separate endpoints.

String pattern is undefined (OpenAPI 3.0)

A string with a defined format lacks the necessary pattern constraint

Maximum string length is undefined (OpenAPI 3.0)

A string that needs a length limit lacks maxLength

String pattern is too broad (OpenAPI 3.0)

A string pattern does not adequately restrict the intended format

Review discriminator value types and mappings

Align discriminator values with schema mappings and check any reliance on string conversion.

Array without an item limit

Use maxItems to document a maximum length when an array needs an item limit.

Array item definition is missing

Array schemas and parameters need an items definition appropriate to their specification version.

Array item type is undefined (OpenAPI 3.0)

An array that expects a specific type does not constrain its item type

A body is defined for a bodyless response (OpenAPI 3.0)

A response body definition for HEAD, 204, or 304 conflicts with HTTP semantics

Review schema type and items usage

Use items for actual array elements and align it with the data type.

An operation-level security array is empty

An empty operation-level security array removes the inherited authentication requirement.

Review the paths published in OpenAPI

Check whether an empty paths object matches the intended audience and document the paths they need.

Review OpenAPI response definitions

Define at least one actual response in each operation’s responses object.

The global security array is empty

An empty global security array declares no default authentication requirement.

An operation-level security value contains an empty object

Distinguish an empty authentication requirement from an invalid security value and declare the intended policy.

Global security contains an empty object

An empty requirement object in global security allows an unauthenticated alternative.

Path placeholder has an empty name

Give path placeholders a name and define a required parameter with the same name.

Review normal operation response definitions

Document the outcomes that an operation actually returns during normal processing.

Review discriminator property definitions

Align the discriminator property name with the actual data and schema definition.

Numeric format is unspecified (OpenAPI 3.0)

A numeric schema does not specify its representation using format

Maximum numeric value is undefined (OpenAPI 3.0)

A numeric field that needs an upper bound lacks a maximum constraint

Minimum numeric value is undefined (OpenAPI 3.0)

A numeric field that needs a lower bound lacks a minimum constraint

Response body without a documented schema

Document the media type and structure of responses that actually return a body.

XEIZE DocumentationTechnical support