Description
A schema’s externalDocs.url links to separate documentation of the model’s meaning or constraints. A wrong link makes that information difficult to find. OpenAPI 3.0 relative URLs can be resolved against the server URL.
Potential impact
API consumers may miss business meanings or detailed constraints, leading to data-handling and integration errors.
Remediation
Link to the actual documentation for the schema and check both address and content. Verify relative links against the intended base server URL; an explicit URL can identify an independent documentation site.
Examples
These OpenAPI 3.0 examples compare / with an explicit documentation address on the User schema. A relative path is not inherently an incorrect link.
Before
{
"openapi": "3.0.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0",
"contact": {
"name": "contact",
"url": "https://www.google.com/",
"email": "user@gmail.com"
}
},
"paths": {
"/": {
"get": {
"operationId": "listVersionsv2",
"summary": "List API versions",
"responses": {
"200": {
"description": "200 response",
"content": {
"application/json": {
"examples": {
"foo": {
"value": {
"versions": [
{
"status": "CURRENT",
"updated": "2011-01-21T11:33:21Z",
"id": "v2.0",
"links": [
{
"href": "http://127.0.0.1:8774/v2/",
"rel": "self"
}
]
}
]
}
}
}
}
}
}
}
}
}
},
"components": {
"schemas": {
"User": {
"type": "object",
"properties": {
"id": {
"type": "integer"
},
"name": {
"type": "string"
}
},
"externalDocs": {
"url": "/"
}
}
}
}
}
After
{
"openapi": "3.0.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0",
"contact": {
"name": "contact",
"url": "https://www.google.com/",
"email": "user@gmail.com"
}
},
"paths": {
"/": {
"get": {
"operationId": "listVersionsv2",
"summary": "List API versions",
"responses": {
"200": {
"description": "200 response",
"content": {
"application/json": {
"examples": {
"foo": {
"value": {
"versions": [
{
"status": "CURRENT",
"updated": "2011-01-21T11:33:21Z",
"id": "v2.0",
"links": [
{
"href": "http://127.0.0.1:8774/v2/",
"rel": "self"
}
]
}
]
}
}
}
}
}
}
}
}
}
},
"components": {
"schemas": {
"User": {
"type": "object",
"properties": {
"id": {
"type": "integer"
},
"name": {
"type": "string"
}
},
"externalDocs": {
"url": "http://docs.my-api.com/store-orders.htm"
}
}
}
}
}
Check that the revised address actually documents the User model. Changing externalDocs does not itself change the schema’s validation constraints.