Description
A path item without operations does not tell readers which requests the path supports. However, OpenAPI 3.0 and 2.0 allow empty path items for access-control reasons, and a referenced path item may supply operations through $ref.
Potential impact
Unintentionally omitted operations can leave consumers unaware of supported methods and make document-based integration or testing incomplete. Hiding an operation in the document does not block access to the server.
Remediation
Check which operations the document’s audience should see, including referenced path items. Add only actual HTTP methods and responses that should be documented, and retain intentionally empty items. Enforce server authentication and permissions separately.
Examples
These OpenAPI 3.0 excerpts compare an empty path item with one containing an operation. The info object is omitted. An empty item is not itself a specification violation.
Before
{
"openapi": "3.0.0",
"paths": {
"/": {}
}
}
After
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "OK"
}
}
}
}
}
}
The second excerpt describes GET / and its 200 response. This addition is appropriate when the API provides that operation and it should be documented for the audience.