Description
OpenAPI 3.0 and 2.0 require the property used by a discriminator to be mandatory. If it is absent from required, the schema may allow an object without the value needed to identify its type.
Potential impact
- Clients and servers may be unable to select a subtype consistently.
- Different presence requirements in the document and actual data can cause integration failures.
Remediation
Include the property named by OpenAPI 3.0 discriminator.propertyName or OpenAPI 2.0 discriminator in required. Preserve other requirements in composed schemas and verify the value in actual requests and responses.
Examples
These OpenAPI 3.0 parent-schema excerpts omit subtypes, polymorphic composition, info and paths. The first requires only name, not the discriminator property petType.
Before
json
{
"openapi": "3.0.0",
"components": {
"schemas": {
"GeneralError": {
"type": "object",
"discriminator": {
"propertyName": "petType"
},
"properties": {
"petType": {
"type": "string"
}
},
"required": [
"name"
]
}
}
}
}
After
json
{
"openapi": "3.0.0",
"components": {
"schemas": {
"GeneralError": {
"type": "object",
"discriminator": {
"propertyName": "petType"
},
"properties": {
"petType": {
"type": "string"
}
},
"required": [
"petType"
]
}
}
}
}
The second makes petType required. It also removes name from the required list; retain both names if the actual contract still requires name.