Description
enum limits the allowed values. A value must also satisfy other constraints such as type. A numeric schema listing only a string has no value that satisfies both. If only some enum entries conflict with the type, those entries are not allowed.
Potential impact
- Consumers may send a listed value and still fail type validation.
- Documentation or generated clients may misrepresent the values actually accepted.
Remediation
Check the actual API data type and permitted values, then align enum and type. Distinguish numeric strings from numbers and ensure intended values satisfy the other constraints as well.
Examples
These OpenAPI 3.0 response-schema excerpts omit info. The first allows only the string "black" while requiring a number, so no response value can satisfy both constraints.
Before
json
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"201": {
"description": "Created",
"content": {
"text/html": {
"schema": {
"type": "number",
"enum": [
"black"
]
}
}
}
}
}
}
}
}
}
After
json
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"201": {
"description": "Created",
"content": {
"text/html": {
"schema": {
"type": "number",
"enum": [
1,
2,
3
]
}
}
}
}
}
}
}
}
}
The second allows the numbers 1, 2 and 3. Choose the status code, media type and value list according to the actual response contract.