Skip to main content

path-percent-encoded

Disallows allowReserved: true on path parameters.

AttributeValue
CategoryOperations
MaturityGold
OpenAPIOpenAPI 3.0, 3.1, 3.2
StarterOff
Lenient–StrictWarning
CompleteError

Intent

Keeping reserved characters encoded prevents a path value from being mistaken for URL structure by clients, routers, or gateways.

Flags

A path parameter belonging to a path operation when allowReserved is explicitly true. Path-level and operation-level parameters are included.

Does not flag

Non-path parameters, parameters outside a path operation, or path parameters where allowReserved is false or omitted.

See it fail

- name: paymentId
in: path
required: true
allowReserved: true
schema:
type: string

Diagnostic: Path parameters should keep `allowReserved` false for percent encoding.

Fix it

- name: paymentId
in: path
required: true
allowReserved: false
schema:
type: string

Omitting allowReserved has the same false default.

Configure

profiles:
default:
rules:
extends: [recommended]
override:
path-percent-encoded: error

Nearby: query-percent-encoded, path-parameters-defined.