request-mime-type

Restricts request media types to values configured in allowedValues.

Attribute	Value
Category	Operations
Maturity	Baseline
OpenAPI	Swagger 2.0; OpenAPI 3.0, 3.1, 3.2
Starter–Recommended	Off
Strict	Warning
Complete	Error

Intent

An allowlist keeps request formats within the media types supported by the API platform and its consumers.

Flags

• In Swagger 2.0, each document-level or operation-level consumes value outside the allowlist.
• In OpenAPI 3, disallowed request-body and parameter content keys.
• For callbacks and webhooks, response content is treated as inbound request content.

Comparison is exact and case-sensitive.

Does not flag

The rule produces no findings until allowedValues is configured. It also ignores media types outside request scope.

See it fail

With only application/json allowed:

requestBody:
  content:
    application/xml:
      schema:
        type: object

Diagnostic: Mime type "application/xml" is not allowed

Fix it

Change the contract to an allowed media type, or add the deliberately supported type to the allowlist.

Configure

profiles:
  default:
    rules:
      extends: [strict]
      override:
        request-mime-type:
          severity: error
          allowedValues:
            - application/json
            - application/problem+json

Nearby: response-mime-type, content-type-header-declared.