response-mime-type

Restricts response media types to values configured in allowedValues.

Attribute	Value
Category	Operations
Maturity	Baseline
OpenAPI	Swagger 2.0; OpenAPI 3.0, 3.1, 3.2
Starter–Recommended	Off
Strict	Warning
Complete	Error

Intent

An allowlist keeps response formats within the media types supported across clients and the API platform.

Flags

• In Swagger 2.0, each document-level or operation-level produces value outside the allowlist.
• In OpenAPI 3, disallowed response content keys.
• For callbacks and webhooks, request-body content is treated as outbound response content.

Comparison is exact and case-sensitive.

Does not flag

The rule produces no findings until allowedValues is configured. It also ignores media types outside response scope.

See it fail

With only application/json allowed:

responses:
  '200':
    description: OK
    content:
      application/xml:
        schema:
          type: object

Diagnostic: Mime type "application/xml" is not allowed

Fix it

Change the contract to an allowed media type, or add the deliberately supported type to the allowlist.

Configure

profiles:
  default:
    rules:
      extends: [strict]
      override:
        response-mime-type:
          severity: error
          allowedValues:
            - application/json
            - application/problem+json

Nearby: request-mime-type, error-response-media-type.