Skip to main content

missing-schema-fallback

Finds places where a missing schema makes tooling fall back to an unconstrained empty schema.

AttributeValue
CategorySchema
MaturityPlatinum
OpenAPISwagger 2.0; OpenAPI 3.0, 3.1, 3.2
StarterOff
LenientWarning
Recommended–CompleteError

Intent

Implicit empty schemas accept arbitrary data and hide the API's real payload shape.

Flags

  • Request or response media types without schema.
  • Response headers without either schema or content.
  • Non-parameter array schemas without items.

Does not flag

Media types with a schema, headers with schema or content, arrays with items, and array schemas inside parameters.

See it fail

Tags:
type: array

Diagnostic: No items schema defined for array schema defaulting to empty schema

A media type has the same problem when it declares only an example:

content:
application/json:
example: {status: ready}

Fix it

Describe the accepted value explicitly:

Tags:
type: array
items:
type: string

For media types, add schema alongside any example.

Configure

profiles:
default:
rules:
extends: [recommended]
override:
missing-schema-fallback: warn

Nearby: array-max-items, request-body-defined.