Skip to content

Check OpenAPI 3.0 schemas against the OAS 3.0 Schema Object schema - #307

Open
p1c2u wants to merge 1 commit into
masterfrom
feature/oas30-openapi-metaschema
Open

p1c2u wants to merge 1 commit into
masterfrom
feature/oas30-openapi-metaschema

Conversation

@p1c2u

@p1c2u p1c2u commented Nov 9, 2026 •

Copy link
Copy Markdown
Collaborator

Problem

OpenAPI 3.0 schemas are checked against the JSON Schema Draft 4 metaschema. The OAS 3.0 Schema Object is a restricted subset of Wright Draft 00, and JSON Schema keywords it does not list are unsupported (OAS 3.0.3). Draft 4 still accepts type arrays, definitions, id, $schema, patternProperties, const, items arrays and unknown keywords, so invalid 3.0 schemas pass check_schema.

Change

  • Vendor the official OAS 3.0 schema (2024-10-18) unmodified under schemas/oas3.0/schema/. The specifications registry picks it up automatically, and it ships in the wheel.
  • check_schema for OAS 3.0 uses the official Schema, Reference, Discriminator, XML and ExternalDocumentation definitions. This applies to OAS30Validator and the Strict, Read and Write variants; the variants previously fell back to jsonschema's default Draft 4 check.
  • The official oneOf: [Schema, Reference] alternatives are rewritten at import time to choose by the presence of $ref, as the specification does. Errors therefore name the offending keyword (['string', 'null'] is not of type 'string', 'definitions' does not match any of the regexes: '^x-') rather than a generic oneOf failure. Keys next to $ref are ignored.
  • META_SCHEMA and instance validation are unchanged.
  • No docs changes; the migration note below is meant for the 0.10 release notes.

Breaking change

  • Schemas that use keywords OpenAPI 3.0 doesn't support now raise SchemaError.
  • So does a root carrying non-Schema Object keys, such as components, or a whole OpenAPI document passed to validate().

To migrate, provide referenced schemas via registry=..., validate fragments through a validator built from the full document, or skip the check with check_schema=False. This needs a minor version bump (0.10).

Not covered, to stay faithful to the official schema: "items MUST be present if type is array" is not enforced.

Overlaps with #306, which also changes OAS 3.0 schema checking; whichever merges second will need a rebase.

Checks

  • 332 passed, 6 skipped (55 new tests in tests/unit/test_oas30_schema_object_metaschema.py)
  • mypy: only the 2 _regex.py errors that already exist on master
  • black, isort, flynt, pyupgrade, deptry and the Sphinx -n -W build all clean

@p1c2u
p1c2u force-pushed the feature/oas30-openapi-metaschema branch from 93b17bb to c876e9e Compare November 9, 2026 21:09
@p1c2u p1c2u changed the title Add opt-in OpenAPI 3.0 Schema Object metaschema check Check OpenAPI 3.0 schemas against the OAS 3.0 Schema Object schema Nov 9, 2026
@p1c2u
p1c2u changed the base branch from fix/oas30-ref-schema-check to master November 9, 2026 21:09
@p1c2u
p1c2u force-pushed the feature/oas30-openapi-metaschema branch 2 times, most recently from 62967c7 to 60b074f Compare November 9, 2026 21:20
OpenAPI 3.0 schemas were checked against the JSON Schema Draft 4
metaschema, which accepts keywords OpenAPI 3.0 does not support
(type arrays, definitions, id, $schema, patternProperties, const,
unknown keywords, ...).

Vendor the official OAS 3.0 schema (2024-10-18) unmodified and check
OAS 3.0 schemas against its Schema, Reference, Discriminator, XML and
ExternalDocumentation definitions. Schema or Reference is chosen by the
presence of $ref instead of the official oneOf, so errors point at the
offending keyword and keys next to $ref are ignored as the
specification requires.

Apply the check to OAS30Validator and the Strict, Read and Write
variants; the variants previously used jsonschema's default Draft 4
check.

This is a breaking change: schemas using unsupported keywords, and
roots carrying non-Schema Object keys such as components or a whole
OpenAPI document, now raise SchemaError. Referenced schemas can be
provided via registry, or the check skipped with check_schema=False.
@p1c2u
p1c2u force-pushed the feature/oas30-openapi-metaschema branch from 60b074f to bc567a2 Compare November 9, 2026 21:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant