Should required properties in a component be allowed if not included in properties?

[mull]

What a title.

I noticed today that we are sending data in our responses that is not described in the component spec. In the example schema I'll post below I have a created_at entry that has no description inside properties. This seems to validate in most validation tools. Should it be valid?

{
  "openapi": "3.0.3",
  "info": {
    "title": "Hello",
    "version": "1.0.1"
  },
  "paths": {
    "/objects": {
      "get": {
        "summary": "Get all objects",
        "description": "Returns an array of TestObject that is visible to the user role",
        "operationId": "fetchObjects",
        "responses": {
          "200": {
            "description": "A list of objects",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/Object"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "Object": {
        "required": ["id", "title", "created_at"],
        "type": "object",
        "properties": {
          "id": {
            "type": "integer"
          },
          "title": {
            "description": "Title for the new object.",
            "type": "string"
          }
        }
      }
    }
  }
}

[hkosova]

Your example is valid and is equivalent to this (YAML version for readability):

Object:
  required: [id, title, created_at]
  type: object
  properties:
    id:
      type: integer
    title:
      description: Title for the new object.
      type: string
    created_at: {}   # The value can be of any type

Extra properties not explicitly defined under properties are allowed unless the schema has additionalProperties: false / unevaluatedProperties: false.

You can use a linter to enforce that the properties listed in the required list are explicitly defined in properties.

[mull]

Thanks for the answer! Was a bit of a surprise to me, but I'll take it 🙏

[jeremyfiel]

https://www.youtube.com/watch?v=b4009ZC9nkU

must watch for anyone using JSON Schema

[handrews]

This JSON Schema question was answered, closing.