Validate no extra fields in response

[slessard]

I'm using Prism in validating proxy mode. With Prism I've found several mismatches between my API specification and the actual implementation. But one issue I found manually is that is some cases the service responds with more fields than are defined in the API specification. I can see how this might not be invalid because all of the defined fields are present. Is there a way to force Prism to validate that only defined fields are present in a response and report an error if one or more undefined fields are present in a response?

[yairau]

Just encountered that issue myself.

[slessard]

For each schema that contains properties you can add additionalProperties=false at the top level of the schema. That should trigger the validation you and I are looking for. I haven't tested the kind of validation with Prism but I have tested it with a different OpenAPI validation tool and found ti to work.

https://apisecurity.io/encyclopedia/content/oasv3/datavalidation/schema/v3-schema-object-additionalproperties-true.htm

[yairau]

Iv'e now tested it with Prism and it does work, so thank you.

I would just note that I've also added a Spectral rule to make sure that every object has the property additionalProperties defined. It looks like this:

extends:
  - spectral:oas
rules:
  require-additional-properties:
    description: 'Add a `additionalProperties` property to this object and set it to true or false. True value means this object is allowed to have undocumented properties, so this should rarely be the case.'
    severity: error
    given: "$..[?(@.type==='object')]"
    then:
      - field: additionalProperties
        function: defined