Skip to content

OpenAPI.NET 3.4 appears to emit unevaluatedProperties: false by default for generated schemas. #2769

@mdaneri

Description

@mdaneri

Describe the issue

OpenAPI.NET 3.4 appears to emit unevaluatedProperties: false by
default for generated schemas.

This changes the effective validation semantics of generated OpenAPI 3.1
documents by making objects strict unless explicitly modeled otherwise.

In JSON Schema 2020-12, unevaluatedProperties is optional. If omitted,
unevaluated properties are allowed. Emitting
unevaluatedProperties: false by default makes the generated schema
more restrictive than the default JSON Schema / OpenAPI behavior.

Breaking change

This behavior also represents a breaking change in generated OpenAPI
documents
compared to previous OpenAPI.NET versions.

OpenAPI documents generated with version 3.4.x differ from those
generated by earlier versions
, even when the input model has not
changed. The serializer now injects unevaluatedProperties: false into
schemas that previously did not contain this keyword.

This has several consequences:

  • Generated OpenAPI documents change between versions without changes
    to the source model.
  • Tools performing document comparison (CI validation, contract
    checks, snapshot tests) detect unexpected differences.
  • Clients or validators using strict JSON Schema validation may now
    reject payloads that were previously valid.

Because OpenAPI specifications are often treated as stable API
contracts
, such changes can impact downstream tooling and consumers.

Why this is a problem

Setting unevaluatedProperties: false by default means that unknown
properties are rejected even when the schema author did not explicitly
request strict object validation.

For example, a simple schema like this:

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string"
    }
  }
}

normally allows:

{
  "name": "Max",
  "nickname": "Maxy"
}

But when OpenAPI.NET emits:

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string"
    }
  },
  "unevaluatedProperties": false
}

the same instance becomes invalid.

This is not just cosmetic output; it materially changes the meaning of
the generated schema.

Expected behavior

OpenAPI.NET should not emit unevaluatedProperties: false unless strict
object validation was explicitly requested by the author or configured
by the generator.

The default generated schema should preserve the standard JSON Schema /
OpenAPI behavior, which is equivalent to allowing unevaluated properties
when the keyword is omitted.

Actual behavior

Generated schemas include unevaluatedProperties: false by default,
which makes the resulting schemas strict even when that was not
explicitly modeled.

Impact

This can cause several issues:

  • generated OpenAPI documents become more restrictive than expected
  • clients and validators may reject payloads that would otherwise be
    valid
  • downstream users may assume strict object semantics were
    intentionally authored
  • future-compatible or extensible request/response objects become
    harder to represent
  • generated OpenAPI specifications change between OpenAPI.NET versions

Suggested fix

Do not emit unevaluatedProperties by default.

Instead:

  • omit the keyword unless strict object validation is explicitly
    intended
  • optionally provide a configuration switch for generators/users who
    want strict object output
  • if emitted, only emit it where it is semantically meaningful

Additional note

There is a separate but related issue where unevaluatedProperties is
also being emitted for non-object schemas such as arrays and primitive
types. That appears to be serializer noise.

This issue is specifically about the default semantic choice of emitting
unevaluatedProperties: false for schemas without an explicit request
for strictness.

Version info

  • OpenAPI.NET: 3.4.0
  • OpenAPI document version: 3.1.x

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions