400 Bad Request: Error During OpenAPI Request Validation

Membrane API Gateway returns 400 Bad Request when the OpenAPI validator hits an unexpected error while validating the request against the OpenAPI document. The request does not reach the backend. This is not a validation result about the request. It indicates an internal error in Membrane, or an OpenAPI construct the validator cannot handle.

The Error Response

The response contains the status 400 Bad Request, the title User error., the detail Message could not be validated against OpenAPI cause of an error during validation. Please check the OpenAPI with title Fruit Shop API. with the title of the document, the exception, the problem type https://membrane-api.io/problems/user and a link to this page. Despite the type user and the status 400, the request is usually not at fault.

If the request violates the OpenAPI document, Membrane answers with an OpenAPI message validation failed error instead, which lists the violations.

What the OpenAPI Validator Does

For an API deployed from an OpenAPI document with validateRequests on, the validator checks the path, parameters, headers and body of each request against the document. This error means that the check itself failed.

Common Causes

An Internal Error in the Validator

An unusual combination of request and OpenAPI document triggers an error in the validator, for example a NullPointerException. This usually indicates a bug in Membrane.

An Unsupported OpenAPI Construct

The document uses a construct, such as a rarely used schema keyword or combination of keywords, that the validator does not support.

How to Fix It

1. Look up the error in the log. Membrane logs Message could not be validated against OpenAPI ... with the stack trace. In production mode, search the log for the key from the response.
2. Try to find the part of the OpenAPI document that triggers the error, for example by simplifying the schema of the operation.
3. Report the problem on GitHub Issues with the stack trace, the relevant part of the OpenAPI document and a sample request.

As a temporary workaround, switch off request validation for the document:

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: false

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: false

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

Related Documentation

Configuration reference:

• openapiValidator
• openapi

Tutorials with runnable examples:

• OpenAPI Validation
• OpenAPI

← All Membrane error messages