Why does Membrane API Gateway return OpenAPI message validation failed?

Request validation is on, and the request does not conform to the OpenAPI document of the API. The path, a parameter, the content type or the body violates the document. The validation field of the response lists the errors.

Which status codes does the Membrane OpenAPI request validation return?

The status is taken from the first error: usually 400 for invalid parameters or bodies, 404 for an unknown path, 405 for an unsupported method, 415 for an unsupported content type, and 401 or 403 for failed security validation.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

400 Bad Request: OpenAPI Request Validation Failed

Membrane API Gateway rejects a request with the title OpenAPI message validation failed when request validation is on and the request does not conform to the OpenAPI document of the API. The request does not reach the backend.

The Error Response

The response contains the title OpenAPI message validation failed, a validation field that lists the errors, the problem type https://membrane-api.io/problems/user/validation and a link to this page. The type user/validation means that the message did not pass validation. The status is taken from the first error:

Status	Reason
`400 Bad Request`	A parameter or the body violates the document. This is the most common case.
`404 Not Found`	The path is not defined in the document.
`405 Method Not Allowed`	The path is defined, but not for this HTTP method.
`415 Unsupported Media Type`	The operation does not accept the `Content-Type` of the request.
`401 Unauthorized` and `403 Forbidden`	With security validation on, the request lacks the required authentication or scopes.

How OpenAPI Request Validation Works

For an API deployed from an OpenAPI document, Membrane can check every request against the document: the path and method, the path, query, header and cookie parameters, the content type and the body schema. Validation is configured per document with validateRequests, validateResponses, validateSecurity and validationDetails. See OpenAPI Configuration and Validation.

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: true

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: true

Common Causes

The Path or Method Is Not Defined

The request uses a path that the document does not describe, or a method that is not defined for the path.

Invalid Parameters

A required path, query, header or cookie parameter is missing, or a value has the wrong type or format, for example a string where the document expects an integer.

The Body Does Not Match the Schema

A required property is missing, a property has the wrong type, a value is out of range, or the body contains properties that the schema does not allow.

The Content Type Is Not Accepted

The request is sent with a Content-Type that the operation does not list under requestBody.

Authentication Is Missing

With validateSecurity on, the request lacks the authentication or the scopes required by the security schemes of the operation.

How to Fix It

Read the validation field of the response. Each entry names the location of the error and the violated constraint.
Compare the request with the OpenAPI document. Membrane publishes it under /api-docs, including a Swagger UI to try out requests.
Correct the request. If the document is wrong, correct the document instead.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. In production mode, the link to this page is left out:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---. The list of violations in the validation field is still sent in production mode, because it describes the message against the published API. To leave it out, set validationDetails: false on the openapi entry:

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: true
      validationDetails: false

api:
  port: 2000
  openapi:
    - location: fruitshop-api.yml
      validateRequests: true
      validationDetails: false