# schema-no-additional-properties

Source: https://apigenie.pl/docs/linter/openapi/rules/schema-no-additional-properties

This rule ensures that schema objects of type "object" explicitly forbid
additional properties.

## Rule Details

Allowing additional properties can lead to inconsistencies in the API's
structure, as well as to security risks. If a malicious actor can inject
unsupported fields into an API request, and it will not be validated,
the server may function incorrectly.

The `schema-no-additional-properties` rule is designed to ensure that all
schema objects of type "object" explicitly forbid additional properties.
This is done by checking if the `additionalProperties` field is set to
`false`.

## Configuration

None.

## Examples

**Good**.

```yaml
components:
  schemas:
    User:
      type: object
      properties:
        firstName:
          type: string
        lastName:
          type: string
      additionalProperties: false
```

**Bad**. The User schema object does not forbid additional properties.

```yaml
components:
  schemas:
    User:
      type: object
      properties:
        firstName:
          type: string
        lastName:
          type: string
```

## When Not to Use It

We recommend to always enable this rule.

## Automatic fixes

When invoked with `--fix`, this rule sets `additionalProperties: false` on
enabled schemas whose declared type includes `object`.

## Compatibility

This rule is compatible with all OpenAPI 3.x versions.