# schema-no-additional-properties

Source: https://apigenie.pl/docs/linter/swagger/rules/schema-no-additional-properties

This rule ensures that object schemas do not accept arbitrary additional
properties.

## Rule Details

An object schema accepts properties that are not listed in `properties`
unless `additionalProperties` is `false`. Open objects hide typos in property
names, and let undocumented data pass through the API.

The `schema-no-additional-properties` rule checks every schema of a Swagger
2.0 document with `type: object` (schemas with a `$ref` are checked where
they are defined). It reports `Object schema does not disable additional
properties` when `additionalProperties` is absent or `true`.

A schema value of `additionalProperties` describes a map whose values have
that schema. This is a deliberate choice, and such schemas are not reported.

## Configuration

None.

## Examples

**Good**. `Pet` is closed, and `Labels` is a map of strings.

```yaml
swagger: '2.0'
info:
  title: Pets
  version: 1.0.0
paths: {}
definitions:
  Pet:
    type: object
    additionalProperties: false
    properties:
      name:
        type: string
      labels:
        $ref: '#/definitions/Labels'
  Labels:
    type: object
    additionalProperties:
      type: string
```

**Bad**. Both `Pet` and its `owner` property accept any additional property.

```yaml
swagger: '2.0'
info:
  title: Pets
  version: 1.0.0
paths: {}
definitions:
  Pet:
    type: object
    properties:
      name:
        type: string
      owner:
        type: object
        additionalProperties: true
        properties:
          name:
            type: string
```

## Automatic fixes

When invoked with `--fix`, this rule sets `additionalProperties: false` on
every reported schema.

## When Not to Use It

You may disable this rule if your API deliberately accepts or returns
properties that are not described, for example to stay compatible with future
versions.

## Compatibility

This rule is compatible with Swagger 2.0 documents. OpenAPI 3.x documents are
linted by the OpenAPI linter, which has a rule of the same name.