Body Validation

25 tests verify JSON Schema validation, size limits, type checking, and structure validation.

OpenAPI Schema Definition

Request bodies are validated against JSON schemas defined in OpenAPI:

# openapi.yaml
components:
  schemas:
    User:
      type: object
      required:
        - name
        - email
      properties:
        name:
          type: string
          minLength: 2
          maxLength: 100
        email:
          type: string
          format: email
        age:
          type: integer
          minimum: 0
          maximum: 150
      additionalProperties: false

BODY-001PASS

Valid JSON body

Sample Request

curl -X POST -H "X-API-Key: valid-key" \
  -H "Content-Type: application/json" \
  -d '{"name": "John Doe", "email": "john@example.com", "age": 30}' \
  http://localhost:8080/users

Request body matches the JSON schema - all required fields present, correct types.

BODY-002BLOCKED

Missing required field

Sample Request

curl -X POST -H "X-API-Key: valid-key" -H "Content-Type: application/json" -d '{"name": "John"}' http://localhost:8080/users

Expected Response

HTTP/1.1 400 Bad Request

{"error": "Schema validation failed", "details": "Missing required property: email"}

Required fields defined in the schema must be present. Missing fields cause validation failure.

BODY-003BLOCKED

Invalid email format

Sample Request

curl -X POST -d '{"name": "John", "email": "not-an-email"}' http://localhost:8080/users

Expected Response

{"error": "Invalid format", "field": "email", "expected": "email"}

Fields with format constraints (email, uuid, date-time) are validated against their format.

BODY-005BLOCKED

Wrong type - string instead of integer

Sample Request

curl -X POST -d '{"name": "John", "email": "john@test.com", "age": "thirty"}' http://localhost:8080/users

Expected Response

{"error": "Type mismatch", "field": "age", "expected": "integer", "got": "string"}

Type validation ensures fields match their expected types (string, integer, boolean, etc.).

BODY-008BLOCKED

Additional property not allowed

Sample Request

curl -X POST -d '{"name": "John", "email": "john@test.com", "admin": true}' http://localhost:8080/users

Expected Response

{"error": "Additional property not allowed", "property": "admin"}

With additionalProperties: false, any fields not defined in the schema are rejected. This prevents mass assignment attacks.

BODY-012BLOCKED

Body size exceeds limit

Sample Request

curl -X POST -d @large_file.json http://localhost:8080/users  # 10MB file

Expected Response

HTTP/1.1 413 Payload Too Large

Oversized request bodies are rejected to prevent denial-of-service attacks.