---
schema_version: "1"
id: e8c3c0faf5963e2613081035695ae79a3cf52f26a63942309ff67e0dee76df78
title: Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 6f68735fe12dfbfc5def28512f2ee2d2d1b493dcc0cb83b5055b4018b8befba1
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: oas3, schema validation, api gateway, flex gateway, gateway, policy
---

# Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Schema Validation Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming traffic against a supplied API schema</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.4.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/schema-validation-release-notes">Schema Validation Policy</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - The request properties do not comply with the API specifications.</p></td></tr></tbody></table>

## Summary

> [!NOTE] The Schema Validation policy only supports REST APIs and currently only supports OpenAPI
> Specification 3.0 (OAS3) schema validations.

> [!NOTE] The Schema Validation policy supports a maximum of 64 bits for the `number` schema data
> type.

Applications processing REST API requests are susceptible to attacks such as header injection and
payload injection. Additional vulnerabilities can lead to the access of sensitive information. The
Schema Validation policy protects against such attacks and vulnerabilities by validating traffic
against a supplied API specification.

There are many ways to upload REST API specifications, but using Exchange is the easiest way. To
upload an API specification to Exchange, see
[Create an Exchange Asset](https://docs.mulesoft.com/exchange/to-create-an-asset).

Omni Gateway supports schemas defined in JSON or YAML, contained in a single file.

The Schema Validation policy validates request headers, queries, or path parameters.

Requests only include support for JSON format with content type `application/json`.

You configure the policy to perform one of the following actions:

- Block the request, and then return the 400 error status code.

- Allow the request, log the error, and then return the status code of the request.

You can validate content against:

- The presence of all required properties.

- The presence or absence of additional properties.

- The types of all properties.

  For example, if a schema specifies a property as an integer, the request must include an integer
  and not another type, such as a string.

- The format of the properties.

  For example, if the `pattern` keyword is specified, the policy validates the property as a regular
  expression.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: spec-validation-flex config: source: <string> // REQUIRED spec: <string> //
REQUIRED apiBasePath: <string> // OPTIONAL blockOperation: <boolean> // REQUIRED
strictParamsValidation: <boolean> // OPTIONAL

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>source</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>context</code></p></div></div></td><td><div><div><p>Determines if the schema is specified in this YAML resource, or if it’s specified in the API Context from Exchange (Connected Mode only). Supported values: <code>inline</code> or <code>context</code>. You must specify <code>inline</code> when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>spec</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>""</code></p></div></div></td><td><div><div><p>The actual inline specification. You must provide this when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>apiBasePath</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>"/"</code></p></div></div></td><td><div><div><p>The base path of the API. You must provide this value when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>blockOperation</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>If <code>true</code>, the policy blocks an invalid spec validation. If <code>false</code>, the policy only logs an error.</p></div></div></td></tr><tr><td><div><div><p><code>strictParamsValidation</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>Determines whether to validate query parameters not defined in specification.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

```yaml
- policyRef:
    name: spec-validation-flex
  config:
    source: "inline"
    apiBasePath: "/"
    blockOperation: true
    strictParamsValidation: false
    spec: |
      {
        "openapi": "3.0.2",
        ...
      }
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Default</th><th>Required</th></tr></thead><tbody><tr><td><div><div><p>Block request</p></div></div></td><td><div><div><p>Select to block an incoming request that does not conform to the API specification. Selecting not to block only logs the request. Choosing to block invalid requests returns a 400 status when the request is invalid.</p></div></div></td><td><div><div><p>Block enabled</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Strict query parameters validation</p></div></div></td><td><div><div><p>Restricts API calls from query parameters not defined in the API Specification</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Advanced options</p></div></div></td><td><div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><div><div><p>Policy version</p></div></div></td><td><div><div><p>Version of the applied policy</p></div></div></td><td><div><div><p>Latest</p></div></div></td><td><div><div><p>Yes</p></div></div></td></tr><tr><td><div><div><p>Rule of application</p></div></div></td><td><div><div><p>Configures the runtimes the policy is applied to. Schema Validation is currently only available for Omni Gateway. Applying the policy to all runtimes only applies the policy to Omni Gateway APIs.</p></div></div></td><td><div><div><p>All runtimes</p></div></div></td><td><div><div><p>Yes</p></div></div></td></tr></tbody></table>