---
schema_version: "1"
id: 2dd9209e8cd7ed1c9d51005e2bca73d08213132824e0c96ba2eeacd3274cb7b5
title: Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/policies-included-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/policies-included-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: cd8a00550a822e542504ca1a93eab361889aee9b003e26a3fe368cdf9122659a
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
keywords: oas3, schema validation, api gateway, flex gateway, gateway, policy
---

# Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Schema Validation Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming traffic against a supplied API schema</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.4.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>400 - The request properties do not comply with the API specifications.</p></td></tr></tbody></table>

## Summary

> [!NOTE] The Schema Validation policy only supports REST APIs and currently only supports OpenAPI
> Specification 3.0 (OAS3) schema validations.

> [!NOTE] The Schema Validation policy supports a maximum of 64 bits for the `number` schema data
> type.

Applications processing REST API requests are susceptible to attacks such as header injection and
payload injection. Additional vulnerabilities can lead to the access of sensitive information. The
Schema Validation policy protects against such attacks and vulnerabilities by validating traffic
against a supplied API specification.

There are many ways to upload REST API specifications, but using Exchange is the easiest way. To
upload an API specification to Exchange, see
[Create an Exchange Asset](https://docs.mulesoft.com/exchange/to-create-an-asset).

Flex Gateway supports schemas defined in JSON or YAML, contained in a single file.

The Schema Validation policy validates request headers, queries, or path parameters.

Requests only include support for JSON format with content type `application/json`.

You configure the policy to perform one of the following actions:

- Block the request, and then return the 400 error status code.

- Allow the request, log the error, and then return the status code of the request.

You can validate content against:

- The presence of all required properties.

- The presence or absence of additional properties.

- The types of all properties.

  For example, if a schema specifies a property as an integer, the request must include an integer
  and not another type, such as a string.

- The format of the properties.

  For example, if the `pattern` keyword is specified, the policy validates the property as a regular
  expression.

## Configuring Policy Parameters

### Flex Gateway Local Mode

In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the
following policy definition and table of parameters:

\- policyRef: name: spec-validation-flex config: source: <string> // REQUIRED spec: <string> //
REQUIRED apiBasePath: <string> // OPTIONAL blockOperation: <boolean> // REQUIRED
strictParamsValidation: <boolean> // OPTIONAL

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>source</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>context</code></p></div></div></td><td><div><div><p>Determines if the schema is specified in this YAML resource, or if it’s specified in the API Context from Exchange (Connected Mode only). Supported values: <code>inline</code> or <code>context</code>. You must specify <code>inline</code> when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>spec</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>""</code></p></div></div></td><td><div><div><p>The actual inline specification. You must provide this when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>apiBasePath</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>"/"</code></p></div></div></td><td><div><div><p>The base path of the API. You must provide this value when configuring the policy in Local Mode.</p></div></div></td></tr><tr><td><div><div><p><code>blockOperation</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>If <code>true</code>, the policy blocks an invalid spec validation. If <code>false</code>, the policy only logs an error.</p></div></div></td></tr><tr><td><div><div><p><code>strictParamsValidation</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>Determines whether to validate query parameters not defined in specification.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

```yaml
- policyRef:
    name: spec-validation-flex
  config:
    source: "inline"
    apiBasePath: "/"
    blockOperation: true
    strictParamsValidation: false
    spec: |
      {
        "openapi": "3.0.2",
        ...
      }
```

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy to your API instance from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Default</th><th>Required</th></tr></thead><tbody><tr><td><div><div><p>Block request</p></div></div></td><td><div><div><p>Select to block an incoming request that does not conform to the API specification. Selecting not to block only logs the request. Choosing to block invalid requests returns a 400 status when the request is invalid.</p></div></div></td><td><div><div><p>Block enabled</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Strict query parameters validation</p></div></div></td><td><div><div><p>Restricts API calls from query parameters not defined in the API Specification</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>No</p></div></div></td></tr><tr><td><div><div><p>Advanced options</p></div></div></td><td><div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><div><div><p>Policy version</p></div></div></td><td><div><div><p>Version of the applied policy</p></div></div></td><td><div><div><p>Latest</p></div></div></td><td><div><div><p>Yes</p></div></div></td></tr><tr><td><div><div><p>Rule of application</p></div></div></td><td><div><div><p>Configures the runtimes the policy is applied to. Schema Validation is currently only available for Flex Gateway. Applying the policy to all runtimes only applies the policy to Flex Gateway APIs.</p></div></div></td><td><div><div><p>All runtimes</p></div></div></td><td><div><div><p>Yes</p></div></div></td></tr></tbody></table>