According to both Swagger documentation and https://datatracker.ietf.org/doc/html/draft-wright-json-schema-validation-00#section-5.18, omitting additionalProperties actually allows any additional properties in the object.

Despite of this, when generating schema from Java classes, swagger does not emit “additionalProperties: false” to prevent that. Well, one could say it’s because they by default expect our classes to grow new fields 🙂 instead of by default expecting only fixed set of fields. But the real question is why we cannot override that and make it put “additionalProperties: false” in the schema?

Sure, it’s possible to do that if we manually specify the whole @Content, its @Schema, its properties=…, then we can also append additionalProperties=whatever. But we lose a lot of automation that way, because normally swagger fills “properties=” from a class properties.

I know the lack of manual control is somewhat mitigated by Swagger’s ability to also generate additionalProperties= for Map<> properties, but one thing does not actually replace another. Following this behavior, most every Schema in a 3.0 specification generated by swagger will allow additional properties, how is that?

It’s noteworthy that when generating 3.1 spec, putting @Schema(…additionalProperties=FALSE) on a class will do the trick, but not for 3.0