OAS Validation

Release date 2026/09/15

Feature

• Added a new configuration field rfc9457_error_response which, when set to true, returns validation errors in the RFC 9457 application/problem+json format for HTTP requests.

Bugfix

• Added a warning when structured_errors is enabled without verbose_response, as both options must be enabled together.

• Fixed an issue where readOnly and writeOnly properties in OpenAPI 3.1.x specifications were not correctly validated.

Performance

• Improved plugin performance by removing unnecessary hash computation. Enabling the plugin now adds much less latency and CPU overhead to requests.

Release date 2026/09/16

Bugfix

• Added a warning when structured_errors is enabled without verbose_response, as both options must be enabled together.

• Fixed an issue where readOnly and writeOnly properties in OpenAPI 3.1.x specifications were not correctly validated.

• Fixed an issue where OpenAPI 3.1.x parameter patterns using ECMA-262 \uXXXX Unicode escapes failed to match correctly, because PCRE does not support that escape syntax.

Performance

• Improved plugin performance by removing unnecessary hash computation. Enabling the plugin now adds much less latency and CPU overhead to requests.

Release date 2026/07/02

Feature

• Added opt-in structured validation errors via the new structured_errors field, which provides structured error details. Use the max_structured_errors field (must be greater than 0) to cap the number of returned errors in structured format; when unset, all errors are returned. When structured_errors is disabled, the plugin preserves the original non-structured error format.

Bugfix

• Fixed an issue where the OAS specification cache failed to distinguish between different values of api_spec_encoded for the same specification content.

• Fixed an issue where path parameters were extracted from the wrong URI segment when custom_base_path was used with bare /{param} paths.

Release date 2026/09/17

Bugfix

• Fixed an issue where readOnly and writeOnly properties in OpenAPI 3.1.x specifications were not correctly validated.

• Fixed an issue where OpenAPI 3.1.x parameter patterns using ECMA-262 \uXXXX Unicode escapes failed to match correctly, because PCRE does not support that escape syntax.

Performance

• Improved plugin performance by removing unnecessary hash computation. Enabling the plugin now adds much less latency and CPU overhead to requests.

Release date 2026/06/04

Bugfix

• Fixed an issue where path parameters were extracted from the wrong URI segment when custom_base_path was used with bare /{param} paths.

• Fixed an issue where the OAS specification cache failed to distinguish between different values of api_spec_encoded for the same specification content.

Release date 2026/04/07

Bugfix

• Fixed an issue where response body buffering was not properly disabled when validate_response_body was set to false.

• Fixed an issue where parameter validation errors caused a runtime crash when collect_all_errors was enabled.

• Fixed an issue where swagger formData parameters were not properly handled.

• Fixed an issue where minLength and maxLength constraints defined in a Swagger 2.0 parameter schema were not enforced.

• Fixed an issue where the validator cache did not account for the collect_all_errors setting.

Release date 2026/07/27

Bugfix

• Fixed an issue where the OAS specification cache failed to distinguish between different values of api_spec_encoded for the same specification content.

Release date 2026/06/30

Bugfix

• Fixed an issue where path parameters were extracted from the wrong URI segment when custom_base_path was used with bare /{param} paths.

Release date 2026/04/08

Bugfix

• Fixed an issue where parameter validation errors caused a runtime crash when collect_all_errors was enabled.

• Fixed an issue where swagger formData parameters were not properly handled.

• Fixed an issue where minLength and maxLength constraints defined in a Swagger 2.0 parameter schema were not enforced.

• Fixed an issue where the validator cache did not account for the collect_all_errors setting.

Release date 2026/02/01

Bugfix

• Fixed an issue where response body buffering was not properly disabled when validate_response_body was set to false.

Release date 2025/12/18

Feature

• Added support for collecting all validation errors when collect_all_errors is set to true in the plugin configuration. Note: Enabling this option with OpenAPI 3.0 will affect performance.

• Support readOnly and writeOnly keywords for OpenAPI 3.1.x.

Bugfix

• Fixed an issue where parameter data extraction failed when $ appears in the path pattern.

• Fixed an issue where nested references in oneOf / anyOf when they are used with a discriminator are not unfolded.

• Fixed an issue where YAML 1.1 null values were parsed incorrectly.

Release date 2026/07/22

Bugfix

• Fixed an issue where the OAS specification cache failed to distinguish between different values of api_spec_encoded for the same specification content.

• Fixed an issue where path parameters were extracted from the wrong URI segment when custom_base_path was used with bare /{param} paths.

Release date 2026/04/15

Bugfix

• Fixed an issue where nested references in oneOf / anyOf when they are used with a discriminator are not unfolded.

• Fixed an issue where swagger formData parameters were not properly handled.

• Fixed an issue where minLength and maxLength constraints defined in a Swagger 2.0 parameter schema were not enforced.

Release date 2026/02/26

Bugfix

• Fixed an issue where response body buffering was not properly disabled when validate_response_body was set to false.

Release date 2025/11/18

Bugfix

• Fixed an issue where parameter data extraction failed when $ appears in the path pattern.

Release date 2025/10/01

Bugfix

• Fixed an issue where certain query strings in URLs that did not conform to the configured OpenAPI specification could cause the plugin to throw an unexpected runtime error and respond with an HTTP 500 error.

Release date 2026/06/30

Bugfix

• Fixed an issue where path parameters were extracted from the wrong URI segment when custom_base_path was used with bare /{param} paths.

Release date 2026/04/15

Bugfix

• Fixed an issue where swagger formData parameters were not properly handled.

• Fixed an issue where minLength and maxLength constraints defined in a Swagger 2.0 parameter schema were not enforced.

Release date 2026/02/26

Bugfix

• Fixed an issue where response body buffering was not properly disabled when validate_response_body was set to false.

• Fixed an issue where nested references in oneOf / anyOf when they are used with a discriminator are not unfolded.

Release date 2025/10/23

Bugfix

• Fixed an issue where parameter data extraction failed when $ appears in the path pattern.

Release date 2025/07/03

Feature

• Added support for validating multipart/form-data requests.

Bugfix

• Fixed an issue where the plugin raises “path not found error” when include_base_path is set to true and the server url is “/”.

• Fixed an issue where the plugin throws an error for responses without a Content-Type header.

• Fixed an issue where query parameters with explode=false couldn’t be validated.

Performance

• Improved performance for OpenAPI 3.1.

Release date 2026/04/09

Bugfix

• Fixed an issue where minLength and maxLength constraints defined in a Swagger 2.0 parameter schema were not enforced.

Release date 2026/02/11

Bugfix

• Fixed an issue where response body buffering was not properly disabled when validate_response_body was set to false.

Performance

• Improved performance for OpenAPI 3.1.

Release date 2025/12/09

Bugfix

• Fixed an issue where nested references in oneOf / anyOf when they are used with a discriminator are not unfolded.

Release date 2025/07/06

Bugfix

• Fixed an issue where the plugin throws an error for responses without a Content-Type header.

Release date 2025/03/27

Feature

• Added support for the discriminator keyword in OpenAPI specs.

• Added support for oneOf, anyOf, allOf, and not keywords.

Bugfix

• Fixed an issue where query params without values caused an assertion failure.

Performance

• Improved performance on OpenAPI 3.0.

Release date 2025/07/07

Bugfix

• Fixed an issue where the plugin throws an error for responses without a Content-Type header.

Release date 2024/12/12

Bugfix

• Fixed an issue where the error message was omitted if notify_only_request_body_validation_failure or notify_only_response_body_validation_failure was set to false.

• Fixed an issue where the include_base_path did not work when multiple servers were provided.

• Fixed an issue where the spec could not be located if the Content-Type in the request/response body included parameters (e.g., application/json; charset=utf8), while the openapi specification defined in api_spec did not include parameters.

Release date 2025/07/02

Bugfix

• Fixed an issue where the plugin throws an error for responses without a Content-Type header.

Release date 2024/09/11

Feature

• Fixed an issue where the plugin cannot obtain the value when the path parameter name contains hyphen characters.

Bugfix

• Fixed an issue where parameter serialization does not behave the same as in the OpenAPI specification

• Fixed a bug where the non-string primitive types passed via URL query were unexpectedly cast to string when OpenAPI spec is v3.1.0.

Release date 2024/05/28

Feature

• Add a new field api_spec_encoded to indicate whether the api_spec is URI-Encoded.

• Add the custom_base_path field to specifiy a custom base path. It will be used with the deck file namespace feature

• Supported OpenAPI Specification v3.1.0. The plugin now switches to a new JSONSchema validator when the specification version is v3.1.0.

Bugfix

• priorities have been updated to prevent collisions between plugins. The relative priority (and the order of execution) of bundled plugins remained unchanged.

Release date 2024/05/14

Bugfix

• priorities have been updated to prevent collisions between plugins. The relative priority (and the order of execution) of bundled plugins remained unchanged.

Release date 2024/04/08

Feature

• Add a new field api_spec_encoded to indicate whether the api_spec is URI-Encoded.

Release date 2024/02/12

Breaking Change

• bypass schema validation when content-type is not application/json.

Bugfix

• OAS-Validation Fix a bug where the plugin throws a runtime error caused by the ref parameter schema not being dereferenced.

• Fixed an issue that the plugin throws a runtime error while validating parameters with AnyType schema and style keyword defined.

• Fixed an issue that the cookie parameters are not being validated.

• Fixed an issue that the nullable keyword did not take effect.

• Fixed an issue where the request path could not matched when containing regex escape characters.

• Fixed an issue that the URI component escaped characters were incorrectly unescaped.

Release date 2024/05/20

Feature

• Add a new field api_spec_encoded to indicate whether the api_spec is URI-Encoded.

Bugfix

• Fixed an issue that the cookie parameters are not being validated.

• priorities have been updated to prevent collisions between plugins. The relative priority (and the order of execution) of bundled plugins remained unchanged.

Release date 2023/12/21

Bugfix

• OAS-Validation Fix a bug where the plugin throws a runtime error caused by the ref parameter schema not being dereferenced.

• Fixed an issue that the plugin throws a runtime error while validating parameters with AnyType schema and style keyword defined.

• Fixed an issue that the nullable keyword did not take effect.

• Fixed an issue that the URI component escaped characters were incorrectly unescaped.

Release date 2023/11/08

Feature

• Introduces a new property include_base_path to indicate whether to include the base path when performing the path match evaluation.

Bugfix

• OAS Validation Fix an issue where non application/json content-types are being rejected even though the request body is not required.

• Fix an issue where a null pointer exception may occur in some scenarios when configuration notify_only_request_validation_failure is true

• Fix the issue that path parameter cannot match non-ascii characters.

• Fix an issue where valid recursive schemas are always rejected.

Release date 2024/05/16

Bugfix

• priorities have been updated to prevent collisions between plugins. The relative priority (and the order of execution) of bundled plugins remained unchanged.

Release date 2024/04/15

Feature

• Add a new field api_spec_encoded to indicate whether the api_spec is URI-Encoded.

Release date 2024/01/17

Bugfix

• Fixed an issue that the cookie parameters are not being validated.

Release date 2023/12/15

Bugfix

• Fix a bug where the plugin throws a runtime error caused by the ref parameter schema not being dereferenced.

• Fix an issue where valid recursive schemas are always rejected.

• Fixed an issue that the plugin throws a runtime error while validating parameters with AnyType schema and style keyword defined.

• Fixed an issue that the nullable keyword did not take effect.

• Fixed an issue that the URI component escaped characters were incorrectly unescaped.

• Fix the issue that path parameter cannot match non-ascii characters.

Release date 2023/08/09

Bugfix

• Fixed an issue where the plugin was unable to pass the validation even if path parameter was valid.

• Fixed an issue where the plugin always validated the request body even if the method spec had no requestBody defined.

• Fixed an issue where the comparison between large absolute value numbers could be incorrect due to the number being converted to exponential notation.

Release date 2023/05/19

Bugfix

• Added the missing schema field protocols for jwe-decrypt, oas-validation, and vault-auth.

Release date 2023/01/24

Bugfix

• Added the OAS Validation plugin back into the bundled plugins list. The plugin is now available by default with no extra configuration necessary through kong.conf.

• Fixed an issue where the plugin returned the wrong error message when failing to get the path schema spec.

• Fixed a 500 error that occurred when the response body schema had no content field.

Release date 2022/12/06

Feature

• Validate HTTP requests and responses based on an OpenAPI 3.0 or Swagger API Specification.