Skip to content
Sarj Repo Standards
rest/http/forbidden-content

Forbidden HTTP message content

Operations document content only where HTTP semantics permit it.

error

Examples

FlaggedFails
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "204": {
                "content": {
                  "application/json": {}
                },
                "description": "done"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}
PassesClean
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "get": {
            "responses": {
              "204": {
                "description": "done",
                "headers": {
                  "ETag": {
                    "schema": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}
FlaggedFails
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "trace": {
            "requestBody": {
              "content": {
                "application/json": {}
              }
            },
            "responses": {
              "200": {
                "description": "trace"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}
PassesClean
{
  "documents": {
    "openapi.json": {
      "info": {
        "title": "Fixture",
        "version": "1"
      },
      "openapi": "3.1.2",
      "paths": {
        "/widgets": {
          "trace": {
            "responses": {
              "200": {
                "description": "trace"
              }
            }
          }
        }
      }
    }
  },
  "entrypoint": "openapi.json"
}

Why it matters

The contract promises message content that conforming HTTP behavior forbids.

How detection works

A TRACE operation declares a request body, or a HEAD, 1xx, 204, 205, or 304 response declares non-empty content.

What is inspected

  • parsed operation method, response status, requestBody, and non-empty content fields

Limits

  • requiring response completeness
  • judging whether optional content is useful
  • Headers and links are not treated as message content.
  • Missing or empty response content maps remain clean.
  • Only TRACE request bodies and the closed HEAD, 1xx, 204, 205, and 304 cases are checked.

How to fix it

Remove content forbidden by the method or response status.

  1. Remove requestBody from TRACE operations.
  2. Remove the response content map while preserving valid headers and links.

Verify

  • Run repo-lint rest check again against the same tracked contract and semantics.