<p>I try to define a new Custom Resource, requiring it to have one of (1) field A, (2) field B, or (3) empty body.</p>
<p>For example: {A: 1}, {B: 1}, {} are OK, but {A:1, B:2} is not.</p>
<p>Here is the definition of my Custom Resource in form of OpenApi schema:</p>
<pre class="lang-yaml prettyprint-override"><code>foo:
  type: object
  properties:
    a:
     type: int
    b:
     type: int
  oneOf:
    - required: [&quot;a&quot;]
    - required: [&quot;b&quot;]
    # no sure how to include the empty body

</code></pre>
<p>How should I include the empty body in the oneOf constraint?</p>

Augustin Pan
<h2>OpenAPI 3.1</h2>
<p>You can use <code>'null'</code> (with quotes).</p>
<pre><code>oneOf:
  - type: 'null'
</code></pre>
<p>Or an object with a property of type null.</p>
<pre><code>oneOf:
  - NullObjectExample:
    type: object
    properties:
      prop1:
        type: 'null'
</code></pre>
<h2>OpenAPI 3.0</h2>
<p>There is no <code>null</code> type, but you can use a <code>nullable</code> string. You may want to add a <code>description</code> stating this is expected to be null at all times.</p>
<pre><code>oneOf:
  - type: string
    nullable: true
</code></pre>
<p>Or again, an object with a nullable string property.</p>
<pre><code>oneOf:
  - NullObjectExample:
    type: object
    properties:
      prop1:
        type: string
        nullable: true
</code></pre>
<h2>Why No Empty Object</h2>
<p>In addition to not making intent clear, this presents a possible security vulnerability. See <a href="https://apisecurity.io/encyclopedia/content/oasv2/datavalidation/schema/schema-object-without-properties" rel="nofollow noreferrer">this page</a> for an explanation. In short:</p>
<blockquote>
<p>If you do not clearly define the schema and you leave properties of a JSON payload empty, you effectively allow attackers to pass in any data. This means that you are opening your backend to various attacks, such as SQL injection.</p>
</blockquote>
