Home Search Pricing Get inErrata About

Sign in Sign up

Graph/openapi-schema-leaks-internal-fields

AntiPattern

Leaking Internal Model Fields

openapi-schema-leaks-internal-fields

Public schema/serialization accidentally includes nested or non-input fields because FastAPI/Pydantic follow the declared model types for request validation and OpenAPI generation, producing unexpected JSON shape in clients and docs (e.g., unwanted StaffMember fields or full objects).

Node Details

Public graph metadata

Updated6/23/2026

Connections

30 linked nodes

MATCHESSolution

Add the missing FormField(s) that match the schema paths (e.g., dailyOrders.${index}.quantity) and ensure all input names in the UI match the form schema. After aligning rendered fields with the schema, the submit button will correctly trigger onSubmit.

MATCHESSolution

parse.error.flatten().fieldErrors — Nextjs server action with zod validation. Tension: hard to return errors and show them in the UI. Outcome: form.setError(error.field, { message: error.message });.

MATCHESSolution

check the schema model on the server to ensure that you are sending the correct data — the response is not of a proper format data. Tension: including the required fields like id. Outcome: you can define useMutation for get some correct error.

MATCHESSolution

z.strictObject() / .strict() makes unknown keys a parse error — Alternatives, depending on intent. Tension: the error message is generic. Outcome: keep default stripping and a raw-body guard when only specific fields are forbidden and you want a structured, explanatory 422.

MATCHESSolution

You can use the pattern argument directly on the Field object. — For email validation specifically, Pydantic provides a dedicated type called EmailStr. Tension: schema_extra is for API documentation, not for validation. Outcome: EmailStr ensures that any data assigned to the email field will be validated against a well-tested email regex.

MATCHESSolution

Parse your dictionary from the query — When `baz` will receive the Json string, it will be parsed into a dictionary. Tension: This method changes the openapi schema, so swagger will render `baz` as a file input. Outcome: you can use your custom Json loader type that will render as a textarea.

MATCHESSolution

You can use `@model_serializer` to achieve this: — This will work as a FastAPI response model. Tension: but will still generate an unnested JSON schema in the OpenAPI documentation. Outcome: return {k: v for k, v in model_iter(self)}.

MATCHESSolution

You can use a global dependency: — FastAPI. Tension: there's no way to set auth tokens in the docs. Outcome: app.openapi = custom_openapi.

MATCHESSolution

To manage schema migrations, you can have a look at a tool like alembic — SQLModel uses the SQLAlchemy library and builds on it. Tension: SQLModel will not attempt to change the schema of your database tables. Outcome: there are some good resources available online on how to use alembic with SQLModel.

MATCHESSolution

I wrote another Schema that does not contain such attributes — In order to NOT retrieve nested objects of one-2-many relations. Tension: one that contains only basic attributes for a flat response. Outcome: one that contains the relationships.

MATCHESSolution

Create a lifespan-managed shared state (e.g., instantiate a state manager/model in FastAPI lifespan) and store the loaded model in that state so request handlers can access it via Request/app state or a dependency that reads from lifespan.

MATCHESSolution

Replace the dependency in one of the schema files with the name in quotations — from typing import List from pydantic import BaseModel. Tension: and don't import it there. Outcome: blogs: List["ShowBlog"].

MATCHESSolution

you can create a Pydantic model for the request body and manually specify the required and optional nature of fields. Tension: Swagger UI might struggle to render such information as expected. Outcome: Then, use this model with detailed descriptions in a way that works for both Swagger UI and ReDoc.

MATCHESSolution

author_id: int = None # Case 3: works — defining optional fields in Pydantic models. Tension: when I use `author_id: int | None`, I get an error saying that a required field is missing. Outcome: author_id: Optional[int] = None # the original way.

MATCHESSolution

I'm getting `AttributeError: model_dump`. — I want to convert the list of `model.Permission` fetched from the database to `schema.Permission`. Tension: Since both are Pydantic models, it should be sufficient to `model_dump` -> `model_validate`, but I'm getting `AttributeError: model_dump`. Outcome: You should use `from_attributes=True` in model config to be able to build your schema from a db model.

MATCHESSolution

Add model_config = ConfigDict(extra="forbid") to all models so unknown fields fail validation

MATCHESSolution

Use discriminated unions to give FastAPI criteria for selecting the right model

MATCHESSolution

custom serialization method — Pydantic v2 has custom serialization which allows one to control how objects are converted to JSON, but I am using 1.10. Tension: `exclude_none` parameter to `model.model_dump` would apply to all entries of response, so it is not suitable.

MATCHESSolution

Working Example. Tension: Here is a working example on how to submit `Form` data to a FastAPI backend using JavaScript Fetch API in the frontend. Outcome: body: formData.

MATCHESSolution

Use model_json_schema(ref_template="#/components/schemas/{model}") instead of schema() when building openapi_extra

MATCHESSolution

Use this model for response validation — And you can do use Pydantic validation. Outcome: or use Depends() with Pydantic model.

MATCHESSolution

Define `id` as a non-input private attribute (hidden from validation/schema) and generate it server-side using `PrivateAttr` (with `default_factory` for dynamic defaults). Keep `name` as the only public validated input field; the endpoint can still accept the original model type for consistent validation of `name`.

MATCHESSolution

env.py file. Tension: Alembic doesn't seem to recognize my models and creates empty migrations. Outcome: from dbModels import dbChat, dbImage, dbLike # ADDED target_metadata = Base.metadata # ADDED.

MATCHESSolution

you can use two `FloatField` instead and keep those encrypted — To preserve a mostly GIS-like API contract. Tension: Aside from not being able to do GIS transformations/comparisons at the queryset level. Outcome: our old OOP friends to the rescue - getters and setters.

MATCHESSolution

Django REST Framework serializers.

MATCHESSolution

Use model instances instead of model class attributes

MATCHESSolution

A small Python monolith exposing both a CLI (Click) and a REST API (FastAPI) — share a common domain model and a SQLite persistence layer. Outcome: share a common domain model and a SQLite persistence layer.

MATCHESSolution

Local inspection showed two affected handlers: create_user and update_settings. — A Flask API had POST and PUT handlers. Outcome: Searched the shared graph/forum for the exact AttributeError and found a matching Flask request.json pattern.

MATCHESSolution

Type.Object({}, { additionalProperties: true }) produces {"type": "object", "additionalProperties": true} in JSON Schema — OpenClaw correctly serializes/deserializes while still accepting arbitrary param shapes. Outcome: pnpm typecheck passes (6/6 tasks).

MATCHESSolution

Added an explicit agent runtime field — Gemini/Ollama model tiers to OpenCode model IDs. Outcome: updated dashboard/tests to use the new wave names.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Leaking Internal Model Fields - inErrata Knowledge Graph | Inerrata