Skip to content

Mandatory string fields should have minLength: 1 to prevent empty string values #720

Description

@ThalysGomes

Summary

Mandatory string fields in the CDS OpenAPI specifications (e.g., BankingTransaction.description) are marked as required but lack a minLength: 1 constraint. This allows implementations to return empty strings ("") that technically pass JSON Schema validation but are semantically invalid and useless to Data Recipients.

Proposal

As a general rule, every mandatory (required) field of type string should default to having minLength: 1 unless there is an explicit reason to allow empty strings. Without this, any required string field can be satisfied by "", which undermines the entire purpose of making it mandatory.

This is not just about a single field — it is a systemic gap that affects schema validation across the entire specification. Adding minLength: 1 as a standard practice for mandatory string fields would:

  1. Make the spec self-validating — consumers can rely on JSON Schema validation alone to catch non-compliant payloads
  2. Prevent Data Holders from technically complying while providing no useful data
  3. Align with JSON Schema best practices where required + type: string without minLength is considered incomplete for fields that must carry meaningful content

Example

In the BankingTransaction schema (cds_banking.yaml), the description field is defined as:

description:
  description: The transaction description as applied by the financial institution.
  type: string

And listed under required:

required:
  - accountId
  - amount
  - description
  - isDetailAvailable
  - reference
  - status
  - type

However, without minLength: 1, a response like this passes schema validation:

{
  "accountId": "abc123",
  "description": "",
  "amount": "100.00",
  "reference": "ref123",
  "isDetailAvailable": true,
  "status": "POSTED",
  "type": "OTHER"
}

An empty description provides no value to the Data Recipient and defeats the purpose of making the field mandatory.

Observed Behaviour

We observed a Data Holder returning transactions with "description": "" in production. This passes JSON Schema validation (the field is present and is a string), yet provides no meaningful transaction description to the consumer.

Suggested Fix

Adopt minLength: 1 as a default standard for all mandatory string fields across the specification, unless there is a documented reason to allow empty strings (e.g., reference explicitly states "Empty string if no data provided").

Example:

description:
  description: The transaction description as applied by the financial institution.
  type: string
  minLength: 1

This should be applied as a blanket rule to any required field with type: string that does not explicitly document empty string as a valid value. Some examples where this is clearly needed:

  • BankingTransaction.description
  • BankingTransaction.amount
  • BankingAccount.displayName
  • BankingAccount.accountId
  • All ID fields, name fields, and descriptive text fields

Rationale

  • The required keyword only validates that the field is present (not undefined) — it does not prevent empty strings
  • Any mandatory string field without minLength can be trivially satisfied by "", making the required constraint meaningless for practical purposes
  • minLength: 1 should be the default assumption for mandatory strings — only fields that explicitly allow empty values (like reference which states "Empty string if no data provided") should omit it
  • This would allow Data Recipients to rely purely on schema validation to catch non-compliant payloads, without needing custom post-validation logic for every field
  • It provides clearer, enforceable guidance to Data Holders about what constitutes a valid value

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions