Schema Enforcement

Upload your OpenAPI spec; Shield blocks every request that doesn't conform. Kills mass-assignment + parameter-tampering attacks dead — at the edge, before reaching your code.

The premise

Your OpenAPI spec is a security contract: it says "these endpoints accept these methods with these parameters of these types." Real users always conform to the spec — they use your UI which uses your spec. Attackers don't; they send malformed or extra-field requests probing for behavior outside the spec.

Schema Enforcement makes that contract literal: any request that doesn't conform is rejected at the edge. Catches:

  • Mass assignment — POST with extra fields (is_admin: true) the spec doesn't declare.
  • Method tampering — DELETE on endpoints declared GET-only.
  • Parameter type confusion — string where the spec says integer.
  • Missing required fields — caught before reaching your validation code.
  • Path traversal — IDs that don't match the declared pattern.
  • Deprecated-endpoint hits — /v1 reached when only /v2 is declared.

Spec ingestion

Three sources:

  • Paste / upload — OpenAPI 3.0/3.1 YAML or JSON.
  • URL fetch — Shield pulls from your /openapi.json nightly. Useful when your spec auto-publishes from CI.
  • Generated from DAST — discovery mode of API Scanner produces an OpenAPI spec from your live API; pipe it into Shield.

Strictness levels

Lenient   — Path + method must match spec. Body extra fields allowed.
Standard  — Path + method + body schema (extra fields rejected).
Strict    — Standard + query params + path params + headers all validated.
            Format/regex/enum constraints enforced.

Recommended progression: Lenient → Standard → Strict, with a week of Log-mode at each level before promoting.

Per-endpoint overrides

Some endpoints intentionally accept extra fields (free-form metadata, webhooks). Mark them with x-shield-extra-fields-allowed: true in your OpenAPI spec, or override in the Shield UI.

Spec drift detection

Schema Enforcement runs in two directions: rejects spec violations from clients AND surfaces production endpoints missing from your spec. Sync via Shield → Schema → Generate spec patch.

Auth-context awareness

OpenAPI supports security: per-endpoint. Shield enforces it — a route declared to require Bearer auth that arrives without one is rejected before reaching your code. Same for API key, OAuth scopes, mTLS client cert presence.

Performance

Spec is loaded into Worker memory at boot (~50KB compiled validator for a typical spec). Per-request decision: 2-5ms for Lenient/Standard, 8-15ms for Strict on bodies > 10KB.

CI/CD integration

# Push the latest spec to Shield on every main merge
- name: Update Shield schema
  if: github.ref == 'refs/heads/main'
  run: |
    curl -sf -X PUT https://api.sectora.io/api/v1/shield/sites/$SITE_ID/schema \
      -H "Authorization: Bearer $SECTORA_API_KEY" \
      -H "Content-Type: application/yaml" \
      --data-binary @openapi.yaml

What's next