Nullable fields explicitly marked
Why it matters
When a field typed as string returns null at runtime, consumers get a type error or a silent coercion depending on their language. When some endpoints omit missing fields and others include them as null, every consumer must guard against both undefined and null for every optional field. This is the most common source of unexpected Cannot read properties of null errors in client applications. iso-25010:2011 compatibility.interoperability requires that the schema truthfully represent what the API sends — nullability is a core part of that contract.
Severity rationale
Medium because undeclared nullability causes runtime type errors in consumers and forces defensive null-guarding throughout client code without enabling direct security exploits.
Remediation
Mark nullable fields explicitly in both your TypeScript types and your OpenAPI schema. Choose one approach for missing data — always include with null, or always omit — and document it:
// TypeScript -- explicit nullability:
interface UserResponse {
id: string // always present
name: string // always present
avatarUrl: string | null // explicitly nullable
bio: string | null // explicitly nullable
}
# OpenAPI -- nullable fields:
UserResponse:
type: object
required: [id, name]
properties:
avatarUrl: { type: string, nullable: true }
Consistency between "return null" and "omit the field" is non-negotiable — consumers cannot handle both reliably.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · compatibility.interoperability — Interoperability — explicit nullability prevents consumer misinterpretation
Taxons
History
- 2026-04-18·v1.0.0·Initial import from api-design·automated