request-required-property-became-read-only

What this check detects

`readOnly` means a property is returned by the server but not sent by clients. OpenAPI resolves the combination with `required` in the client’s favour: a property that is both required and read-only is required in responses only, never in requests.

So marking a required request property read-only relaxes the request contract, clients no longer need to send it. That is why it is informational rather than breaking.

Example

"id" stays in required, but because it is read-only the requirement applies to responses only. Requests that omit it are still valid.

How to handle this change

When oasdiff flags request-required-property-became-read-only, you have a few ways to respond:

• Find a backward-compatible alternative. Redesign the change so clients that followed the old contract keep working, and agree on the approach with whoever introduced it.
• Release it in a new API version. Keep the current contract and introduce the change in a new version, then deprecate the old one with a sunset date so clients have time to migrate.
• Accept it as a deliberate breaking change. Sometimes a breaking change is unavoidable, such as an urgent or security fix. Approve it knowingly, document it in your release notes, and tell affected clients. This should be the exception, not a routine way of working.

If oasdiff's verdict does not match your API's compatibility policy, you can also change how it treats request-required-property-became-read-only with a severity-levels file:

Put one rule per line; the level can be err, warn, or info, or none to disable the check entirely:

# severity.txt
request-required-property-became-read-only err

Then pass it to oasdiff:

oasdiff changelog base.yaml revision.yaml --severity-levels severity.txt