response-header-type-generalized

What this check detects

Responses are the mirror of requests: widening what the server can return is the breaking direction. This check fires when a response header’s type set grows, so the server may now return a value the client was not written to handle.

A header declared `integer` that becomes `number` may now carry `1.5`. A client that parsed the header as an integer breaks on a fractional value, even though on the server side the change looks like a harmless relaxation.

Example

The server may now return a non-integer value (for example 1.5) in X-Rate-Limit, which a client expecting an integer cannot handle.

How to handle this change

When oasdiff flags response-header-type-generalized, you have a few ways to respond:

• Find a backward-compatible alternative. Redesign the change so clients that followed the old contract keep working, and agree on the approach with whoever introduced it.
• Release it in a new API version. Keep the current contract and introduce the change in a new version, then deprecate the old one with a sunset date so clients have time to migrate.
• Accept it as a deliberate breaking change. Sometimes a breaking change is unavoidable, such as an urgent or security fix. Approve it knowingly, document it in your release notes, and tell affected clients. This should be the exception, not a routine way of working.

If oasdiff's verdict does not match your API's compatibility policy, you can also change how it treats response-header-type-generalized with a severity-levels file:

Put one rule per line; the level can be err, warn, or info, or none to disable the check entirely:

# severity.txt
response-header-type-generalized warn

Then pass it to oasdiff:

oasdiff changelog base.yaml revision.yaml --severity-levels severity.txt