From 51c5cc98cfb95ad6ab0746b71c1834f4b950d046 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 3 Jun 2026 11:34:45 +0000
Subject: [PATCH] fix(asm): replace OAS 3.0 nullable:true with OAS 3.1 type
 unions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`nullable: true` is an OpenAPI 3.0 keyword that is silently ignored in
OAS 3.1 (JSON Schema draft 2020-12). The five affected fields — Scan.label,
Scan.started_at, Scan.completed_at, ScanDetail.error_message, and
Vulnerability.cvss_score — are replaced with `type: [T, 'null']`, the
correct OAS 3.1 form. Without this fix, code generators targeting OAS 3.1
produce non-nullable types, causing type errors at runtime when the API
returns null for these fields.

https://claude.ai/code/session_01RpWy2Xow4dh8HhFYwcfGRS
---
 asm/openapi.yaml | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/asm/openapi.yaml b/asm/openapi.yaml
index 3673084..3a1e8ef 100644
--- a/asm/openapi.yaml
+++ b/asm/openapi.yaml
@@ -691,8 +691,7 @@ components:
           readOnly: true
           example: scn_a1b2c3d4e5f60001
         label:
-          type: string
-          nullable: true
+          type: [string, 'null']
         status:
           $ref: '#/components/schemas/ScanStatus'
         scan_type:
@@ -707,14 +706,12 @@ components:
           format: date-time
           readOnly: true
         started_at:
-          type: string
+          type: [string, 'null']
           format: date-time
-          nullable: true
           readOnly: true
         completed_at:
-          type: string
+          type: [string, 'null']
           format: date-time
-          nullable: true
           readOnly: true
 
     ScanDetail:
@@ -746,8 +743,7 @@ components:
                     informational:
                       type: integer
             error_message:
-              type: string
-              nullable: true
+              type: [string, 'null']
               description: Set when status is `failed`
 
     # ── Vulnerabilities ────────────────────────────────────────────────────────
@@ -770,11 +766,10 @@ components:
         status:
           $ref: '#/components/schemas/VulnStatus'
         cvss_score:
-          type: number
+          type: [number, 'null']
           format: float
           minimum: 0
           maximum: 10
-          nullable: true
           example: 10.0
         cve_ids:
           type: array