OAuth 2 flow with empty scopes produces invalid specification

According to the OpenApi specification, it is possible to specify an OAuth 2 security scheme without specifying any scopes. In this case, the specification should contain scopes: {}. See https://swagger.io/docs/specification/authentication/oauth2/.

I have used the follow configuration for the security scheme but the scopes object is removed:

settings.GeneratorSettings.DocumentProcessors.Add(
    new SecurityDefinitionAppender("oauth2", new OpenApiSecurityScheme
    {
        Description = "My oauth flow",
        Type = OpenApiSecuritySchemeType.OAuth2,
        Flow = OpenApiOAuth2Flow.Password,
        TokenUrl = "api/token",
        Scopes = new Dictionary<string, string>(),
    }));

The resulting section in the swagger.json looks like this:

"securitySchemes": {
  "oauth2": {
    "type": "oauth2",
    "description": My oauth flow",
    "flows": {
      "password": {
        "tokenUrl": "api/token"
      }
    }
  }
}

[RicoSuter]

Could the problem be a serializer setting or logic decision that is preventing the empty Scopes dictionary from being serialized?

I think there could be a “converter” which hides empty collection which might affect this one…

This one? https://github.com/RicoSuter/NJsonSchema/blob/master/src/NJsonSchema/Infrastructure/IgnoreEmptyCollectionsContractResolver.cs

Is the “scopes” required according to specs? If yes we should set it to required in the attribute: https://github.com/RicoSuter/NSwag/blob/master/src/NSwag.Core/OpenApiOAuthFlow.cs#L30 so that the resolver above does not “hide” it…

Yes, it is: https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.0.md#oauth-flow-object

[CNBoland]

I’m running into this, too. I’m working with my API in Postman. Postman validates the OpenAPI definition and is complaining about the missing scopes property.

I setup a sample here to check serialization. With default serialization setting, the NSwag.OpenApiOAuthFlow.Scopes property renders correctly as an empty object.

Could the problem be a serializer setting or logic decision that is preventing the empty Scopes dictionary from being serialized?