PH67732: HTTP status code 500 is returned when an OpenAPI 3 API requester sends an empty request body.

APAR status

• Closed as unreproducible in next release.

Error description

• When an API requester calls the REST API GET method with empty
  body, the API endpoint receives a request with Content-Type
  "application/json" with no body. The API endpoint returns HTTP
  status code 500 with following error message:
  
  {"fault":{"faultstring":"JSONThreatProtection[JTP-message]:
  Execution failed. reason: Expecting { or [ at line
  1","detail":
  {"errorcode":"steps.jsonthreatprotection.ExecutionFailed"}}
  
  A trace of the problem shows that the Content Type has been set
  to "application/json":
  > suppressContentTypeForEmptyBody Entry
  < suppressContentTypeForEmptyBody Exit
                          false
  > getEndpointRequestContentType Entry
  < getEndpointRequestContentType Exit
                          application/json
  3 Adding Content-type header application/json for empty body
  
  Additional search words:
  BAQP0073E msgBAQP0073E BAQP0073 msgBAQP0073 BAQP0068W
  msgBAQP0068W BAQP0068 msgBAQP0068 BAQP0068E msgBAQP0068E
  BAQP0069I msgBAQP0069I BAQP0069 msgBAQP0069 BAQP0069E
  msgBAQP0069E faultstring fault
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of z/OS Connect V3.0 API           *
  *                 requesters with the oasRequester-1.0 feature *
  *                 (OpenAPI 3).                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: HTTP status code 500 is returned when   *
  *                      an OpenAPI 3 API requester sends an     *
  *                      empty request body.                     *
  ****************************************************************
  When an OpenAPI 3 API requester request with no payload was sent
  to an API endpoint a Content-Type header "application/json"
  value was sent. The API endpoint was not expecting the
  Content-Type header and return HTTP status code 500.
  This problem is similar to the issue fixed for OpenAP2 API
  requesters under APAR PH39672.
  
  API requester Gradle plug-in attribute
  sendContentTypeForEmptyBody has been added and can be specified
  in the options.yaml when building API requesters. The default
  value is "TRUE", which preserves the original behaviour and an
  "application/json" Content-Type header will be sent with a
  request that has an empty body.
  
  Setting sendContentTypeForEmptyBody: FLASE when an API requester
  is built, will result in the z/OS Connect not sending a Content-
  Type header to the API endpoint when there is an empty body on
  the request.
  
  To resolve conflicts in message numbers message number BAQP0068W
  has been change to BAQP0071W:
  BAQP0071W: The parsed OpenAPI document has additional properties
             and it is ignored for API provider projects.
  Explanation:
  z/OS Connect does not support additionalProperties in OpenAPI
  documents for API provider projects.
  User Action:
  For information only.
  
  Message BAQP0069I has been change to BAQP0072I
  BAQP0072I: inlineMaxOccursLimit property value is updated to 21.
  Explanation:
  inlineMaxOccursLimit value is less than 21. For
  additionalProperties, inlineMaxOccursLimit property must be
  equal to or greater than 21.
  User Action:
  For information only.
  
  The following new message has been added:
  BAQP0073E: The "sendContentTypeForEmptyBody" property value
             <value> is invalid.
  Explanation:
  The supplied "sendContentTypeForEmptyBody" property is invalid
  please use one of TRUE, or FALSE.
  User Action:
  Correct the sendContentTypeForEmptyBody property value.
  

Problem conclusion

Temporary fix

Comments

• z/OS Connect has been changed to allow the
  sendContentTypeForEmptyBody attribute to be set to FALSE for
  OpenAPI 3 API requesters, allowing reported problem to be
  prevented.
  
  The fix for this APAR is expected to be delivered by the PTFs
  for z/OS Connect V3.0.99.0 (PH68482).
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  Z/OS CONNECT EE

• Fixed component ID

  5655CE300

Applicable component levels