RicoSuter/NSwag · error · ArgumentNullException

globalScopeNames

Error message

globalScopeNames

What it means

The SecurityDefinitionAppender constructor throws ArgumentNullException when globalScopeNames is null. The scope name list is stored directly as the security requirement's scope names, so a null sequence is rejected even though an empty list is allowed.

Solutions

1. Pass an empty array instead of null when there are no global scopes
2. Initialize the scope list from config with a null-coalescing default
3. Validate config before constructing the appender

Example fix

// before
new SecurityDefinitionAppender("oauth2", config.Scopes, scheme);
// after
new SecurityDefinitionAppender("oauth2", config.Scopes ?? Array.Empty<string>(), scheme);

var scopes = globalScopeNames ?? Array.Empty<string>();
new SecurityDefinitionAppender(name, scopes, scheme);

bool canAppend = globalScopeNames is not null;

When it happens

Trigger: Constructing SecurityDefinitionAppender(name, null, securityScheme) — typically when the scope list comes from configuration that was not populated.

Common situations: Adding OAuth2/API-key security definitions in a document processor pipeline where global scopes come from appsettings that are missing or null at that point.

Related errors

• document
• items
• key
• This UI does not support multiple documents per UI: Do not…
• The SwaggerUiRoute cannot contain

AI-assisted analysis of RicoSuter/NSwag@63daf8fcc3 (2026-09-14). Data as JSON: /api/errors/5e7491a7e8a4c279. Report an issue: GitHub.

Appendix: source

Thrown at src/NSwag.Generation/Processors/Security/SecurityDefinitionAppender.cs:36

        private readonly OpenApiSecurityScheme _swaggerSecurityScheme;

        /// <summary>Initializes a new instance of the <see cref="SecurityDefinitionAppender" /> class where the security requirement must be manually added.</summary>
        /// <param name="name">The name/key of the security scheme/definition.</param>
        /// <param name="swaggerSecurityScheme">The Swagger security scheme.</param>
        public SecurityDefinitionAppender(string name, OpenApiSecurityScheme swaggerSecurityScheme)
        {
            _name = name;
            _swaggerSecurityScheme = swaggerSecurityScheme;
        }

        /// <summary>Initializes a new instance of the <see cref="SecurityDefinitionAppender" /> class.</summary>
        /// <param name="name">The name/key of the security scheme/definition.</param>
        /// <param name="globalScopeNames">The global scope names to add to as security requirement with the scheme name in the document's 'security' property (can be an empty list).</param>
        /// <param name="swaggerSecurityScheme">The Swagger security scheme.</param>
        public SecurityDefinitionAppender(string name, IEnumerable<string> globalScopeNames, OpenApiSecurityScheme swaggerSecurityScheme)
        {
            _name = name;
            _scopeNames = globalScopeNames ?? throw new ArgumentNullException(nameof(globalScopeNames));
            _swaggerSecurityScheme = swaggerSecurityScheme;
        }

        /// <summary>Processes the specified Swagger document.</summary>
        /// <param name="context"></param>
        public void Process(DocumentProcessorContext context)
        {
            context.Document.SecurityDefinitions[_name] = _swaggerSecurityScheme;

            if (_scopeNames != null)
            {
                if (context.Document.Security == null)
                {
                    context.Document.Security = [];
                }

                context.Document.Security.Add(new OpenApiSecurityRequirement
                {

View on GitHub (pinned to 63daf8fcc3)