{"record":{"id":"a143753fdc6d6922","repo":"projectdiscovery/nuclei","slug":"not-a-valid-openapi-3-0-spec-found-version-v","errorCode":null,"errorMessage":"not a valid OpenAPI 3.0 spec (found version: %v)","messagePattern":"not a valid OpenAPI 3\\.0 spec \\(found version: (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/input/formats/openapi/downloader.go","lineNumber":74,"sourceCode":"\t}\n\n\tbodyBytes, err := io.ReadAll(io.LimitReader(resp.Body, maxSpecSizeBytes))\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to read response body\")\n\t}\n\n\t// Validate it's a valid JSON and has OpenAPI structure\n\tvar spec map[string]interface{}\n\tif err := json.Unmarshal(bodyBytes, &spec); err != nil {\n\t\treturn \"\", fmt.Errorf(\"downloaded content is not valid JSON: %w\", err)\n\t}\n\n\t// Check if it's an OpenAPI 3.0 spec\n\tif openapi, exists := spec[\"openapi\"]; exists {\n\t\tif openapiStr, ok := openapi.(string); ok && strings.HasPrefix(openapiStr, \"3.\") {\n\t\t\t// Valid OpenAPI 3.0 spec\n\t\t} else {\n\t\t\treturn \"\", fmt.Errorf(\"not a valid OpenAPI 3.0 spec (found version: %v)\", openapi)\n\t\t}\n\t} else {\n\t\treturn \"\", fmt.Errorf(\"not an OpenAPI spec (missing 'openapi' field)\")\n\t}\n\n\t// Extract host from URL for server configuration\n\tparsedURL, err := url.Parse(urlStr)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to parse URL\")\n\t}\n\thost := parsedURL.Host\n\tscheme := parsedURL.Scheme\n\tif scheme == \"\" {\n\t\tscheme = \"https\"\n\t}\n\n\t// Add servers section if missing or empty\n\tservers, exists := spec[\"servers\"]","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/input/formats/openapi/downloader.go#L56-L92","documentation":"The downloaded JSON parsed fine and contains a top-level `openapi` field, but its value is not a string starting with \"3.\" (e.g. \"2.0\", \"4.0.0\", or a non-string type such as a number). The downloader only supports OpenAPI 3.x documents, so any other version is rejected with the offending value in the message.","triggerScenarios":"Feeding a Swagger 2.0 document (swagger: \"2.0\" plus openapi-style hosting) to `-im openapi`; a spec generator emitting the version as a number (openapi: 3.0.1 is invalid JSON Schema typing); experimental 3.x-lookalike or 4.x specs.","commonSituations":"Old API gateways (API Gateway 2015-era exports, older Loopback/Swashbuckle) that only emit 2.0; hand-edited specs where the version string got mangled; mixing up the two input modes when a company has both v2 and v3 specs.","solutions":["If the spec is Swagger 2.x, run with `-im swagger` instead","If the spec is genuinely 3.x, ensure the field is a quoted string like \"openapi\": \"3.0.3\"","Upgrade/convert the 2.0 spec to 3.x with a converter (e.g. swagger2openapi) if you must use openapi mode","Check the printed 'found version' value to confirm what the server actually served"],"exampleFix":"# before (2.0 spec in openapi mode -> not a valid OpenAPI 3.0 spec)\nnuclei -im openapi -u https://host/swagger.json\n\n# after\nnuclei -im swagger -u https://host/swagger.json","handlingStrategy":"validation","validationCode":"var spec struct {\n    OpenAPI any `json:\"openapi\"`\n}\njson.Unmarshal(body, &spec)\nif v, ok := spec.OpenAPI.(string); !ok || !strings.HasPrefix(v, \"3.\") {\n    return fmt.Errorf(\"spec is not OpenAPI 3.x; use swagger mode if it is 2.x\")\n}","typeGuard":"func isOpenAPI3(spec map[string]any) bool {\n    v, ok := spec[\"openapi\"].(string)\n    return ok && strings.HasPrefix(v, \"3.\")\n}","tryCatchPattern":"if strings.Contains(err.Error(), \"not a valid OpenAPI 3.0 spec\") {\n    // switch to -im swagger for 2.x docs, or fix the version field to a \"3.x.y\" string\n}","preventionTips":["Check the first line of the spec: \"openapi\": \"3.x.y\" as a quoted string","Map spec version to input mode: 2.x -> swagger, 3.x -> openapi","Re-validate specs after running them through converters"],"tags":["openapi","version","spec-validation","download"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}