Practice-inspired educational scenario
An orders API returns id, status and total. The team wants to add an optional response field named deliveryWindow. Existing fields keep their meaning, and the OpenAPI change check passes. One still-supported mobile-app version, however, uses strict deserialization and rejects a response containing an unknown property. That version cannot be updated before the planned server deployment. The contract has never stated whether clients must ignore unknown fields.
Would you expose the field to every client? In 2–3 sentences, state your decision, how you would limit risk and what evidence you need before broader rollout.
Guiding questions
- Does a passing OpenAPI check prove the behaviour of a particular deserializer?
- Which client version is still part of the supported contract?
- How can you limit exposure and test the change without risking the whole population?