fix(asm): replace OAS 3.0 nullable: true with OAS 3.1 type unions

[dmchaledev]

Problem

asm/openapi.yaml declares openapi: 3.1.0 but uses nullable: true in five field definitions. This is an OpenAPI 3.0 keyword that is silently ignored under OAS 3.1 (which is based on JSON Schema draft 2020-12). Any OAS 3.1-aware tool — code generators, validators, mock servers — will treat those fields as non-nullable, causing type errors at runtime when the API returns null.

Affected fields:

Schema	Field	Impact
Scan	label	Generated clients won't accept null label
Scan	started_at	Clients will type-error when scan is queued (not yet started)
Scan	completed_at	Clients will type-error when scan is in-progress
ScanDetail	error_message	Clients will type-error on successful scans
Vulnerability	cvss_score	Clients will type-error on vulns with no CVSS score

Fix

Replace nullable: true with the OAS 3.1 / JSON Schema 2020-12 type union syntax:

# Before (OAS 3.0 — ignored in 3.1)
type: string
nullable: true

# After (OAS 3.1 correct)
type: [string, 'null']

Test plan

• spectral lint asm/openapi.yaml --ruleset spectral:oas passes with no warnings about nullable
• An OAS 3.1 code generator (e.g. openapi-generator-cli generate -g typescript-fetch) produces nullable/optional types for the five fields above

https://claude.ai/code/session_01RpWy2Xow4dh8HhFYwcfGRS

---

Generated by Claude Code