An enumeration restricts a value to a named list of permitted alternatives. Instead of accepting any string, an API can accept only known, valid values. section 5.8 section 6.3
Enumerations matter when unconstrained strings expose an API to unexpected behavior. A free-form sortBy parameter lets attackers probe field names, discover hidden schema properties, or trigger errors. A restricted enumeration rejects values outside the intended interface. section 6.3
Restricting a product sort parameter
A product endpoint can allow sorting only by price, review, or name. A request using is_exclusive might otherwise reveal a hidden model property; an enumeration prevents that value by design. section 6.3
Validating data from another API
A character status model can define wizard, witch, and muggle as its only valid values. If an external API returns something else, validation stops the update before invalid data reaches the database. The failure should be logged and exposed through an understandable error response. section 5.8
Use enumerations alongside other controls rather than treating them as a complete defense. Parameterize database queries to address injection, validate data from every service boundary, and use separate schemas when alternatives require different properties. section 5.8 section 6.4.1
