Remove minLength validation for the secondEmail attribute from the OpenAPI spec.

[BinoyOza-okta]

Fix: Remove minLength: 5 from UserProfile.secondEmail to Allow Empty Strings

Summary

Removes the minLength: 5 constraint from UserProfile.secondEmail so the SDK can correctly deserialize users whose secondary email is an empty string (""), as returned by the Okta API.

Ticket: OKTA-1146937

Problem

The Okta API returns "" (empty string) for secondEmail when a user has no secondary email configured. The SDK's OpenAPI spec included a minLength: 5 constraint on this field, causing Pydantic validation to reject valid API responses:

1 validation error for UserProfile
secondEmail
  String should have at least 5 characters [type=string_too_short, input_value='', input_type=str]

This broke any SDK operation that deserializes a user profile (e.g., list_users, get_user, create_user) whenever a user had an empty secondEmail.

Root Cause

The OpenAPI spec defined secondEmail with an overly restrictive constraint:

secondEmail:
  type: string
  format: email
  minLength: 5    # ← Rejects empty strings returned by API
  maxLength: 100
  nullable: true

The upstream spec has already been corrected. This PR aligns the SDK with that fix.

Solution

Files Changed

1. openapi/api.yaml — Removed minLength: 5 from UserProfile.secondEmail

   secondEmail:
     type: string
     format: email
     # minLength: 5  ← Removed
     maxLength: 100
     nullable: true

2. okta/models/user_profile.py — Removed min_length=5 from second_email field

   # Before
   second_email: Optional[
       Annotated[str, Field(min_length=5, strict=True, max_length=100)]
   ] = Field(...)
   
   # After
   second_email: Optional[Annotated[str, Field(strict=True, max_length=100)]] = Field(...)

Testing

✅ Verified on live org by fetching a user with secondEmail set to "" (empty string)
✅ User deserialization completes successfully without validation errors
✅ format: email and maxLength: 100 constraints remain intact for non-empty values
✅ No breaking changes — purely removes an incorrect restriction

Related Issues

• okta/okta-sdk-python#477
• okta/okta-sdk-python#481
• okta/okta-management-openapi-spec#242

[lucas-bremond]

👋 Interested in getting this fix merged/released, as this is a blocker for the integration of Okta SDK v3.

[dhiwakar-okta]

LGTM 🚀