First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

import json

from fastapi import FastAPI
from pydantic import BaseModel, Field


class DatabaseFieldInfo(BaseModel):
    name: str = Field(
        default="",
        description="Name of the field in the Database collection",
    )


class DatabaseCollectionInfo(BaseModel):
    name: str = Field(
        description="Name of the Database collection",
    )
    description: str = Field(
        default="",
        description="Description of the Database collection",
    )
    fields: list[DatabaseFieldInfo] = Field(
        default_factory=list,
        description="List of fields in the Database collection",
        json_schema_extra={"default": []},
        exclude=True,
    )


app = FastAPI(title="Minimal FastAPI App", version="1.0.0")


@app.get("/collection", response_model=DatabaseCollectionInfo)
async def get_collection_info() -> DatabaseCollectionInfo:
    return DatabaseCollectionInfo(name="example_collection", fields=[])


if __name__ == "__main__":
    openapi_spec = app.openapi()
    print(json.dumps(openapi_spec, indent=2))

Description

Running the example provide will result in the following output.

Note that fields is set to be exclude=True and it is indeed excluded from the DatabaseCollectionInfo schema, BUT the DatabaseFieldInfo is still rendered in the components list even though it is never used in the API footprint.

This is a regression and was working in 0.118.3, but is no longer working in 0.120.2

{
  "openapi": "3.1.0",
  "info": {
    "title": "Minimal FastAPI App",
    "version": "1.0.0"
  },
  "paths": {
    "/collection": {
      "get": {
        "summary": "Get Collection Info",
        "operationId": "get_collection_info_collection_get",
        "responses": {
          "200": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DatabaseCollectionInfo"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "DatabaseCollectionInfo": {
        "properties": {
          "name": {
            "type": "string",
            "title": "Name",
            "description": "Name of the Database collection"
          },
          "description": {
            "type": "string",
            "title": "Description",
            "description": "Description of the Database collection",
            "default": ""
          }
        },
        "type": "object",
        "required": [
          "name"
        ],
        "title": "DatabaseCollectionInfo"
      },
      "DatabaseFieldInfo": {
        "properties": {
          "name": {
            "type": "string",
            "title": "Name",
            "description": "Name of the field in the Database collection",
            "default": ""
          }
        },
        "type": "object",
        "title": "DatabaseFieldInfo"
      }
    }
  }
}

Operating System

macOS

Operating System Details

No response

FastAPI Version

0.120.2

Pydantic Version

2.12.3

Python Version

Python 3.13.1

Additional Context

Why is this problematic? Setting exclude=True is useful when you need to prevent implementation details from being exposed to the outside world, e.g. via the OpenAPI spec.

But in this regression, even though exclude is set and it is indeed excluded from the parent schema, the nested schemas associated with it are still exposed and can leak details that the API author does not want to expose in the spec, even if the data is not returned by the API.