Branding theme response models mark 'displayName' (and other fields) as required, causing "Failed to deserialize response" on valid API responses

[wasabii]

Describe the problem

The generated branding-theme response models mark fields such as displayName as required (required member / [RequiredMember]), but the Auth0 Management API omits displayName from the response when a theme has no display name. As a result, IManagementApiClient.Branding.Themes.GetAsync(...) / GetDefaultAsync() throw on a perfectly valid HTTP 200 response:

Auth0.ManagementApi.ManagementApiException: Failed to deserialize response
 ---> System.Text.Json.JsonException: JSON deserialization for type
      'Auth0.ManagementApi.GetBrandingThemeResponseContent' was missing
      required properties including: 'displayName'.

This makes it impossible to read a branding theme that was created without a display name — the API accepts and stores such a theme, but the SDK cannot read it back.

CreateAsync is affected the same way, with a worse side effect. CreateBrandingThemeResponseContent also marks displayName as required. If you call Branding.Themes.CreateAsync(...) without a DisplayName, the POST succeeds server-side (the theme is created), but the SDK then throws Failed to deserialize response while parsing the create response (which omits displayName). The caller sees only an exception and never receives the new ThemeId, so the just-created theme is effectively orphaned — it exists in the tenant but the caller has no handle to it, and every subsequent GetAsync/GetDefaultAsync throws as well. There is no clean way to recover it through the SDK.

Affected versions

Reproduced with Auth0.ManagementApi 8.3.0 and 9.1.0 (latest). In 9.x the problem is broadened — additional response fields are now required as well (e.g. Fonts), so any theme for which the API omits one of those fields will fail the same way.

// GetBrandingThemeResponseContent (9.1.0, decompiled)
[JsonPropertyName("displayName")]
public required string DisplayName { get; set; }
[JsonPropertyName("fonts")]
public required BrandingThemeFonts Fonts { get; set; }

Reproduction

1. Have a tenant whose branding theme has no display name (create one without displayName). The Management API returns a theme JSON with no displayName key, e.g.:

{
  "borders": { "button_border_radius": 10, /* ... */ },
  "colors":  { /* ... */ },
  "fonts":   { /* ... */ },
  "page_background": { /* ... */ },
  "widget":  { /* ... */ },
  "themeId": "5bkX................"
  // note: no "displayName" key
}

2. Call any of the theme read methods:

var api = new ManagementApiClient(token, new ClientOptions { BaseUrl = $"https://{domain}/api/v2/" });

await api.Branding.Themes.GetAsync("default");      // throws
await api.Branding.Themes.GetAsync(themeId);        // throws
await api.Branding.Themes.GetDefaultAsync();        // throws

Each throws ManagementApiException: Failed to deserialize response (inner JsonException as above).

A theme that does have a display name (the API then includes "displayName": "...") deserializes and reads back fine — confirming the trigger is solely the omitted field.

The same happens on create:

// POST succeeds and the theme is created in Auth0, but this call throws
// while deserializing the (displayName-less) response, so the caller never
// gets the ThemeId back -> orphaned theme.
await api.Branding.Themes.CreateAsync(new CreateBrandingThemeRequestContent { /* no DisplayName */ });

Expected behavior

GetAsync / GetDefaultAsync should successfully deserialize a valid 200 branding-theme response even when optional fields such as displayName are absent (DisplayName should be null), instead of throwing.

Actual behavior

Deserialization throws because displayName (and, in 9.x, other fields) are modeled as required, so any response that omits them fails.

Suggested fix

Do not mark branding-theme response properties as required when the Management API can legitimately omit them. At minimum GetBrandingThemeResponseContent.DisplayName and GetBrandingDefaultThemeResponseContent.DisplayName should be optional (nullable, non-required). The required fields added in 9.x for these response types should be reviewed against what the API actually guarantees to return.

Environment

• Auth0.ManagementApi 8.3.0 and 9.1.0
• .NET 10, System.Text.Json
• Auth0 Management API v2, GET /api/v2/branding/themes/{id} and GET /api/v2/branding/themes/default

[kailash-b]

Hi @wasabii 👋

Thanks for reaching out.

The root-cause of the issue is that, we are allowing users to create Branding Themes without providing a displayName. However, the response expects the displayName as a required field (hence the deserialisation failure).

We are taking this up internally to see how we can fix the issue with minimum impact to existing users.
Will keep this thread updated.

Thanks for your patience 🤝