I mentioned this on slack: It's rather ridiculous to be required to specify all 3, I'd propose this should use anyOf

https://swagger.io/docs/specification/v3_0/data-models/oneof-anyof-allof-not/

OWASP/www-project-web-security-testing-guide#460 (comment)