It could be verified at runtime, but I haven't seen anyone trying to version/hash schemas and include that in the request. The workaround in practice seems to

It could be verified at runtime, but I haven't seen anyone trying to version/hash schemas and include that in the request. The workaround in practice seems to be to keep the DB behind a server that always™ uses a compatible schema and exposes an API that's either properly versioned or at least safe for slightly older clients. To be fair it's hard to get rid of the middleman and serve straight from the DB, it's always deemed too scary for many reasons, so it's not that bad.