API specification bug

In the webpage Merge requests API | GitLab

When create a new merge request, the API need two parameters: source_branch and target_branch.

I installed GitLab using Docker Engine, and the version is GitLab Community Edition 13.12.4.
In the system, source_branch and target_branch require existing branch resource.

But when I tested the API, I had the following problems:

POST /projects/:id/merge_requests

body:

{“title":“titleString”,“source_branch”:“source_branchString”,“target_branch”:“target_branchString”}

response
201 Created

{“id”:2,“iid”:2,“project_id”:14,“title”:“titleString”,“description”:null,“state”:“opened”,“created_at”:“2021-09-09T01:14:14.144Z”,“updated_at”:“2021-09-09T01:14:14.144Z”,“merged_by”:null,“merged_at”:null,“closed_by”:null,“closed_at”:null,“target_branch”:“target_branchString”,“source_branch”:“source_branchString”,“user_notes_count”:0,“upvotes”:0,“downvotes”:0,“author”:{“id”:9,“name”:"first last”,“username”:“username”,“state”:“active”,“avatar_url”:“https://www.gravatar.com/avatar/fb5f034bf1bafc9589f29ffb0860fd1a?s=80\u0026d=identicon",“web_url”:“http://127.0.0.1/username”},“assignees”:[],“assignee”:null,“reviewers”:[],“source_project_id”:14,“target_project_id”:14,“labels”:[],“work_in_progress”:false,“milestone”:null,“merge_when_pipeline_succeeds”:false,“merge_status”:“checking”,“sha”:null,“merge_commit_sha”:null,“squash_commit_sha”:null,“discussion_locked”:null,“should_remove_source_branch”:null,“force_remove_source_branch”:null,“reference”:"!2",“references”:{“short”:"!2",“relative”:"!2",“full”:“username/nameString!2”},“web_url”:“http://127.0.0.1/username/nameString/-/merge_requests/2”,“time_stats”:{“time_estimate”:0,“total_time_spent”:0,“human_time_estimate”:null,“human_total_time_spent”:null},“squash”:false,“task_completion_status”:{“count”:0,“completed_count”:0},“has_conflicts”:false,“blocking_discussions_resolved”:true,“subscribed”:true,“changes_count”:null,“latest_build_started_at”:null,“latest_build_finished_at”:null,“first_deployed_to_production_at”:null,“pipeline”:null,“head_pipeline”:null,“diff_refs”:null,“merge_error”:null,“user”:{"can_merge”:true}}

The API also returns 201 when two resources are randomly generated strings. This could be a potential bug.