When you have an object property such as public UserDto Creator , this gets added to the generated OpenAPI schema as a $ref.

As per this issue, "In OpenAPI 3.0.x, in order to combine a $ref with other properties, the $ref needs to be wrapped into allOf"

I found the simplest solution was to add the below to the SwaggerGen initialization:

builder.Services.AddSwaggerGen(options =>
{
    ...
    options.UseAllOfToExtendReferenceSchemas();
}

Swashbuckle will then wrap the $ref in an allOf, and correctly set readOnly to true.

One issue with the accepted answer is that the UserDto object will be readOnly everywhere in the schema, not just for the BlogDto object. This can be a problem if you also need to specify an API for creating a UserDto, in which case the object would not appear in a POST request in the UI.