-
Notifications
You must be signed in to change notification settings - Fork 9.2k
v3.3: Add a global parameters field #5446
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: v3.3-dev
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -103,6 +103,7 @@ In addition to the required fields, at least one of the `components`, `paths`, o | |
| | <a name="oas-webhooks"></a>webhooks | Map[`string`, [Path Item Object](#path-item-object)] | The incoming webhooks that MAY be received as part of this API and that the API consumer MAY choose to implement. Closely related to the `callbacks` feature, this section describes requests initiated other than by an API call, for example by an out of band registration. The key name is a unique string to refer to each webhook, while the (optionally referenced) Path Item Object describes a request that may be initiated by the API provider and the expected responses. An [example](https://learn.openapis.org/examples/v3.1/webhook-example.html) is available. | | ||
| | <a name="oas-components"></a>components | [Components Object](#components-object) | An element to hold various Objects for the OpenAPI Description. | | ||
| | <a name="oas-security"></a>security | [[Security Requirement Object](#security-requirement-object)] | A declaration of which security mechanisms can be used across the API. The list of values includes alternative Security Requirement Objects that can be used. Only one of the Security Requirement Objects need to be satisfied to authorize a request. Individual operations can override this definition. The list can be incomplete, up to being empty or absent. To make security explicitly optional, an empty security requirement (`{}`) can be included in the array. | | ||
| | <a name="path-item-parameters"></a>parameters | [[Parameter Object](#parameter-object) \| [Reference Object](#reference-object)] | A list of parameters that are applicable for all operations in this API. These parameters can be overridden at the path item or operation levels, but cannot be removed there. The list MUST NOT include duplicated parameters. A unique parameter is defined by a combination of a [name](#parameter-name) and [location](#parameter-in). The list can use the [Reference Object](#reference-object) to link to parameters that are defined in the [OpenAPI Object's `components.parameters`](#components-parameters). | | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. what does it mean to have a path parameter in this collection if the Path Item path template does not have a match for it?
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. v3.2.0 §4.12.2.1: "If in is "path", the name field MUST correspond to a single template expression occurring within the path field in the Paths Object."
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, what I'm worried about is that it'll be easy for people to produce invalid documents. But maybe I'm over-indexing? |
||
| | <a name="oas-tags"></a>tags | [[Tag Object](#tag-object)] | A list of tags used by the OpenAPI Description with additional metadata. The order of the tags can be used to reflect on their order by the parsing tools. Not all tags that are used by the [Operation Object](#operation-object) must be declared. The tags that are not declared MAY be organized randomly or based on the tools' logic. Each tag name in the list MUST be unique. | | ||
| | <a name="oas-external-docs"></a>externalDocs | [External Documentation Object](#external-documentation-object) | Additional external documentation. | | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| openapi: 3.3.0 | ||
| info: | ||
| title: API | ||
| version: 1.0.0 | ||
| parameters: | ||
| - name: myquerystring | ||
| in: querystring | ||
| content: | ||
| application/json: | ||
| schema: | ||
| type: string | ||
| - name: myquery | ||
| in: query | ||
| schema: | ||
| type: string |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| openapi: 3.3.0 | ||
| info: | ||
| title: API | ||
| version: 1.0.0 | ||
| parameters: | ||
| - name: myquerystring1 | ||
| in: querystring | ||
| content: | ||
| application/json: | ||
| schema: {} | ||
| - name: myquerystring2 | ||
| in: querystring | ||
| content: | ||
| application/json: | ||
| schema: {} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| openapi: 3.3.0 | ||
| info: | ||
| title: API | ||
| version: 1.0.0 | ||
| parameters: | ||
| - name: limit | ||
| in: query | ||
| schema: | ||
| type: integer | ||
| minimum: 0 | ||
| paths: | ||
| /things: | ||
| summary: Lots of things | ||
| get: | ||
| summary: Get a list of things | ||
| responses: | ||
| default: | ||
| description: A list of things |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How does this interact with definitions split across multiple files? The restriction
Makes me worried that this will not be useful outside of very narrow use cases, though if it is scoped to the file it is defined in then it might be fine (though bring it's own complexities).
Eg: I could imagine using this for authentication related headers, but often you might have a handful of authentication related routes (for login, token refresh, password reset) that don't want those headers.
The other main use case I picture is flow control/rate limit related headers which might be ok without any scoping.
By multiple files, I mean I normally structure things like
I'd wonder if being able to specify
(name, in, schema: null)or similar on a route/operation level to remove the parameter would be worthwhile.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good point. Can we consider the overriding mechanism as a way to "remove" by nulling it out down stream?
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I shudder at the idea of
schema: null. But I thinkschema: falseshould probably do just what you want.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mikekistler is correct.
nullis not a valid schema butfalseis.@mnahkies We expect this to have a fairly narrow use case, and probably more for request headers or cookies than query params (or certainly path params).
Document vs API scope is a mess, currently, and there's really no way to fix it until 4.0. Things at the root level (except the Info Object) are all scoped at API level (
securityandservers), soparametersshould probably follow that rather than create yet another usage pattern (as @baywet has noted, we have too many already).There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm hoping to clarify some of this a bit in 3.3. But currently I would say that global
parametersapplies in exactly the same way as globalservers,securitySchemesandtagsdo. I have my own personal interpretation of how this works today, but this may differ from others' interpretations, which is why I hope to clarify the current state and then use that to move forward with more features to allow more flexibility in how APIs are defined with multiple documents.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That all makes sense.
To be clear my concern on the narrow use case is that even for headers and cookies, it may often not be useable if there is no way to remove it from a few specific operations.
schema: falsewould work for me.(I can think of ways to hack around being unable to remove parameters from operations but I don't particularly like them and think it would muddy the conversation)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mnahkies While technically the spec does say that you can't remove a parameter at the Operation Object level (and therefore with this new addition, also at the Path Item Object level), setting
schema: falseeffectively does this. The UX isn't great because documentation tools will still show it, but afalseschema forbids all values so even if it is there it is not usable.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overlays can remove things, can't it? so that's also an option to remove a parameter.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@karenetheridge With overlays, you'd have to remove the global and distribute it to every Path Item where you wanted it, and just leave it out of those you don't.