Copyright © ${options.publishDate.getFullYear()} the Linux Foundation
`; + preface += `Copyright © 3001 the Linux Foundation
Text for first chapter
+This is the conformance section
+Text for first section
+Definition of Foo.
+Text for second section
+ +Relative link to something else
+Text for first subsection
+[[RFC3986]]
+[[RFC9110]] Section 4
+{
+ "foo": true
+}
+foo: true
+text/plain
+no language
+unknown language
+https://foo.com/bar?baz=qux&fred=waldo#fragment
+https://foo.com/bar{?baz*,qux}
+--boundary-example
+Content-Type: application/openapi+yaml
+Content-Location: https://inaccessible-domain.com/api/openapi.yaml
+
+openapi: 3.2.0
+info:
+ title: Example API
+ version: 1.0
+ externalDocs:
+ url: docs.html
+
+--boundary-example
+Content-Type: text/html
+Content-Location: https://example.com/api/docs.html
+
+<html>
+ <head>
+ <title>API Documentation</title>
+ </head>
+ <body>
+ <p>Awesome documentation goes here</p>
+ </body>
+</html>
+event: addString
+data: This data is formatted
+data: across two lines
+retry: 5
+
+event: addNumber
+data: 1234.5678
+unknownField: this is ignored
+
+: This is a comment
+event: addJSON
+data: {"foo": 42}
+{"event": "addString", "data": "This data is formatted\nacross two lines", "retry": 5}
+{"event": "addNumber", "data": "1234.5678"}
+{"event": "addJSON", "data": "{\"foo\": 42}"}
+{"event": "addString", "data": "This data is formatted\nacross two lines", "retry": 5}
+{"event": "addNumber", "data": "1234.5678"}
+{"event": "addJSON", "data": "{\"foo\": 42}"}
+0x1E{
+ "timestamp": "1985-04-12T23:20:50.52Z",
+ "level": 1,
+ "message": "Hi!"
+}
+0x1E{
+ "timestamp": "1985-04-12T23:20:51.37Z",
+ "level": 1,
+ "message": "Bye!"
+}
+| Version | +Date | +
|---|---|
| 30.0.1 | +3001-04-01 | +
Awesome documentation goes here
+ + +``` + +```eventstream +event: addString +data: This data is formatted +data: across two lines +retry: 5 + +event: addNumber +data: 1234.5678 +unknownField: this is ignored + +: This is a comment +event: addJSON +data: {"foo": 42} +``` + +```jsonl +{"event": "addString", "data": "This data is formatted\nacross two lines", "retry": 5} +{"event": "addNumber", "data": "1234.5678"} +{"event": "addJSON", "data": "{\"foo\": 42}"} +``` + +```ndjson +{"event": "addString", "data": "This data is formatted\nacross two lines", "retry": 5} +{"event": "addNumber", "data": "1234.5678"} +{"event": "addJSON", "data": "{\"foo\": 42}"} +``` + +```jsonseq +0x1E{ + "timestamp": "1985-04-12T23:20:50.52Z", + "level": 1, + "message": "Hi!" +} +0x1E{ + "timestamp": "1985-04-12T23:20:51.37Z", + "level": 1, + "message": "Bye!" +} +``` + +## Appendix A: Revision History + +Version | Date +--------|----------- +30.0.1 | 3001-04-01 diff --git a/tests/md2html/fixtures/basic-old.html b/tests/md2html/fixtures/basic-old.html new file mode 100644 index 0000000000..c0beda2755 --- /dev/null +++ b/tests/md2html/fixtures/basic-old.html @@ -0,0 +1,38 @@ + + + + + +Copyright © 3001 the Linux Foundation
Text for first chapter
+This is the conformance section
+Text for first section
+Broken anchor
+Text for first subsection
+| Version | +Date | +
|---|---|
| 30.0.1 | +3001-04-01 | +
foo|bar. foo|bar. foo|bar. form‑urlencoded |
+| [RFC1866](https://datatracker.ietf.org/doc/html/rfc1866#section-8.2.1) | 11/1995 | content-based serialization | [[RFC1738]] | obsoleted by [[HTML401]] [Section 17.13.4.1](https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1), [[URL]] [Section 5](https://url.spec.whatwg.org/#urlencoded-serializing) |
+
+Style-based serialization is used in the [Parameter Object](#parameter-object) when `schema` is present, and in the [Encoding Object](#encoding-object) when at least one of `style`, `explode`, or `allowReserved` is present.
+See [Appendix C](#appendix-c-using-rfc6570-based-serialization) for more details of RFC6570's two different approaches to percent-encoding, including an example involving `+`.
+
+Content-based serialization is defined by the [Media Type Object](#media-type-object), and used with the [Parameter Object](#parameter-object) when the `content` field is present, and with the [Encoding Object](#encoding-object) based on the `contentType` field when the fields `style`, `explode`, and `allowReserved` are absent.
+Each part is encoded based on the media type (e.g. `text/plain` or `application/json`), and must then be percent-encoded for use in a `form-urlencoded` string.
+
+Note that content-based serialization for `form-data` does not expect or require percent-encoding in the data, only in per-part header values.
+
+#### Interoperability with Historical Specifications
+
+In most cases, generating query strings in strict compliance with [[RFC3986]] is sufficient to pass validation (including JSON Schema's `format: "uri"` and `format: "uri-reference"`), but some `form-urlencoded` implementations still expect the slightly more restrictive [[RFC1738]] rules to be used.
+
+Since all RFC1738-compliant URIs are compliant with RFC3986, applications needing to ensure historical interoperability SHOULD use RFC1738's rules.
+
+#### Interoperability with Web Browser Environments
+
+WHATWG is a [web browser-oriented](https://whatwg.org/faq#what-is-the-whatwg-working-on) standards group that has defined a "URL Living Standard" for parsing and serializing URLs in a browser context, including parsing and serializing `form-urlencoded` data.
+WHATWG's percent-encoding rules for query strings are different depending on whether the query string is [being treated as `form-urlencoded`](https://url.spec.whatwg.org/#application-x-www-form-urlencoded-percent-encode-set) (where it requires more percent-encoding than [[RFC1738]]) or [as part of the generic syntax](https://url.spec.whatwg.org/#query-percent-encode-set), where it allows characters that [[RFC3986]] forbids.
+
+Implementations needing maximum compatibility with web browsers SHOULD use WHATWG's `form-urlencoded` percent-encoding rules.
+However, they SHOULD NOT rely on WHATWG's less stringent generic query string rules, as the resulting URLs would fail RFC3986 validation, including JSON Schema's `format: uri` and `format: uri-reference`.
+
+### Decoding URIs and `form-urlencoded` Strings
+
+The percent-decoding algorithm does not care which characters were or were not percent-decoded, which means that URIs percent-encoded according to any specification will be decoded correctly.
+
+Similarly, all `form-urlencoded` decoding algorithms simply add `+`-for-space handling to the percent-decoding algorithm, and will work regardless of the encoding specification used.
+
+However, care must be taken to use `form-urlencoded` decoding if `+` represents a space, and to use regular percent-decoding if `+` represents itself as a literal value.
+
+### Percent-Encoding and Illegal or Reserved Delimiters
+
+The `[`, `]`, `|`, and space characters, which are used as delimiters for the `deepObject`, `pipeDelimited`, and `spaceDelimited` styles, respectively, all MUST be percent-encoded to comply with [[RFC3986]].
+This requires users to pre-encode the character(s) in some other way in parameter names and values to distinguish them from the delimiter usage when using one of these styles.
+
+The space character is always illegal and encoded in some way by all implementations of all versions of the relevant standards.
+While one could use the `form-urlencoded` convention of `+` to distinguish spaces in parameter names and values from `spaceDelimited` delimiters encoded as `%20`, the specifications define the decoding as a single pass, making it impossible to distinguish the different usages in the decoded result.
+
+Some environments use `[`, `]`, and possibly `|` unencoded in query strings without apparent difficulties, and WHATWG's generic query string rules do not require percent-encoding them.
+Code that relies on leaving these delimiters unencoded, while using regular percent-encoding for them within names and values, is not guaranteed to be interoperable across all implementations.
+
+For maximum interoperability, it is RECOMMENDED to either define and document an additional escape convention while percent-encoding the delimiters for these styles, or to avoid these styles entirely.
+The exact method of additional encoding/escaping is left to the API designer, and is expected to be performed before serialization and encoding described in this specification, and reversed after this specification's encoding and serialization steps are reversed.
+This keeps it outside of the processes governed by this specification.
+
+## Appendix F: Resolving Security Requirements in a Referenced Document
+
+This appendix shows how to retrieve an HTTP-accessible multi-document OpenAPI Description (OAD) and resolve a [Security Requirement Object](#security-requirement-object) in the referenced (non-entry) document. See [Resolving Implicit Connections](#resolving-implicit-connections) for more information.
+
+First, the [entry document](#openapi-description-structure) is where parsing begins. It defines the `MySecurity` security scheme to be JWT-based, and it defines a Path Item as a reference to a component in another document:
+
+```HTTP
+GET /api/description/openapi HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+json
+```
+
+```json
+"components": {
+ "securitySchemes": {
+ "MySecurity": {
+ "type": "http",
+ "scheme": "bearer",
+ "bearerFormat": "JWT"
+ }
+ }
+},
+"paths": {
+ "/foo": {
+ "$ref": "other#/components/pathItems/Foo"
+ }
+}
+```
+
+```HTTP
+GET /api/description/openapi HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+yaml
+```
+
+```yaml
+components:
+ securitySchemes:
+ MySecurity:
+ type: http
+ scheme: bearer
+ bearerFormat: JWT
+paths:
+ /foo:
+ $ref: 'other#/components/pathItems/Foo'
+```
+
+This entry document references another document, `other`, without using a file extension. This gives the client the flexibility to choose an acceptable format on a resource-by-resource basis, assuming both representations are available:
+
+```HTTP
+GET /api/description/other HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+json
+```
+
+```json
+"components": {
+ "securitySchemes": {
+ "MySecurity": {
+ "type": "http",
+ "scheme": "basic"
+ }
+ },
+ "pathItems": {
+ "Foo": {
+ "get": {
+ "security": [
+ "MySecurity": []
+ ]
+ }
+ }
+ }
+}
+```
+
+```HTTP
+GET /api/description/other HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+yaml
+```
+
+```yaml
+components:
+ securitySchemes:
+ MySecurity:
+ type: http
+ scheme: basic
+ pathItems:
+ Foo:
+ get:
+ security:
+ - MySecurity: []
+```
+
+In the `other` document, the referenced path item has a Security Requirement for a Security Scheme, `MySecurity`. The same Security Scheme exists in the original entry document. As outlined in [Resolving Implicit Connections](#resolving-implicit-connections), `MySecurity` is resolved with an [implementation-defined behavior](#undefined-and-implementation-defined-behavior). However, documented in that section, it is RECOMMENDED that tools resolve component names from the [entry document](#openapi-description-structure). As with all implementation-defined behavior, it is important to check tool documentation to determine which behavior is supported.
diff --git a/versions/3.1.0-editors.md b/versions/3.1.0-editors.md
new file mode 100644
index 0000000000..34421f2c62
--- /dev/null
+++ b/versions/3.1.0-editors.md
@@ -0,0 +1,11 @@
+## Active
+* Darrel Miller [@darrelmiller](https://github.com/darrelmiller)
+* Jeremy Whitlock [@whitlockjc](https://github.com/whitlockjc)
+* Marsh Gardiner [@earth2marsh](https://github.com/earth2marsh)
+* Mike Ralphson [@MikeRalphson](https://github.com/MikeRalphson)
+* Ron Ratovsky [@webron](https://github.com/webron)
+* Uri Sarid [@usarid](https://github.com/usarid)
+
+## Emeritus
+* Jason Harmon [@jharmn](https://github.com/jharmn)
+* Tony Tam [@fehguy](https://github.com/fehguy)
diff --git a/versions/3.1.0.md b/versions/3.1.0.md
index 11a7abfc25..1f0830643f 100644
--- a/versions/3.1.0.md
+++ b/versions/3.1.0.md
@@ -1,6 +1,6 @@
# OpenAPI Specification
-#### Version 3.1.0-rc1
+#### Version 3.1.0
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [BCP 14](https://tools.ietf.org/html/bcp14) [RFC2119](https://tools.ietf.org/html/rfc2119) [RFC8174](https://tools.ietf.org/html/rfc8174) when, and only when, they appear in all capitals, as shown here.
@@ -16,66 +16,69 @@ An OpenAPI definition can then be used by documentation generation tools to disp
- [Definitions](#definitions)
- - [OpenAPI Document](#oasDocument)
- - [Path Templating](#pathTemplating)
- - [Media Types](#mediaTypes)
- - [HTTP Status Codes](#httpCodes)
+ - [OpenAPI Document](#openapi-document)
+ - [Path Templating](#path-templating)
+ - [Media Types](#media-types)
+ - [HTTP Status Codes](#http-status-codes)
- [Specification](#specification)
- [Versions](#versions)
- [Format](#format)
- - [Document Structure](#documentStructure)
- - [Data Types](#dataTypes)
- - [Rich Text Formatting](#richText)
- - [Relative References In URIs](#relativeReferences)
+ - [Document Structure](#document-structure)
+ - [Data Types](#data-types)
+ - [Rich Text Formatting](#rich-text-formatting)
+ - [Relative References In URIs](#relative-references-in-uris)
+ - [Relative References In URLs](#relative-references-in-urls)
- [Schema](#schema)
- - [OpenAPI Object](#oasObject)
- - [Info Object](#infoObject)
- - [Contact Object](#contactObject)
- - [License Object](#licenseObject)
- - [Server Object](#serverObject)
- - [Server Variable Object](#serverVariableObject)
- - [Components Object](#componentsObject)
- - [Paths Object](#pathsObject)
- - [Path Item Object](#pathItemObject)
- - [Operation Object](#operationObject)
- - [External Documentation Object](#externalDocumentationObject)
- - [Parameter Object](#parameterObject)
- - [Request Body Object](#requestBodyObject)
- - [Media Type Object](#mediaTypeObject)
- - [Encoding Object](#encodingObject)
- - [Responses Object](#responsesObject)
- - [Response Object](#responseObject)
- - [Callback Object](#callbackObject)
- - [Example Object](#exampleObject)
- - [Link Object](#linkObject)
- - [Header Object](#headerObject)
- - [Tag Object](#tagObject)
- - [Reference Object](#referenceObject)
- - [Schema Object](#schemaObject)
- - [Discriminator Object](#discriminatorObject)
- - [XML Object](#xmlObject)
- - [Security Scheme Object](#securitySchemeObject)
- - [OAuth Flows Object](#oauthFlowsObject)
- - [OAuth Flow Object](#oauthFlowObject)
- - [Security Requirement Object](#securityRequirementObject)
- - [Specification Extensions](#specificationExtensions)
- - [Security Filtering](#securityFiltering)
-- [Appendix A: Revision History](#revisionHistory)
+ - [OpenAPI Object](#openapi-object)
+ - [Info Object](#info-object)
+ - [Contact Object](#contact-object)
+ - [License Object](#license-object)
+ - [Server Object](#server-object)
+ - [Server Variable Object](#server-variable-object)
+ - [Components Object](#components-object)
+ - [Paths Object](#paths-object)
+ - [Path Item Object](#path-item-object)
+ - [Operation Object](#operation-object)
+ - [External Documentation Object](#external-documentation-object)
+ - [Parameter Object](#parameter-object)
+ - [Request Body Object](#request-body-object)
+ - [Media Type Object](#media-type-object)
+ - [Encoding Object](#encoding-object)
+ - [Responses Object](#responses-object)
+ - [Response Object](#response-object)
+ - [Callback Object](#callback-object)
+ - [Example Object](#example-object)
+ - [Link Object](#link-object)
+ - [Header Object](#header-object)
+ - [Tag Object](#tag-object)
+ - [Reference Object](#reference-object)
+ - [Schema Object](#schema-object)
+ - [Discriminator Object](#discriminator-object)
+ - [XML Object](#xml-object)
+ - [Security Scheme Object](#security-scheme-object)
+ - [OAuth Flows Object](#oauth-flows-object)
+ - [OAuth Flow Object](#oauth-flow-object)
+ - [Security Requirement Object](#security-requirement-object)
+ - [Specification Extensions](#specification-extensions)
+ - [Security Filtering](#security-filtering)
+- [Appendix A: Revision History](#appendix-a-revision-history)
## Definitions
-##### OpenAPI Document
-A self-contained or composite resource which defines or describes an API or elements of an API. The OpenAPI document MUST contain at least one [paths](#pathsObject) field, a [components](#oasComponents) field or a [webhooks](#oasWebhooks) field. An OpenAPI document uses and conforms to the OpenAPI Specification.
+##### OpenAPI Document
+A self-contained or composite resource which defines or describes an API or elements of an API. The OpenAPI document MUST contain at least one [paths](#paths-object) field, a [components](#oasComponents) field or a [webhooks](#oasWebhooks) field. An OpenAPI document uses and conforms to the OpenAPI Specification.
-##### Path Templating
+##### Path Templating
Path templating refers to the usage of template expressions, delimited by curly braces ({}), to mark a section of a URL path as replaceable using path parameters.
Each template expression in the path MUST correspond to a path parameter that is included in the [Path Item](#path-item-object) itself and/or in each of the Path Item's [Operations](#operation-object). An exception is if the path item is empty, for example due to ACL constraints, matching path parameters are not required.
-##### Media Types
+The value for these path parameters MUST NOT contain any unescaped "generic syntax" characters described by [RFC3986](https://tools.ietf.org/html/rfc3986#section-3): forward slashes (`/`), question marks (`?`), or hashes (`#`).
+
+##### Media Types
Media type definitions are spread across several resources.
The media type definitions SHOULD be in compliance with [RFC6838](https://tools.ietf.org/html/rfc6838).
@@ -92,8 +95,8 @@ Some examples of possible media type definitions:
application/vnd.github.v3.diff
application/vnd.github.v3.patch
```
-##### HTTP Status Codes
-The HTTP Status Codes are used to indicate the status of the executed operation.
+##### HTTP Status Codes
+The HTTP Status Codes are used to indicate the status of the executed operation.
The available status codes are defined by [RFC7231](https://tools.ietf.org/html/rfc7231#section-6) and registered status codes are listed in the [IANA Status Code Registry](https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml).
## Specification
@@ -122,7 +125,7 @@ This includes all fields that are used as keys in a map, except where explicitly
The schema exposes two types of fields: Fixed fields, which have a declared name, and Patterned fields, which declare a regex pattern for the field name.
-Patterned fields MUST have unique names within the containing object.
+Patterned fields MUST have unique names within the containing object.
In order to preserve the ability to round-trip between YAML and JSON formats, YAML version [1.2](https://yaml.org/spec/1.2/spec.html) is RECOMMENDED along with some additional constraints:
@@ -131,24 +134,24 @@ In order to preserve the ability to round-trip between YAML and JSON formats, YA
**Note:** While APIs may be defined by OpenAPI documents in either YAML or JSON format, the API request and response bodies and other content are not required to be JSON or YAML.
-### Document Structure
+### Document Structure
-An OpenAPI document MAY be made up of a single document or be divided into multiple, connected parts at the discretion of the user. In the latter case, `$ref` fields MUST be used in the specification to reference those parts as follows from the [JSON Schema](https://json-schema.org) definitions.
+An OpenAPI document MAY be made up of a single document or be divided into multiple, connected parts at the discretion of the author. In the latter case, [`Reference Objects`](#reference-object) and [`Schema Object`](#schema-object) `$ref` keywords are used.
It is RECOMMENDED that the root OpenAPI document be named: `openapi.json` or `openapi.yaml`.
-### Data Types
+### Data Types
-Data types in the OAS are based on the types supported by the [JSON Schema Specification Draft 2019-09](http://json-schema.org/draft/2019-09/json-schema-core.html#rfc.section.4.2).
-Note that `integer` as a type is also supported and is defined as a JSON number without a fraction or exponent part.
-Models are defined using the [Schema Object](#schemaObject), which is a superset of JSON Schema Specification Draft 2019-09.
+Data types in the OAS are based on the types supported by the [JSON Schema Specification Draft 2020-12](https://tools.ietf.org/html/draft-bhutton-json-schema-00#section-4.2.1).
+Note that `integer` as a type is also supported and is defined as a JSON number without a fraction or exponent part.
+Models are defined using the [Schema Object](#schema-object), which is a superset of JSON Schema Specification Draft 2020-12.
-As defined by JSON Schema, data types can have an optional modifier property: `format`.
+As defined by the [JSON Schema Validation vocabulary](https://tools.ietf.org/html/draft-bhutton-json-schema-validation-00#section-7.3), data types can have an optional modifier property: `format`.
OAS defines additional formats to provide fine detail for primitive data types.
The formats defined by the OAS are:
-[`type`](#dataTypes) | [`format`](#dataTypeFormat) | Comments
+[`type`](#data-types) | [`format`](#dataTypeFormat) | Comments
------ | -------- | --------
`integer` | `int32` | signed 32 bits
`integer` | `int64` | signed 64 bits (a.k.a long)
@@ -156,43 +159,52 @@ The formats defined by the OAS are:
`number` | `double` | |
`string` | `password` | A hint to UIs to obscure input.
-### Rich Text Formatting
+### Rich Text Formatting
Throughout the specification `description` fields are noted as supporting CommonMark markdown formatting.
-Where OpenAPI tooling renders rich text it MUST support, at a minimum, markdown syntax as described by [CommonMark 0.27](https://spec.commonmark.org/0.27/). Tooling MAY choose to ignore some CommonMark features to address security concerns.
+Where OpenAPI tooling renders rich text it MUST support, at a minimum, markdown syntax as described by [CommonMark 0.27](https://spec.commonmark.org/0.27/). Tooling MAY choose to ignore some CommonMark features to address security concerns.
-### Relative References in URIs
+### Relative References in URIs
Unless specified otherwise, all properties that are URIs MAY be relative references as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-4.2).
-Relative references are resolved using the URLs defined in the [`Server Object`](#serverObject) as a Base URI. This includes relative references in [`Reference Objects`](#referenceObject), outside of any [`Schema Object`](#schemaObject).
-Relative references in [`Schema Objects`](#schemaObject), including any that appear as `$id` values, use the nearest parent `$id` as a Base URI, as described by [JSON Schema Specification Draft 2019-09](https://json-schema.org/draft/2019-09/json-schema-core.html). If no parent schema contains an `$id`, then the Base URI is determined as in the previous paragraph.
+Relative references, including those in [`Reference Objects`](#reference-object), [`PathItem Object`](#path-item-object) `$ref` fields, [`Link Object`](#link-object) `operationRef` fields and [`Example Object`](#example-object) `externalValue` fields, are resolved using the referring document as the Base URI according to [RFC3986](https://tools.ietf.org/html/rfc3986#section-5.2).
+
+If a URI contains a fragment identifier, then the fragment should be resolved per the fragment resolution mechanism of the referenced document. If the representation of the referenced document is JSON or YAML, then the fragment identifier SHOULD be interpreted as a JSON-Pointer as per [RFC6901](https://tools.ietf.org/html/rfc6901).
+
+Relative references in [`Schema Objects`](#schema-object), including any that appear as `$id` values, use the nearest parent `$id` as a Base URI, as described by [JSON Schema Specification Draft 2020-12](https://tools.ietf.org/html/draft-bhutton-json-schema-00#section-8.2). If no parent schema contains an `$id`, then the Base URI MUST be determined according to [RFC3986](https://tools.ietf.org/html/rfc3986#section-5.1).
+
+### Relative References in URLs
+
+Unless specified otherwise, all properties that are URLs MAY be relative references as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-4.2).
+Unless specified otherwise, relative references are resolved using the URLs defined in the [`Server Object`](#server-object) as a Base URL. Note that these themselves MAY be relative to the referring document.
### Schema
In the following description, if a field is not explicitly **REQUIRED** or described with a MUST or SHALL, it can be considered OPTIONAL.
-#### OpenAPI Object
+#### OpenAPI Object
-This is the root object of the [OpenAPI document](#oasDocument).
+This is the root object of the [OpenAPI document](#openapi-document).
##### Fixed Fields
Field Name | Type | Description
---|:---:|---
openapi | `string` | **REQUIRED**. This string MUST be the [version number](#versions) of the OpenAPI Specification that the OpenAPI document uses. The `openapi` field SHOULD be used by tooling to interpret the OpenAPI document. This is *not* related to the API [`info.version`](#infoVersion) string.
-info | [Info Object](#infoObject) | **REQUIRED**. Provides metadata about the API. The metadata MAY be used by tooling as required.
-servers | [[Server Object](#serverObject)] | An array of Server Objects, which provide connectivity information to a target server. If the `servers` property is not provided, or is an empty array, the default value would be a [Server Object](#serverObject) with a [url](#serverUrl) value of `/`.
-paths | [Paths Object](#pathsObject) | The available paths and operations for the API.
-webhooks | Map[`string`, [Path Item Object](#pathItemObject) \| [Reference Object](#referenceObject)] ] | The incoming webhooks that MAY be received as part of this API and that the API consumer MAY choose to implement. Closely related to the `callbacks` feature, this section describes requests initiated other than by an API call, for example by an out of band registration. The key name is a unique string to refer to each webhook, while the (optionally referenced) Path Item Object describes a request that may be initiated by the API provider and the expected responses. An [example](../examples/v3.1/webhook-example.yaml) is available.
-components | [Components Object](#componentsObject) | An element to hold various schemas for the document.
-security | [[Security Requirement Object](#securityRequirementObject)] | A declaration of which security mechanisms can be used across the API. The list of values includes alternative security requirement objects that can be used. Only one of the security requirement objects need to be satisfied to authorize a request. Individual operations can override this definition. To make security optional, an empty security requirement (`{}`) can be included in the array.
-tags | [[Tag Object](#tagObject)] | A list of tags used by the document with additional metadata. The order of the tags can be used to reflect on their order by the parsing tools. Not all tags that are used by the [Operation Object](#operationObject) must be declared. The tags that are not declared MAY be organized randomly or based on the tools' logic. Each tag name in the list MUST be unique.
-externalDocs | [External Documentation Object](#externalDocumentationObject) | Additional external documentation.
+info | [Info Object](#info-object) | **REQUIRED**. Provides metadata about the API. The metadata MAY be used by tooling as required.
+ jsonSchemaDialect | `string` | The default value for the `$schema` keyword within [Schema Objects](#schema-object) contained within this OAS document. This MUST be in the form of a URI.
+servers | [[Server Object](#server-object)] | An array of Server Objects, which provide connectivity information to a target server. If the `servers` property is not provided, or is an empty array, the default value would be a [Server Object](#server-object) with a [url](#serverUrl) value of `/`.
+paths | [Paths Object](#paths-object) | The available paths and operations for the API.
+webhooks | Map[`string`, [Path Item Object](#path-item-object) \| [Reference Object](#reference-object)] ] | The incoming webhooks that MAY be received as part of this API and that the API consumer MAY choose to implement. Closely related to the `callbacks` feature, this section describes requests initiated other than by an API call, for example by an out of band registration. The key name is a unique string to refer to each webhook, while the (optionally referenced) Path Item Object describes a request that may be initiated by the API provider and the expected responses. An [example](../examples/v3.1/webhook-example.yaml) is available.
+components | [Components Object](#components-object) | An element to hold various schemas for the document.
+security | [[Security Requirement Object](#security-requirement-object)] | A declaration of which security mechanisms can be used across the API. The list of values includes alternative security requirement objects that can be used. Only one of the security requirement objects need to be satisfied to authorize a request. Individual operations can override this definition. To make security optional, an empty security requirement (`{}`) can be included in the array.
+tags | [[Tag Object](#tag-object)] | A list of tags used by the document with additional metadata. The order of the tags can be used to reflect on their order by the parsing tools. Not all tags that are used by the [Operation Object](#operation-object) must be declared. The tags that are not declared MAY be organized randomly or based on the tools' logic. Each tag name in the list MUST be unique.
+externalDocs | [External Documentation Object](#external-documentation-object) | Additional external documentation.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
-#### Info Object
+#### Info Object
The object provides metadata about the API.
The metadata MAY be used by the clients if needed, and MAY be presented in editing or documentation generation tools for convenience.
@@ -203,14 +215,14 @@ Field Name | Type | Description
---|:---:|---
title | `string` | **REQUIRED**. The title of the API.
summary | `string` | A short summary of the API.
-description | `string` | A short description of the API. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-termsOfService | `string` | A URL to the Terms of Service for the API. MUST be in the format of a URL.
-contact | [Contact Object](#contactObject) | The contact information for the exposed API.
-license | [License Object](#licenseObject) | The license information for the exposed API.
+description | `string` | A description of the API. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
+termsOfService | `string` | A URL to the Terms of Service for the API. This MUST be in the form of a URL.
+contact | [Contact Object](#contact-object) | The contact information for the exposed API.
+license | [License Object](#license-object) | The license information for the exposed API.
version | `string` | **REQUIRED**. The version of the OpenAPI document (which is distinct from the [OpenAPI Specification version](#oasVersion) or the API implementation version).
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Info Object Example
@@ -248,7 +260,7 @@ license:
version: 1.0.1
```
-#### Contact Object
+#### Contact Object
Contact information for the exposed API.
@@ -257,10 +269,10 @@ Contact information for the exposed API.
Field Name | Type | Description
---|:---:|---
name | `string` | The identifying name of the contact person/organization.
-url | `string` | The URL pointing to the contact information. MUST be in the format of a URL.
-email | `string` | The email address of the contact person/organization. MUST be in the format of an email address.
+url | `string` | The URL pointing to the contact information. This MUST be in the form of a URL.
+email | `string` | The email address of the contact person/organization. This MUST be in the form of an email address.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Contact Object Example
@@ -278,7 +290,7 @@ url: https://www.example.com/support
email: support@example.com
```
-#### License Object
+#### License Object
License information for the exposed API.
@@ -287,10 +299,10 @@ License information for the exposed API.
Field Name | Type | Description
---|:---:|---
name | `string` | **REQUIRED**. The license name used for the API.
-identifier | `string` | An [SPDX](https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60) license expression for the API. The `identifier` field is mutually exclusive of the `url` field.
-url | `string` | A URL to the license used for the API. MUST be in the format of a URL. The `url` field is mutually exclusive of the `identifier` field.
+identifier | `string` | An [SPDX](https://spdx.org/licenses/) license expression for the API. The `identifier` field is mutually exclusive of the `url` field.
+url | `string` | A URL to the license used for the API. This MUST be in the form of a URL. The `url` field is mutually exclusive of the `identifier` field.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### License Object Example
@@ -306,7 +318,7 @@ name: Apache 2.0
identifier: Apache-2.0
```
-#### Server Object
+#### Server Object
An object representing a Server.
@@ -316,9 +328,9 @@ Field Name | Type | Description
---|:---:|---
url | `string` | **REQUIRED**. A URL to the target host. This URL supports Server Variables and MAY be relative, to indicate that the host location is relative to the location where the OpenAPI document is being served. Variable substitutions will be made when a variable is named in `{`brackets`}`.
description | `string` | An optional string describing the host designated by the URL. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-variables | Map[`string`, [Server Variable Object](#serverVariableObject)] | A map between a variable name and its value. The value is used for substitution in the server's URL template.
+variables | Map[`string`, [Server Variable Object](#server-variable-object)] | A map between a variable name and its value. The value is used for substitution in the server's URL template.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Server Object Example
@@ -416,7 +428,7 @@ servers:
```
-#### Server Variable Object
+#### Server Variable Object
An object representing a Server Variable for server URL template substitution.
@@ -425,12 +437,12 @@ An object representing a Server Variable for server URL template substitution.
Field Name | Type | Description
---|:---:|---
enum | [`string`] | An enumeration of string values to be used if the substitution options are from a limited set. The array MUST NOT be empty.
-default | `string` | **REQUIRED**. The default value to use for substitution, which SHALL be sent if an alternate value is _not_ supplied. Note this behavior is different than the [Schema Object's](#schemaObject) treatment of default values, because in those cases parameter values are optional. If the [`enum`](#serverVariableEnum) is defined, the value MUST exist in the enum's values.
+default | `string` | **REQUIRED**. The default value to use for substitution, which SHALL be sent if an alternate value is _not_ supplied. Note this behavior is different than the [Schema Object's](#schema-object) treatment of default values, because in those cases parameter values are optional. If the [`enum`](#serverVariableEnum) is defined, the value MUST exist in the enum's values.
description | `string` | An optional description for the server variable. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
-#### Components Object
+#### Components Object
Holds a set of reusable objects for different aspects of the OAS.
All objects defined within the components object will have no effect on the API unless they are explicitly referenced from properties outside the components object.
@@ -440,19 +452,19 @@ All objects defined within the components object will have no effect on the API
Field Name | Type | Description
---|:---|---
- schemas | Map[`string`, [Schema Object](#schemaObject)] | An object to hold reusable [Schema Objects](#schemaObject).
- responses | Map[`string`, [Response Object](#responseObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Response Objects](#responseObject).
- parameters | Map[`string`, [Parameter Object](#parameterObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Parameter Objects](#parameterObject).
- examples | Map[`string`, [Example Object](#exampleObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Example Objects](#exampleObject).
- requestBodies | Map[`string`, [Request Body Object](#requestBodyObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Request Body Objects](#requestBodyObject).
- headers | Map[`string`, [Header Object](#headerObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Header Objects](#headerObject).
- securitySchemes| Map[`string`, [Security Scheme Object](#securitySchemeObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Security Scheme Objects](#securitySchemeObject).
- links | Map[`string`, [Link Object](#linkObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Link Objects](#linkObject).
- callbacks | Map[`string`, [Callback Object](#callbackObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Callback Objects](#callbackObject).
- pathItems | Map[`string`, [Path Item Object](#pathItemObject) \| [Reference Object](#referenceObject)] | An object to hold reusable [Path Item Object](#pathItemObject).
+ schemas | Map[`string`, [Schema Object](#schema-object)] | An object to hold reusable [Schema Objects](#schema-object).
+ responses | Map[`string`, [Response Object](#response-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Response Objects](#response-object).
+ parameters | Map[`string`, [Parameter Object](#parameter-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Parameter Objects](#parameter-object).
+ examples | Map[`string`, [Example Object](#example-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Example Objects](#example-object).
+ requestBodies | Map[`string`, [Request Body Object](#request-body-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Request Body Objects](#request-body-object).
+ headers | Map[`string`, [Header Object](#header-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Header Objects](#header-object).
+ securitySchemes| Map[`string`, [Security Scheme Object](#security-scheme-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Security Scheme Objects](#security-scheme-object).
+ links | Map[`string`, [Link Object](#link-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Link Objects](#link-object).
+ callbacks | Map[`string`, [Callback Object](#callback-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Callback Objects](#callback-object).
+ pathItems | Map[`string`, [Path Item Object](#path-item-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Path Item Object](#path-item-object).
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
All the fixed fields declared above are objects that MUST use keys that match the regular expression: `^[a-zA-Z0-9\.\-_]+$`.
@@ -632,7 +644,7 @@ components:
in: header
petstore_auth:
type: oauth2
- flows:
+ flows:
implicit:
authorizationUrl: https://example.org/api/oauth/dialog
scopes:
@@ -640,19 +652,18 @@ components:
read:pets: read your pets
```
-
-#### Paths Object
+#### Paths Object
Holds the relative paths to the individual endpoints and their operations.
-The path is appended to the URL from the [`Server Object`](#serverObject) in order to construct the full URL. The Paths MAY be empty, due to [Access Control List (ACL) constraints](#securityFiltering).
+The path is appended to the URL from the [`Server Object`](#server-object) in order to construct the full URL. The Paths MAY be empty, due to [Access Control List (ACL) constraints](#security-filtering).
##### Patterned Fields
Field Pattern | Type | Description
---|:---:|---
-/{path} | [Path Item Object](#pathItemObject) | A relative path to an individual endpoint. The field name MUST begin with a forward slash (`/`). The path is **appended** (no relative URL resolution) to the expanded URL from the [`Server Object`](#serverObject)'s `url` field in order to construct the full URL. [Path templating](#pathTemplating) is allowed. When matching URLs, concrete (non-templated) paths would be matched before their templated counterparts. Templated paths with the same hierarchy but different templated names MUST NOT exist as they are identical. In case of ambiguous matching, it's up to the tooling to decide which one to use.
+/{path} | [Path Item Object](#path-item-object) | A relative path to an individual endpoint. The field name MUST begin with a forward slash (`/`). The path is **appended** (no relative URL resolution) to the expanded URL from the [`Server Object`](#server-object)'s `url` field in order to construct the full URL. [Path templating](#path-templating) is allowed. When matching URLs, concrete (non-templated) paths would be matched before their templated counterparts. Templated paths with the same hierarchy but different templated names MUST NOT exist as they are identical. In case of ambiguous matching, it's up to the tooling to decide which one to use.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Path Templating Matching
@@ -685,7 +696,7 @@ The following may lead to ambiguous resolution:
"get": {
"description": "Returns all pets from the system that the user has access to",
"responses": {
- "200": {
+ "200": {
"description": "A list of pets.",
"content": {
"application/json": {
@@ -719,32 +730,32 @@ The following may lead to ambiguous resolution:
$ref: '#/components/schemas/pet'
```
-#### Path Item Object
+#### Path Item Object
Describes the operations available on a single path.
-A Path Item MAY be empty, due to [ACL constraints](#securityFiltering).
+A Path Item MAY be empty, due to [ACL constraints](#security-filtering).
The path itself is still exposed to the documentation viewer but they will not know which operations and parameters are available.
##### Fixed Fields
Field Name | Type | Description
---|:---:|---
-$ref | `string` | Allows for an external definition of this path item. The referenced structure MUST be in the format of a [Path Item Object](#pathItemObject). In case a Path Item Object field appears both in the defined object and the referenced object, the behavior is undefined.
+$ref | `string` | Allows for a referenced definition of this path item. The referenced structure MUST be in the form of a [Path Item Object](#path-item-object). In case a Path Item Object field appears both in the defined object and the referenced object, the behavior is undefined. See the rules for resolving [Relative References](#relative-references-in-uris).
summary| `string` | An optional, string summary, intended to apply to all operations in this path.
description | `string` | An optional, string description, intended to apply to all operations in this path. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-get | [Operation Object](#operationObject) | A definition of a GET operation on this path.
-put | [Operation Object](#operationObject) | A definition of a PUT operation on this path.
-post | [Operation Object](#operationObject) | A definition of a POST operation on this path.
-delete | [Operation Object](#operationObject) | A definition of a DELETE operation on this path.
-options | [Operation Object](#operationObject) | A definition of a OPTIONS operation on this path.
-head | [Operation Object](#operationObject) | A definition of a HEAD operation on this path.
-patch | [Operation Object](#operationObject) | A definition of a PATCH operation on this path.
-trace | [Operation Object](#operationObject) | A definition of a TRACE operation on this path.
-servers | [[Server Object](#serverObject)] | An alternative `server` array to service all operations in this path.
-parameters | [[Parameter Object](#parameterObject) \| [Reference Object](#referenceObject)] | A list of parameters that are applicable for all the operations described under this path. These parameters can be overridden at the operation level, but cannot be removed there. The list MUST NOT include duplicated parameters. A unique parameter is defined by a combination of a [name](#parameterName) and [location](#parameterIn). The list can use the [Reference Object](#referenceObject) to link to parameters that are defined at the [OpenAPI Object's components/parameters](#componentsParameters).
+get | [Operation Object](#operation-object) | A definition of a GET operation on this path.
+put | [Operation Object](#operation-object) | A definition of a PUT operation on this path.
+post | [Operation Object](#operation-object) | A definition of a POST operation on this path.
+delete | [Operation Object](#operation-object) | A definition of a DELETE operation on this path.
+options | [Operation Object](#operation-object) | A definition of a OPTIONS operation on this path.
+head | [Operation Object](#operation-object) | A definition of a HEAD operation on this path.
+patch | [Operation Object](#operation-object) | A definition of a PATCH operation on this path.
+trace | [Operation Object](#operation-object) | A definition of a TRACE operation on this path.
+servers | [[Server Object](#server-object)] | An alternative `server` array to service all operations in this path.
+parameters | [[Parameter Object](#parameter-object) \| [Reference Object](#reference-object)] | A list of parameters that are applicable for all the operations described under this path. These parameters can be overridden at the operation level, but cannot be removed there. The list MUST NOT include duplicated parameters. A unique parameter is defined by a combination of a [name](#parameterName) and [location](#parameterIn). The list can use the [Reference Object](#reference-object) to link to parameters that are defined at the [OpenAPI Object's components/parameters](#componentsParameters).
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Path Item Object Example
@@ -826,11 +837,11 @@ parameters:
schema:
type: array
items:
- type: string
+ type: string
style: simple
```
-#### Operation Object
+#### Operation Object
Describes a single API operation on a path.
@@ -841,17 +852,17 @@ Field Name | Type | Description
tags | [`string`] | A list of tags for API documentation control. Tags can be used for logical grouping of operations by resources or any other qualifier.
summary | `string` | A short summary of what the operation does.
description | `string` | A verbose explanation of the operation behavior. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-externalDocs | [External Documentation Object](#externalDocumentationObject) | Additional external documentation for this operation.
+externalDocs | [External Documentation Object](#external-documentation-object) | Additional external documentation for this operation.
operationId | `string` | Unique string used to identify the operation. The id MUST be unique among all operations described in the API. The operationId value is **case-sensitive**. Tools and libraries MAY use the operationId to uniquely identify an operation, therefore, it is RECOMMENDED to follow common programming naming conventions.
-parameters | [[Parameter Object](#parameterObject) \| [Reference Object](#referenceObject)] | A list of parameters that are applicable for this operation. If a parameter is already defined at the [Path Item](#pathItemParameters), the new definition will override it but can never remove it. The list MUST NOT include duplicated parameters. A unique parameter is defined by a combination of a [name](#parameterName) and [location](#parameterIn). The list can use the [Reference Object](#referenceObject) to link to parameters that are defined at the [OpenAPI Object's components/parameters](#componentsParameters).
-requestBody | [Request Body Object](#requestBodyObject) \| [Reference Object](#referenceObject) | The request body applicable for this operation. The `requestBody` is fully supported in HTTP methods where the HTTP 1.1 specification [RFC7231](https://tools.ietf.org/html/rfc7231#section-4.3.1) has explicitly defined semantics for request bodies. In other cases where the HTTP spec is vague (such as [GET](https://tools.ietf.org/html/rfc7231#section-4.3.1), [HEAD](https://tools.ietf.org/html/rfc7231#section-4.3.2) and [DELETE](https://tools.ietf.org/html/rfc7231#section-4.3.5)), `requestBody` is permitted but does not have well-defined semantics and SHOULD be avoided if possible.
-responses | [Responses Object](#responsesObject) | The list of possible responses as they are returned from executing this operation.
-callbacks | Map[`string`, [Callback Object](#callbackObject) \| [Reference Object](#referenceObject)] | A map of possible out-of band callbacks related to the parent operation. The key is a unique identifier for the Callback Object. Each value in the map is a [Callback Object](#callbackObject) that describes a request that may be initiated by the API provider and the expected responses.
+parameters | [[Parameter Object](#parameter-object) \| [Reference Object](#reference-object)] | A list of parameters that are applicable for this operation. If a parameter is already defined at the [Path Item](#pathItemParameters), the new definition will override it but can never remove it. The list MUST NOT include duplicated parameters. A unique parameter is defined by a combination of a [name](#parameterName) and [location](#parameterIn). The list can use the [Reference Object](#reference-object) to link to parameters that are defined at the [OpenAPI Object's components/parameters](#componentsParameters).
+requestBody | [Request Body Object](#request-body-object) \| [Reference Object](#reference-object) | The request body applicable for this operation. The `requestBody` is fully supported in HTTP methods where the HTTP 1.1 specification [RFC7231](https://tools.ietf.org/html/rfc7231#section-4.3.1) has explicitly defined semantics for request bodies. In other cases where the HTTP spec is vague (such as [GET](https://tools.ietf.org/html/rfc7231#section-4.3.1), [HEAD](https://tools.ietf.org/html/rfc7231#section-4.3.2) and [DELETE](https://tools.ietf.org/html/rfc7231#section-4.3.5)), `requestBody` is permitted but does not have well-defined semantics and SHOULD be avoided if possible.
+responses | [Responses Object](#responses-object) | The list of possible responses as they are returned from executing this operation.
+callbacks | Map[`string`, [Callback Object](#callback-object) \| [Reference Object](#reference-object)] | A map of possible out-of band callbacks related to the parent operation. The key is a unique identifier for the Callback Object. Each value in the map is a [Callback Object](#callback-object) that describes a request that may be initiated by the API provider and the expected responses.
deprecated | `boolean` | Declares this operation to be deprecated. Consumers SHOULD refrain from usage of the declared operation. Default value is `false`.
-security | [[Security Requirement Object](#securityRequirementObject)] | A declaration of which security mechanisms can be used for this operation. The list of values includes alternative security requirement objects that can be used. Only one of the security requirement objects need to be satisfied to authorize a request. To make security optional, an empty security requirement (`{}`) can be included in the array. This definition overrides any declared top-level [`security`](#oasSecurity). To remove a top-level security declaration, an empty array can be used.
-servers | [[Server Object](#serverObject)] | An alternative `server` array to service this operation. If an alternative `server` object is specified at the Path Item Object or Root level, it will be overridden by this value.
+security | [[Security Requirement Object](#security-requirement-object)] | A declaration of which security mechanisms can be used for this operation. The list of values includes alternative security requirement objects that can be used. Only one of the security requirement objects need to be satisfied to authorize a request. To make security optional, an empty security requirement (`{}`) can be included in the array. This definition overrides any declared top-level [`security`](#oasSecurity). To remove a top-level security declaration, an empty array can be used.
+servers | [[Server Object](#server-object)] | An alternative `server` array to service this operation. If an alternative `server` object is specified at the Path Item Object or Root level, it will be overridden by this value.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### Operation Object Example
@@ -879,7 +890,7 @@ This object MAY be extended with [Specification Extensions](#specificationExtens
"schema": {
"type": "object",
"properties": {
- "name": {
+ "name": {
"description": "Updated name of the pet",
"type": "string"
},
@@ -888,7 +899,7 @@ This object MAY be extended with [Specification Extensions](#specificationExtens
"type": "string"
}
},
- "required": ["status"]
+ "required": ["status"]
}
}
}
@@ -936,8 +947,9 @@ requestBody:
content:
'application/x-www-form-urlencoded':
schema:
+ type: object
properties:
- name:
+ name:
description: Updated name of the pet
type: string
status:
@@ -948,12 +960,12 @@ requestBody:
responses:
'200':
description: Pet updated.
- content:
+ content:
'application/json': {}
'application/xml': {}
'405':
description: Method Not Allowed
- content:
+ content:
'application/json': {}
'application/xml': {}
security:
@@ -963,7 +975,7 @@ security:
```
-#### External Documentation Object
+#### External Documentation Object
Allows referencing an external resource for extended documentation.
@@ -971,10 +983,10 @@ Allows referencing an external resource for extended documentation.
Field Name | Type | Description
---|:---:|---
-description | `string` | A short description of the target documentation. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
-url | `string` | **REQUIRED**. The URL for the target documentation. Value MUST be in the format of a URL.
+description | `string` | A description of the target documentation. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation.
+url | `string` | **REQUIRED**. The URL for the target documentation. This MUST be in the form of a URL.
-This object MAY be extended with [Specification Extensions](#specificationExtensions).
+This object MAY be extended with [Specification Extensions](#specification-extensions).
##### External Documentation Object Example
@@ -990,7 +1002,7 @@ description: Find more info here
url: https://example.com
```
-#### Parameter Object
+#### Parameter Object
Describes a single operation parameter.
@@ -998,7 +1010,7 @@ A unique parameter is defined by a combination of a [name](#parameterName) and [
##### Parameter Locations
There are four possible parameter locations specified by the `in` field:
-* path - Used together with [Path Templating](#pathTemplating), where the parameter value is actually part of the operation's URL. This does not include the host or base path of the API. For example, in `/items/{itemId}`, the path parameter is `itemId`.
+* path - Used together with [Path Templating](#path-templating), where the parameter value is actually part of the operation's URL. This does not include the host or base path of the API. For example, in `/items/{itemId}`, the path parameter is `itemId`.
* query - Parameters that are appended to the URL. For example, in `/items?id=###`, the query parameter is `id`.
* header - Custom headers that are expected as part of the request. Note that [RFC7230](https://tools.ietf.org/html/rfc7230#page-22) states header names are case insensitive.
* cookie - Used to pass a specific cookie value to the API.
@@ -1007,7 +1019,7 @@ There are four possible parameter locations specified by the `in` field:
##### Fixed Fields
Field Name | Type | Description
---|:---:|---
-name | `string` | **REQUIRED**. The name of the parameter. Parameter names are *case sensitive*. type: stringformat: binary | contentMediaType: image/png | if redundant, can be omitted, often resulting in an empty [Schema Object](#schema-object) |
+| type: stringformat: byte | type: stringcontentMediaType: image/pngcontentEncoding: base64 | note that `base64url` can be used to avoid re-encoding the base64 string to be URL-safe |
+
+### Rich Text Formatting
+
+Throughout the specification `description` fields are noted as supporting CommonMark markdown formatting.
+Where OpenAPI tooling renders rich text it MUST support, at a minimum, markdown syntax as described by [CommonMark 0.27](https://spec.commonmark.org/0.27/). Tooling MAY choose to ignore some CommonMark or extension features to address security concerns.
+
+While the framing of CommonMark 0.27 as a minimum requirement means that tooling MAY choose to implement extensions on top of it, note that any such extensions are by definition implementation-defined and will not be interoperable.
+OpenAPI Description authors SHOULD consider how text using such extensions will be rendered by tools that offer only the minimum support.
+
+### Relative References in API Description URIs
+
+URIs used as references within an OpenAPI Description, or to external documentation or other supplementary information such as a license, are resolved as _identifiers_, and described by this specification as **_URIs_**.
+As noted under [Parsing Documents](#parsing-documents), this specification inherits JSON Schema Specification Draft 2020-12's requirements for [loading documents](https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00#section-9) and associating them with their expected URIs, which might not match their current location.
+This feature is used both for working in development or test environments without having to change the URIs, and for working within restrictive network configurations or security policies.
+
+Note that some URI fields are named `url` for historical reasons, but the descriptive text for those fields uses the correct "URI" terminology.
+
+Unless specified otherwise, all fields that are URIs MAY be relative references as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-4.2).
+
+Relative references in [Schema Objects](#schema-object), including any that appear as `$id` values, use the nearest parent `$id` as a Base URI, as described by [JSON Schema Specification Draft 2020-12](https://tools.ietf.org/html/draft-bhutton-json-schema-00#section-8.2).
+
+Relative URI references in other Objects, and in Schema Objects where no parent schema contains an `$id`, MUST be resolved using the referring document's base URI, which is determined in accordance with [[RFC3986]] [Section 5.1.2 – 5.1.4](https://tools.ietf.org/html/rfc3986#section-5.1.2).
+In practice, this is usually the retrieval URI of the document, which MAY be determined based on either its current actual location or a user-supplied expected location.
+
+If a URI contains a fragment identifier, then the fragment should be resolved per the fragment resolution mechanism of the referenced document. If the representation of the referenced document is JSON or YAML, then the fragment identifier SHOULD be interpreted as a JSON-Pointer as per [RFC6901](https://tools.ietf.org/html/rfc6901).
+
+Relative references in CommonMark hyperlinks are resolved in their rendered context, which might differ from the context of the API description.
+
+### Relative References in API URLs
+
+API endpoints are by definition accessed as locations, and are described by this specification as **_URLs_**.
+
+Unless specified otherwise, all fields that are URLs MAY be relative references as defined by [RFC3986](https://tools.ietf.org/html/rfc3986#section-4.2).
+Unless specified otherwise, relative references are resolved using the URLs defined in the [Server Object](#server-object) as a Base URL. Note that these themselves MAY be relative to the referring document.
+
+### Schema
+
+This section describes the structure of the OpenAPI Description format.
+This text is the only normative description of the format.
+A JSON Schema is hosted on [spec.openapis.org](https://spec.openapis.org) for informational purposes.
+If the JSON Schema differs from this section, then this section MUST be considered authoritative.
+
+In the following description, if a field is not explicitly **REQUIRED** or described with a MUST or SHALL, it can be considered OPTIONAL.
+
+#### OpenAPI Object
+
+This is the root object of the [OpenAPI Description](#openapi-description).
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| openapi | `string` | **REQUIRED**. This string MUST be the [version number](#versions) of the OpenAPI Specification that the OpenAPI Document uses. The `openapi` field SHOULD be used by tooling to interpret the OpenAPI Document. This is _not_ related to the API [`info.version`](#info-version) string. |
+| info | [Info Object](#info-object) | **REQUIRED**. Provides metadata about the API. The metadata MAY be used by tooling as required. |
+| jsonSchemaDialect | `string` | The default value for the `$schema` keyword within [Schema Objects](#schema-object) contained within this OAS document. This MUST be in the form of a URI. |
+| servers | [[Server Object](#server-object)] | An array of Server Objects, which provide connectivity information to a target server. If the `servers` field is not provided, or is an empty array, the default value would be a [Server Object](#server-object) with a [url](#server-url) value of `/`. |
+| paths | [Paths Object](#paths-object) | The available paths and operations for the API. |
+| webhooks | Map[`string`, [Path Item Object](#path-item-object)] | The incoming webhooks that MAY be received as part of this API and that the API consumer MAY choose to implement. Closely related to the `callbacks` feature, this section describes requests initiated other than by an API call, for example by an out of band registration. The key name is a unique string to refer to each webhook, while the (optionally referenced) Path Item Object describes a request that may be initiated by the API provider and the expected responses. An [example](https://learn.openapis.org/examples/v3.1/webhook-example.html) is available. |
+| components | [Components Object](#components-object) | An element to hold various Objects for the OpenAPI Description. |
+| security | [[Security Requirement Object](#security-requirement-object)] | A declaration of which security mechanisms can be used across the API. The list of values includes alternative Security Requirement Objects that can be used. Only one of the Security Requirement Objects need to be satisfied to authorize a request. Individual operations can override this definition. The list can be incomplete, up to being empty or absent. To make security explicitly optional, an empty security requirement (`{}`) can be included in the array. |
+| tags | [[Tag Object](#tag-object)] | A list of tags used by the OpenAPI Description with additional metadata. The order of the tags can be used to reflect on their order by the parsing tools. Not all tags that are used by the [Operation Object](#operation-object) must be declared. The tags that are not declared MAY be organized randomly or based on the tools' logic. Each tag name in the list MUST be unique. |
+| externalDocs | [External Documentation Object](#external-documentation-object) | Additional external documentation. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+#### Info Object
+
+The object provides metadata about the API.
+The metadata MAY be used by the clients if needed, and MAY be presented in editing or documentation generation tools for convenience.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| title | `string` | **REQUIRED**. The title of the API. |
+| summary | `string` | A short summary of the API. |
+| description | `string` | A description of the API. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation. |
+| termsOfService | `string` | A URI for the Terms of Service for the API. This MUST be in the form of a URI. |
+| contact | [Contact Object](#contact-object) | The contact information for the exposed API. |
+| license | [License Object](#license-object) | The license information for the exposed API. |
+| version | `string` | **REQUIRED**. The version of the OpenAPI Document (which is distinct from the [OpenAPI Specification version](#oas-version) or the version of the API being described or the version of the OpenAPI Description). |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+##### Info Object Example
+
+```json
+{
+ "title": "Example Pet Store App",
+ "summary": "A pet store manager.",
+ "description": "This is an example server for a pet store.",
+ "termsOfService": "https://example.com/terms/",
+ "contact": {
+ "name": "API Support",
+ "url": "https://www.example.com/support",
+ "email": "support@example.com"
+ },
+ "license": {
+ "name": "Apache 2.0",
+ "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
+ },
+ "version": "1.0.1"
+}
+```
+
+```yaml
+title: Example Pet Store App
+summary: A pet store manager.
+description: This is an example server for a pet store.
+termsOfService: https://example.com/terms/
+contact:
+ name: API Support
+ url: https://www.example.com/support
+ email: support@example.com
+license:
+ name: Apache 2.0
+ url: https://www.apache.org/licenses/LICENSE-2.0.html
+version: 1.0.1
+```
+
+#### Contact Object
+
+Contact information for the exposed API.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| name | `string` | The identifying name of the contact person/organization. |
+| url | `string` | The URI for the contact information. This MUST be in the form of a URI. |
+| email | `string` | The email address of the contact person/organization. This MUST be in the form of an email address. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+##### Contact Object Example
+
+```json
+{
+ "name": "API Support",
+ "url": "https://www.example.com/support",
+ "email": "support@example.com"
+}
+```
+
+```yaml
+name: API Support
+url: https://www.example.com/support
+email: support@example.com
+```
+
+#### License Object
+
+License information for the exposed API.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| name | `string` | **REQUIRED**. The license name used for the API. |
+| identifier | `string` | An [SPDX](https://spdx.org/licenses/) license expression for the API. The `identifier` field is mutually exclusive of the `url` field. |
+| url | `string` | A URI for the license used for the API. This MUST be in the form of a URI. The `url` field is mutually exclusive of the `identifier` field. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+##### License Object Example
+
+```json
+{
+ "name": "Apache 2.0",
+ "identifier": "Apache-2.0"
+}
+```
+
+```yaml
+name: Apache 2.0
+identifier: Apache-2.0
+```
+
+#### Server Object
+
+An object representing a Server.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| url | `string` | **REQUIRED**. A URL to the target host. This URL supports Server Variables and MAY be relative, to indicate that the host location is relative to the location where the document containing the Server Object is being served. Variable substitutions will be made when a variable is named in `{`braces`}`. |
+| description | `string` | An optional string describing the host designated by the URL. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation. |
+| variables | Map[`string`, [Server Variable Object](#server-variable-object)] | A map between a variable name and its value. The value is used for substitution in the server's URL template. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+##### Server Object Example
+
+A single server would be described as:
+
+```json
+{
+ "url": "https://development.gigantic-server.com/v1",
+ "description": "Development server"
+}
+```
+
+```yaml
+url: https://development.gigantic-server.com/v1
+description: Development server
+```
+
+The following shows how multiple servers can be described, for example, at the OpenAPI Object's [`servers`](#oas-servers):
+
+```json
+{
+ "servers": [
+ {
+ "url": "https://development.gigantic-server.com/v1",
+ "description": "Development server"
+ },
+ {
+ "url": "https://staging.gigantic-server.com/v1",
+ "description": "Staging server"
+ },
+ {
+ "url": "https://api.gigantic-server.com/v1",
+ "description": "Production server"
+ }
+ ]
+}
+```
+
+```yaml
+servers:
+ - url: https://development.gigantic-server.com/v1
+ description: Development server
+ - url: https://staging.gigantic-server.com/v1
+ description: Staging server
+ - url: https://api.gigantic-server.com/v1
+ description: Production server
+```
+
+The following shows how variables can be used for a server configuration:
+
+```json
+{
+ "servers": [
+ {
+ "url": "https://{username}.gigantic-server.com:{port}/{basePath}",
+ "description": "The production API server",
+ "variables": {
+ "username": {
+ "default": "demo",
+ "description": "A user-specific subdomain. Use `demo` for a free sandbox environment."
+ },
+ "port": {
+ "enum": ["8443", "443"],
+ "default": "8443"
+ },
+ "basePath": {
+ "default": "v2"
+ }
+ }
+ }
+ ]
+}
+```
+
+```yaml
+servers:
+ - url: https://{username}.gigantic-server.com:{port}/{basePath}
+ description: The production API server
+ variables:
+ username:
+ # note! no enum here means it is an open value
+ default: demo
+ description: A user-specific subdomain. Use `demo` for a free sandbox environment.
+ port:
+ enum:
+ - '8443'
+ - '443'
+ default: '8443'
+ basePath:
+ # open meaning there is the opportunity to use special base paths as assigned by the provider, default is `v2`
+ default: v2
+```
+
+#### Server Variable Object
+
+An object representing a Server Variable for server URL template substitution.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| enum | [`string`] | An enumeration of string values to be used if the substitution options are from a limited set. The array MUST NOT be empty. |
+| default | `string` | **REQUIRED**. The default value to use for substitution, which SHALL be sent if an alternate value is _not_ supplied. If the [`enum`](#server-variable-enum) is defined, the value MUST exist in the enum's values. Note that this behavior is different from the [Schema Object](#schema-object)'s `default` keyword, which documents the receiver's behavior rather than inserting the value into the data. |
+| description | `string` | An optional description for the server variable. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+#### Components Object
+
+Holds a set of reusable objects for different aspects of the OAS.
+All objects defined within the Components Object will have no effect on the API unless they are explicitly referenced from outside the Components Object.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :---- | ---- |
+| schemas | Map[`string`, [Schema Object](#schema-object)] | An object to hold reusable [Schema Objects](#schema-object). |
+| responses | Map[`string`, [Response Object](#response-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Response Objects](#response-object). |
+| parameters | Map[`string`, [Parameter Object](#parameter-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Parameter Objects](#parameter-object). |
+| examples | Map[`string`, [Example Object](#example-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Example Objects](#example-object). |
+| requestBodies | Map[`string`, [Request Body Object](#request-body-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Request Body Objects](#request-body-object). |
+| headers | Map[`string`, [Header Object](#header-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Header Objects](#header-object). |
+| securitySchemes | Map[`string`, [Security Scheme Object](#security-scheme-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Security Scheme Objects](#security-scheme-object). |
+| links | Map[`string`, [Link Object](#link-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Link Objects](#link-object). |
+| callbacks | Map[`string`, [Callback Object](#callback-object) \| [Reference Object](#reference-object)] | An object to hold reusable [Callback Objects](#callback-object). |
+| pathItems | Map[`string`, [Path Item Object](#path-item-object)] | An object to hold reusable [Path Item Objects](#path-item-object). |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+All the fixed fields declared above are objects that MUST use keys that match the regular expression: `^[a-zA-Z0-9\.\-_]+$`.
+
+Field Name Examples:
+
+```text
+User
+User_1
+User_Name
+user-name
+my.org.User
+```
+
+##### Components Object Example
+
+```json
+"components": {
+ "schemas": {
+ "GeneralError": {
+ "type": "object",
+ "properties": {
+ "code": {
+ "type": "integer",
+ "format": "int32"
+ },
+ "message": {
+ "type": "string"
+ }
+ }
+ },
+ "Category": {
+ "type": "object",
+ "properties": {
+ "id": {
+ "type": "integer",
+ "format": "int64"
+ },
+ "name": {
+ "type": "string"
+ }
+ }
+ },
+ "Tag": {
+ "type": "object",
+ "properties": {
+ "id": {
+ "type": "integer",
+ "format": "int64"
+ },
+ "name": {
+ "type": "string"
+ }
+ }
+ }
+ },
+ "parameters": {
+ "skipParam": {
+ "name": "skip",
+ "in": "query",
+ "description": "number of items to skip",
+ "required": true,
+ "schema": {
+ "type": "integer",
+ "format": "int32"
+ }
+ },
+ "limitParam": {
+ "name": "limit",
+ "in": "query",
+ "description": "max records to return",
+ "required": true,
+ "schema" : {
+ "type": "integer",
+ "format": "int32"
+ }
+ }
+ },
+ "responses": {
+ "NotFound": {
+ "description": "Entity not found."
+ },
+ "IllegalInput": {
+ "description": "Illegal input for operation."
+ },
+ "GeneralError": {
+ "description": "General Error",
+ "content": {
+ "application/json": {
+ "schema": {
+ "$ref": "#/components/schemas/GeneralError"
+ }
+ }
+ }
+ }
+ },
+ "securitySchemes": {
+ "api_key": {
+ "type": "apiKey",
+ "name": "api-key",
+ "in": "header"
+ },
+ "petstore_auth": {
+ "type": "oauth2",
+ "flows": {
+ "implicit": {
+ "authorizationUrl": "https://example.org/api/oauth/dialog",
+ "scopes": {
+ "write:pets": "modify pets in your account",
+ "read:pets": "read your pets"
+ }
+ }
+ }
+ }
+ }
+}
+```
+
+```yaml
+components:
+ schemas:
+ GeneralError:
+ type: object
+ properties:
+ code:
+ type: integer
+ format: int32
+ message:
+ type: string
+ Category:
+ type: object
+ properties:
+ id:
+ type: integer
+ format: int64
+ name:
+ type: string
+ Tag:
+ type: object
+ properties:
+ id:
+ type: integer
+ format: int64
+ name:
+ type: string
+ parameters:
+ skipParam:
+ name: skip
+ in: query
+ description: number of items to skip
+ required: true
+ schema:
+ type: integer
+ format: int32
+ limitParam:
+ name: limit
+ in: query
+ description: max records to return
+ required: true
+ schema:
+ type: integer
+ format: int32
+ responses:
+ NotFound:
+ description: Entity not found.
+ IllegalInput:
+ description: Illegal input for operation.
+ GeneralError:
+ description: General Error
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/GeneralError'
+ securitySchemes:
+ api_key:
+ type: apiKey
+ name: api-key
+ in: header
+ petstore_auth:
+ type: oauth2
+ flows:
+ implicit:
+ authorizationUrl: https://example.org/api/oauth/dialog
+ scopes:
+ write:pets: modify pets in your account
+ read:pets: read your pets
+```
+
+#### Paths Object
+
+Holds the relative paths to the individual endpoints and their operations.
+The path is appended to the URL from the [Server Object](#server-object) in order to construct the full URL. The Paths Object MAY be empty, due to [Access Control List (ACL) constraints](#security-filtering).
+
+##### Patterned Fields
+
+| Field Pattern | Type | Description |
+| ---- | :----: | ---- |
+| /{path} | [Path Item Object](#path-item-object) | A relative path to an individual endpoint. The field name MUST begin with a forward slash (`/`). The path is **appended** (no relative URL resolution) to the expanded URL from the [Server Object](#server-object)'s `url` field in order to construct the full URL. [Path templating](#path-templating) is allowed. When matching URLs, concrete (non-templated) paths would be matched before their templated counterparts. Templated paths with the same hierarchy but different templated names MUST NOT exist as they are identical. In case of ambiguous matching, it's up to the tooling to decide which one to use. |
+
+This object MAY be extended with [Specification Extensions](#specification-extensions).
+
+##### Path Templating Matching
+
+Assuming the following paths, the concrete definition, `/pets/mine`, will be matched first if used:
+
+```text
+ /pets/{petId}
+ /pets/mine
+```
+
+The following paths are considered identical and invalid:
+
+```text
+ /pets/{petId}
+ /pets/{name}
+```
+
+The following may lead to ambiguous resolution:
+
+```text
+ /{entity}/me
+ /books/{id}
+```
+
+##### Paths Object Example
+
+```json
+{
+ "/pets": {
+ "get": {
+ "description": "Returns all pets from the system that the user has access to",
+ "responses": {
+ "200": {
+ "description": "A list of pets.",
+ "content": {
+ "application/json": {
+ "schema": {
+ "type": "array",
+ "items": {
+ "$ref": "#/components/schemas/pet"
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+}
+```
+
+```yaml
+/pets:
+ get:
+ description: Returns all pets from the system that the user has access to
+ responses:
+ '200':
+ description: A list of pets.
+ content:
+ application/json:
+ schema:
+ type: array
+ items:
+ $ref: '#/components/schemas/pet'
+```
+
+#### Path Item Object
+
+Describes the operations available on a single path.
+A Path Item MAY be empty, due to [ACL constraints](#security-filtering).
+The path itself is still exposed to the documentation viewer but they will not know which operations and parameters are available.
+
+##### Fixed Fields
+
+| Field Name | Type | Description |
+| ---- | :----: | ---- |
+| $ref | `string` | Allows for a referenced definition of this path item. The value MUST be in the form of a URI, and the referenced structure MUST be in the form of a [Path Item Object](#path-item-object). In case a Path Item Object field appears both in the defined object and the referenced object, the behavior is undefined. See the rules for resolving [Relative References](#relative-references-in-api-description-uris). form‑urlencoded |
+| [RFC1866](https://datatracker.ietf.org/doc/html/rfc1866#section-8.2.1) | 11/1995 | content-based serialization | [[RFC1738]] | obsoleted by [[HTML401]] [Section 17.13.4.1](https://www.w3.org/TR/html401/interact/forms.html#h-17.13.4.1), [[URL]] [Section 5](https://url.spec.whatwg.org/#urlencoded-serializing) |
+
+Style-based serialization is used in the [Parameter Object](#parameter-object) when `schema` is present, and in the [Encoding Object](#encoding-object) when at least one of `style`, `explode`, or `allowReserved` is present.
+See [Appendix C](#appendix-c-using-rfc6570-based-serialization) for more details of RFC6570's two different approaches to percent-encoding, including an example involving `+`.
+
+Content-based serialization is defined by the [Media Type Object](#media-type-object), and used with the [Parameter Object](#parameter-object) when the `content` field is present, and with the [Encoding Object](#encoding-object) based on the `contentType` field when the fields `style`, `explode`, and `allowReserved` are absent.
+Each part is encoded based on the media type (e.g. `text/plain` or `application/json`), and must then be percent-encoded for use in a `form-urlencoded` string.
+
+Note that content-based serialization for `form-data` does not expect or require percent-encoding in the data, only in per-part header values.
+
+#### Interoperability with Historical Specifications
+
+In most cases, generating query strings in strict compliance with [[RFC3986]] is sufficient to pass validation (including JSON Schema's `format: "uri"` and `format: "uri-reference"`), but some `form-urlencoded` implementations still expect the slightly more restrictive [[RFC1738]] rules to be used.
+
+Since all RFC1738-compliant URIs are compliant with RFC3986, applications needing to ensure historical interoperability SHOULD use RFC1738's rules.
+
+#### Interoperability with Web Browser Environments
+
+WHATWG is a [web browser-oriented](https://whatwg.org/faq#what-is-the-whatwg-working-on) standards group that has defined a "URL Living Standard" for parsing and serializing URLs in a browser context, including parsing and serializing `form-urlencoded` data.
+WHATWG's percent-encoding rules for query strings are different depending on whether the query string is [being treated as `form-urlencoded`](https://url.spec.whatwg.org/#application-x-www-form-urlencoded-percent-encode-set) (where it requires more percent-encoding than [[RFC1738]]) or [as part of the generic syntax](https://url.spec.whatwg.org/#query-percent-encode-set), where it allows characters that [[RFC3986]] forbids.
+
+Implementations needing maximum compatibility with web browsers SHOULD use WHATWG's `form-urlencoded` percent-encoding rules.
+However, they SHOULD NOT rely on WHATWG's less stringent generic query string rules, as the resulting URLs would fail RFC3986 validation, including JSON Schema's `format: uri` and `format: uri-reference`.
+
+### Decoding URIs and `form-urlencoded` Strings
+
+The percent-decoding algorithm does not care which characters were or were not percent-decoded, which means that URIs percent-encoded according to any specification will be decoded correctly.
+
+Similarly, all `form-urlencoded` decoding algorithms simply add `+`-for-space handling to the percent-decoding algorithm, and will work regardless of the encoding specification used.
+
+However, care must be taken to use `form-urlencoded` decoding if `+` represents a space, and to use regular percent-decoding if `+` represents itself as a literal value.
+
+### Percent-Encoding and Illegal or Reserved Delimiters
+
+The `[`, `]`, `|`, and space characters, which are used as delimiters for the `deepObject`, `pipeDelimited`, and `spaceDelimited` styles, respectively, all MUST be percent-encoded to comply with [[RFC3986]].
+This requires users to pre-encode the character(s) in some other way in parameter names and values to distinguish them from the delimiter usage when using one of these styles.
+
+The space character is always illegal and encoded in some way by all implementations of all versions of the relevant standards.
+While one could use the `form-urlencoded` convention of `+` to distinguish spaces in parameter names and values from `spaceDelimited` delimiters encoded as `%20`, the specifications define the decoding as a single pass, making it impossible to distinguish the different usages in the decoded result.
+
+Some environments use `[`, `]`, and possibly `|` unencoded in query strings without apparent difficulties, and WHATWG's generic query string rules do not require percent-encoding them.
+Code that relies on leaving these delimiters unencoded, while using regular percent-encoding for them within names and values, is not guaranteed to be interoperable across all implementations.
+
+For maximum interoperability, it is RECOMMENDED to either define and document an additional escape convention while percent-encoding the delimiters for these styles, or to avoid these styles entirely.
+The exact method of additional encoding/escaping is left to the API designer, and is expected to be performed before serialization and encoding described in this specification, and reversed after this specification's encoding and serialization steps are reversed.
+This keeps it outside of the processes governed by this specification.
+
+## Appendix F: Resolving Security Requirements in a Referenced Document
+
+This appendix shows how to retrieve an HTTP-accessible multi-document OpenAPI Description (OAD) and resolve a [Security Requirement Object](#security-requirement-object) in the referenced (non-entry) document. See [Resolving Implicit Connections](#resolving-implicit-connections) for more information.
+
+First, the [entry document](#openapi-description-structure) is where parsing begins. It defines the `MySecurity` security scheme to be JWT-based, and it defines a Path Item as a reference to a component in another document:
+
+```HTTP
+GET /api/description/openapi HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+json
+```
+
+```json
+"components": {
+ "securitySchemes": {
+ "MySecurity": {
+ "type": "http",
+ "scheme": "bearer",
+ "bearerFormat": "JWT"
+ }
+ }
+},
+"paths": {
+ "/foo": {
+ "$ref": "other#/components/pathItems/Foo"
+ }
+}
+```
+
+```HTTP
+GET /api/description/openapi HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+yaml
+```
+
+```yaml
+components:
+ securitySchemes:
+ MySecurity:
+ type: http
+ scheme: bearer
+ bearerFormat: JWT
+paths:
+ /foo:
+ $ref: 'other#/components/pathItems/Foo'
+```
+
+This entry document references another document, `other`, without using a file extension. This gives the client the flexibility to choose an acceptable format on a resource-by-resource basis, assuming both representations are available:
+
+```HTTP
+GET /api/description/other HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+json
+```
+
+```json
+"components": {
+ "securitySchemes": {
+ "MySecurity": {
+ "type": "http",
+ "scheme": "basic"
+ }
+ },
+ "pathItems": {
+ "Foo": {
+ "get": {
+ "security": [
+ "MySecurity": []
+ ]
+ }
+ }
+ }
+}
+```
+
+```HTTP
+GET /api/description/other HTTP/1.1
+Host: www.example.com
+Accept: application/openapi+yaml
+```
+
+```yaml
+components:
+ securitySchemes:
+ MySecurity:
+ type: http
+ scheme: basic
+ pathItems:
+ Foo:
+ get:
+ security:
+ - MySecurity: []
+```
+
+In the `other` document, the referenced path item has a Security Requirement for a Security Scheme, `MySecurity`. The same Security Scheme exists in the original entry document. As outlined in [Resolving Implicit Connections](#resolving-implicit-connections), `MySecurity` is resolved with an [implementation-defined behavior](#undefined-and-implementation-defined-behavior). However, documented in that section, it is RECOMMENDED that tools resolve component names from the [entry document](#openapi-description-structure). As with all implementation-defined behavior, it is important to check tool documentation to determine which behavior is supported.
diff --git a/vitest.config.mjs b/vitest.config.mjs
new file mode 100644
index 0000000000..4268028a0d
--- /dev/null
+++ b/vitest.config.mjs
@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+ test: {
+ forceRerunTriggers: ['**/scripts/**', '**/tests/**'],
+ testTimeout: 10000, // 10 seconds
+ },
+})
\ No newline at end of file