You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: versions/3.1.1.md
+28-27Lines changed: 28 additions & 27 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ This document is licensed under [The Apache License, Version 2.0](https://www.ap
10
10
11
11
The OpenAPI Specification (OAS) defines a standard, language-agnostic interface to HTTP APIs which allows both humans and computers to discover and understand the capabilities of the service without access to source code, documentation, or through network traffic inspection. When properly defined, a consumer can understand and interact with the remote service with a minimal amount of implementation logic.
12
12
13
-
An OpenAPI description can then be used by documentation generation tools to display the API, code generation tools to generate servers and clients in various programming languages, testing tools, and many other use cases.
13
+
An OpenAPI Description can then be used by documentation generation tools to display the API, code generation tools to generate servers and clients in various programming languages, testing tools, and many other use cases.
14
14
15
15
For examples of OpenAPI usage and additional documentation, please visit [[?OpenAPI-Learn]].
16
16
@@ -91,11 +91,11 @@ The OpenAPI Specification is versioned using a `major`.`minor`.`patch` versionin
91
91
92
92
Occasionally, non-backwards compatible changes may be made in `minor` versions of the OAS where impact is believed to be low relative to the benefit provided.
93
93
94
-
An OpenAPI description document compatible with OAS 3.\*.\* contains a required [`openapi`](#oas-version) field which designates the version of the OAS that it uses.
94
+
An OpenAPI Description compatible with OAS 3.\*.\* contains a required [`openapi`](#oas-version) field which designates the version of the OAS that it uses.
95
95
96
96
### Format
97
97
98
-
An OpenAPI description document that conforms to the OpenAPI Specification is itself a JSON object, which may be represented either in JSON or YAML format.
98
+
An OpenAPI Description that conforms to the OpenAPI Specification is itself a JSON object, which may be represented either in JSON or YAML format.
99
99
100
100
For example, if a field has an array value, the JSON array representation will be used:
101
101
@@ -117,18 +117,15 @@ In order to preserve the ability to round-trip between YAML and JSON formats, YA
117
117
* Tags MUST be limited to those allowed by [YAML's JSON schema ruleset](https://yaml.org/spec/1.2/spec.html#id2803231), which defines a subset of the YAML syntax and is unrelated to [[JSON-Schema-2020-12|JSON Schema]].
118
118
* Keys used in YAML maps MUST be limited to a scalar string, as defined by the [YAML Failsafe schema ruleset](https://yaml.org/spec/1.2/spec.html#id2802346).
119
119
120
-
**Note:** While APIs may be described by OpenAPI documents in either YAML or JSON format, the API request and response bodies and other content are not required to be JSON or YAML.
120
+
**Note:** While APIs may be described by OpenAPI Description in either YAML or JSON format, the API request and response bodies and other content are not required to be JSON or YAML.
121
121
122
122
### OpenAPI Description Structure
123
123
124
-
An OpenAPI Description (OAD) MAY be made up of a single document or be divided into multiple, connected parts at the discretion of the author. In the latter case, [Reference Object](#reference-object), [Path Item Object](#path-item-object) and [Schema Object](#schema-object)`$ref` keywords, as well as the [Link Object](#link-object)`operationRef` keyword, are used.
124
+
An OpenAPI Description (OAD) MAY be structured as a single JSON or YAML document or composed from elements distributed across multiple documents at the discretion of the author. In the latter case, [Reference Object](#reference-object), [Path Item Object](#path-item-object) and [Schema Object](#schema-object)`$ref` keywords, as well as the [Link Object](#link-object)`operationRef` keyword, are used.
125
125
126
-
Any document consisting entirely of an [OpenAPI Object](#openapi-object) is known as a **syntactically complete OpenAPI document**.
127
-
An OpenAPI document that does _not_ reference any other documents is known as a **self-contained OpenAPI document**.
128
-
A single-document description is therefore _both_ syntactically complete _and_ self-contained.
129
-
In a multi-document description, the document containing the OpenAPI Object where parsing begins for a specific API's description is known as that API's **entry OpenAPI document**, or simply **entry document**.
126
+
In a multi-document OAD, the document containing the OpenAPI Object where parsing begins is known as that OAD's **entry document**.
130
127
131
-
It is RECOMMENDED that the entry OpenAPI document be named: `openapi.json` or `openapi.yaml`.
128
+
It is RECOMMENDED that the entry document of an OAD be named: `openapi.json` or `openapi.yaml`.
132
129
133
130
#### Parsing Documents
134
131
@@ -157,10 +154,10 @@ It is the responsibility of an embedding format to define how to parse embedded
157
154
158
155
#### Structural Interoperability
159
156
160
-
When parsing an OAD, JSON or YAML objects are parsed into specific Objects (such as [Operation Objects](#operation-object), [Response Objects](#response-object), [Reference Objects](#reference-object), etc.) based on the parsing context. Depending on how references are arranged, a given JSON or YAML object can be parsed in multiple different contexts:
157
+
JSON or YAML objects within an OAD are interpreted as specific Objects (such as [Operation Objects](#operation-object), [Response Objects](#response-object), [Reference Objects](#reference-object), etc.) based on their context. Depending on how references are arranged, a given JSON or YAML object can be interpreted in multiple different contexts:
161
158
162
-
*As a syntactically complete OpenAPI Description document
163
-
* As the Object type implied by its parent Object within the document
159
+
*The root object of the entry document is interpreted as an OpenAPI Object
160
+
* As the Object type implied by its parent Object within the description
164
161
* As a reference target, with the Object type matching the reference source's context
165
162
166
163
If the same JSON/YAML object is parsed multiple times and the respective contexts require it to be parsed as _different_ Object types, the resulting behavior is _implementation defined_, and MAY be treated as an error if detected. An example would be referencing an empty Schema Object under `#/components/schemas` where a Path Item Object is expected, as an empty object is valid for both types. For maximum interoperability, it is RECOMMENDED that OpenAPI Description authors avoid such scenarios.
@@ -316,13 +313,13 @@ In the following description, if a field is not explicitly **REQUIRED** or descr
316
313
317
314
#### OpenAPI Object
318
315
319
-
This is the root object of the [OpenAPI document](#openapi-description).
316
+
This is the root object of the [OpenAPI Description](#openapi-description).
320
317
321
318
##### Fixed Fields
322
319
323
320
| Field Name | Type | Description |
324
321
| ---- | :----: | ---- |
325
-
| <aname="oas-version"></a>openapi |`string`|**REQUIRED**. This string MUST be the [version number](#versions) of the OpenAPI Specification that the OpenAPI document uses. The `openapi` field SHOULD be used by tooling to interpret the OpenAPI document. This is _not_ related to the API [`info.version`](#info-version) string. |
322
+
| <aname="oas-version"></a>openapi |`string`|**REQUIRED**. This string MUST be the [version number](#versions) of the OpenAPI Specification that the OpenAPI Description uses. The `openapi` field SHOULD be used by tooling to interpret the OpenAPI Description. This is _not_ related to the API [`info.version`](#info-version) string. |
326
323
| <aname="oas-info"></a>info |[Info Object](#info-object)|**REQUIRED**. Provides metadata about the API. The metadata MAY be used by tooling as required. |
327
324
| <aname="oas-json-schema-dialect"></a> jsonSchemaDialect |`string`| The default value for the `$schema` keyword within [Schema Objects](#schema-object) contained within this OAS document. This MUST be in the form of a URI. |
328
325
| <aname="oas-servers"></a>servers |[[Server Object](#server-object)]| An array of Server Objects, which provide connectivity information to a target server. If the `servers` field is not provided, or is an empty array, the default value would be a [Server Object](#server-object) with a [url](#server-url) value of `/`. |
@@ -350,7 +347,7 @@ The metadata MAY be used by the clients if needed, and MAY be presented in editi
350
347
| <aname="info-terms-of-service"></a>termsOfService |`string`| A URI for the Terms of Service for the API. This MUST be in the form of a URI. |
351
348
| <aname="info-contact"></a>contact |[Contact Object](#contact-object)| The contact information for the exposed API. |
352
349
| <aname="info-license"></a>license |[License Object](#license-object)| The license information for the exposed API. |
353
-
| <aname="info-version"></a>version |`string`|**REQUIRED**. The version of the OpenAPI document (which is distinct from the [OpenAPI Specification version](#oas-version) or the version of the API being described). |
350
+
| <aname="info-version"></a>version |`string`|**REQUIRED**. The version of the OpenAPI Description (which is distinct from the [OpenAPI Specification version](#oas-version) or the version of the API being described). |
354
351
355
352
This object MAY be extended with [Specification Extensions](#specification-extensions).
356
353
@@ -456,7 +453,7 @@ An object representing a Server.
456
453
457
454
| Field Name | Type | Description |
458
455
| ---- | :----: | ---- |
459
-
| <a name="server-url"></a>url | `string` | **REQUIRED**. A URL to the target host. This URL supports Server Variables and MAY be relative, to indicate that the host location is relative to the location where the OpenAPI document is being served. Variable substitutions will be made when a variable is named in `{`braces`}`. |
456
+
| <a name="server-url"></a>url | `string` | **REQUIRED**. A URL to the target host. This URL supports Server Variables and MAY be relative, to indicate that the host location is relative to the location where the entry document of the OpenAPI Description is being served. Variable substitutions will be made when a variable is named in `{`braces`}`. |
460
457
| <a name="server-description"></a>description | `string` | An optional string describing the host designated by the URL. [CommonMark syntax](https://spec.commonmark.org/) MAY be used for rich text representation. |
461
458
| <a name="server-variables"></a>variables | Map[`string`, [Server Variable Object](#server-variable-object)] | A map between a variable name and its value. The value is used for substitution in the server's URL template. |
462
459
@@ -2227,7 +2224,7 @@ Because examples using these fields represent the final serialized form of the d
2227
2224
The singular `example` field in the Parameter or Media Type Object is concise and convenient for simple examples, but does not offer any other advantages over using Example Objects under `examples`.
2228
2225
2229
2226
Some examples cannot be represented directly in JSON or YAML.
2230
-
For all three ways of providing examples, these can be shown as string values with any escaping necessary to make the string valid in the JSON or YAML format of the OpenAPI Description document.
2227
+
For all three ways of providing examples, these can be shown as string values with any escaping necessary to make the string valid in the JSON or YAML format of the OpenAPI Description.
2231
2228
With the Example Object, such values can alternatively be handled through the `externalValue` field.
A simple object to allow referencing other components in the OpenAPI document, internally and externally.
2667
+
A simple object to allow referencing other components in the OpenAPI Description, internally and externally.
2671
2668
2672
2669
The `$ref` string value contains a URI [RFC3986](https://tools.ietf.org/html/rfc3986), which identifies the value being referenced.
2673
2670
@@ -3322,7 +3319,7 @@ However, the exact nature of such conversions are implementation-defined.
3322
3319
3323
3320
##### Examples
3324
3321
3325
-
For these examples, assume all schemas are in the entry OpenAPI document; for handling of `discriminator` in referenced documents see [Resolving Implicit Connections](#resolving-implicit-connections).
3322
+
For these examples, assume all schemas are in a single-document OpenAPI Description; for handling of `discriminator` in referenced documents see [Resolving Implicit Connections](#resolving-implicit-connections).
3326
3323
3327
3324
In OAS 3.x, a response payload MAY be described to be exactly one of any number of types:
3328
3325
@@ -3346,7 +3343,7 @@ MyResponseType:
3346
3343
propertyName: petType
3347
3344
```
3348
3345
3349
-
The expectation now is that a property with name `petType` _MUST_ be present in the response payload, and the value will correspond to the name of a schema defined in the OpenAPI description. Thus the response payload:
3346
+
The expectation now is that a property with name `petType` _MUST_ be present in the response payload, and the value will correspond to the name of a schema defined in the OpenAPI Description. Thus the response payload:
3350
3347
3351
3348
```json
3352
3349
{
@@ -4065,7 +4062,7 @@ The extensions properties are implemented as patterned fields that are always pr
4065
4062
4066
4063
The OpenAPI Initiative maintains several [[OpenAPI-Registry|extension registries]], including registries for [individual extension keywords](https://spec.openapis.org/registry/extension/) and [extension keyword namespaces](https://spec.openapis.org/registry/namespace/).
4067
4064
4068
-
Extensions are one of the best ways to prove the viability of proposed additions to the specification.
4065
+
Extensions are one of the best ways to prove the viability of proposed additions to the specification.
4069
4066
It is therefore RECOMMENDED that implementations be designed for extensibility to support community experimentation.
4070
4067
4071
4068
Support for any one extension is OPTIONAL, and support for one extension does not imply support for others.
@@ -4084,9 +4081,9 @@ Two examples of this:
4084
4081
4085
4082
## Security Considerations
4086
4083
4087
-
### OpenAPI Document Formats
4084
+
### OpenAPI Description Formats
4088
4085
4089
-
OpenAPI description documents use JSON, YAML, and JSON Schema, and therefore share their security considerations:
4086
+
OpenAPI Descriptions use JSON, YAML, and JSON Schema, and therefore share their security considerations:
@@ -4095,15 +4092,19 @@ OpenAPI description documents use JSON, YAML, and JSON Schema, and therefore sha
4095
4092
4096
4093
### Tooling and Usage Scenarios
4097
4094
4098
-
In addition, OpenAPI description documents are processed by a wide variety of tooling for numerous different purposes, such as client code generation, documentation generation, server side routing, and API testing. OpenAPI description authors must consider the risks of the scenarios where the OpenAPI description may be used.
4095
+
In addition, OpenAPI Descriptions are processed by a wide variety of tooling for numerous different purposes, such as client code generation, documentation generation, server side routing, and API testing. OpenAPI Description authors must consider the risks of the scenarios where the OpenAPI Description may be used.
4099
4096
4100
4097
### Security Schemes
4101
4098
4102
-
An OpenAPI description describes the security schemes used to protect the resources it defines. The security schemes available offer varying degrees of protection. Factors such as the sensitivity of the data and the potential impact of a security breach should guide the selection of security schemes for the API resources. Some security schemes, such as basic auth and OAuth Implicit flow, are supported for compatibility with existing APIs. However, their inclusion in OpenAPI does not constitute an endorsement of their use, particularly for highly sensitive data or operations.
4099
+
An OpenAPI Description describes the security schemes used to protect the resources it defines. The security schemes available offer varying degrees of protection. Factors such as the sensitivity of the data and the potential impact of a security breach should guide the selection of security schemes for the API resources. Some security schemes, such as basic auth and OAuth Implicit flow, are supported for compatibility with existing APIs. However, their inclusion in OpenAPI does not constitute an endorsement of their use, particularly for highly sensitive data or operations.
4103
4100
4104
4101
### Handling External Resources
4105
4102
4106
-
OpenAPI description documents may contain references to external resources that may be dereferenced automatically by consuming tools. External resources may be hosted on different domains that may be untrusted. References in an OpenAPI document, or across OpenAPI documents within a multi-document OpenAPI description, may cause a cycle. Tooling must detect and handle cycles to prevent resource exhaustion.
4103
+
OpenAPI Descriptions may contain references to external resources that may be dereferenced automatically by consuming tools. External resources may be hosted on different domains that may be untrusted.
4104
+
4105
+
### Handling Reference Cycles
4106
+
4107
+
References in an OpenAPI Description may cause a cycle. Tooling must detect and handle cycles to prevent resource exhaustion.
0 commit comments