Skip to content

3757 docs - Embedded guide and API reference, plus the OpenAPI spec fixes behind them - #5571

Merged
ivicac merged 15 commits into
masterfrom
claude/embedded-docs-3757
Aug 25, 2026
Merged

3757 docs - Embedded guide and API reference, plus the OpenAPI spec fixes behind them#5571
ivicac merged 15 commits into
masterfrom
claude/embedded-docs-3757

Conversation

@ivicac

@ivicac ivicac commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Documentation work on the embedded guide and the API reference, plus the OpenAPI spec fixes that came out of it.

The API reference was empty

generate:openapi had produced zero pages since it was introduced. The automation-bridge entry pointed at embedded-configuration-admin-rest, a module that has never existed in this repository; the generator reads every spec up front, so that one ENOENT aborted the run and nothing was written. Fumadocs then rendered the three separators in openapi/meta.json with nothing beneath them — which is what both production and a local dev server showed.

Because the deploy pipeline runs next build without the generate step, the site kept shipping successfully with the whole section missing.

npm run lint goes from 24 errors to 0, and 21 spec groups now generate.

Server changes

One commit touches specs rather than docs, and it fixes a real defect:

  • getConnections was unbindable. It was declared at a literal /externalUserId/... segment while also declaring externalUserId as a required path parameter, so the generator emitted @PathVariable("externalUserId") against a route template with no such variable. The operation is implemented in ConnectionApiController, so the endpoint could not have bound a request.
  • disableIntegrationInstanceWorkflow declared jwtBearerAuth while sitting on an {externalUserId} path, opposite to its enable twin on the identical path.
  • Security was undeclared on six operations, and entirely absent from the execution and webhook specs. All 45 embedded operations now declare it, and the declared scheme agrees with the path shape in every case.

Regenerated sources are limited to the seven files carrying a real change; the other 49 differed only in the @Generated date stamp.

Reference split by audience

Every embedded resource is reachable two ways and the reference interleaved them. It now has Backend (API Key) and Frontend (Signing Key JWT) folders under one Embedded separator, derived from the security the specs declare. Twin counts come out matched across every shared resource — 12/12, 4/4, 2/2, 1/1.

New pages

Comparing the guide against Prismatic's and Paragon's showed we document the happy path well and say almost nothing about failure — a grep for "troubleshoot" or "retry" across the embedded tree returned nothing.

Page Covers
Syncing Connected Users External user ids, records appearing on first authentication, the PATCH semantics
Troubleshooting The error envelope, what each status means, the three failure classes
Failures and Retries What the engine retries on its own, error branches, and that replay is not exposed
Theming and Localization (coming soon) The honest inventory of what is brandable and what is fixed
Limits and Concurrency Nothing is enforced per tenant today; the ingress is yours
Headless Embedding The flow the React SDK performs, endpoint by endpoint

Tenant-Isolated Security was merged into White-Label Execution with a redirect to the anchor.

Notes for review

  • b1a61e91a09 is the one to look at closely — it changes a public route. That route was unbindable as declared, so nothing can have depended on it.
  • The .gitignore commit is unrelated to content: the repo-wide Gradle **/build/ rule swallows the docs' content section literally named build, so git add silently skipped new pages there.
  • Some competitor gaps are feature work, not docs — theming, i18n, SDK lifecycle callbacks, event destinations, user-configured OAuth. The Theming page names them rather than leaving silence.

Verification

  • npm run generate:openapi exits 0 from a clean slate, producing 21 groups
  • npm run lint (link + fragment validation): 0 errors
  • npm run coming-soon: no drift
  • The three regenerated modules compile, including test sources

🤖 Generated with Claude Code

https://claude.ai/code/session_01HWSX2tatFegkBoWULoekeU

ivicac and others added 15 commits August 25, 2026 00:11
Field Mapping gets comingSoon frontmatter, which renders both the badge
and the callout without any change to the body.

Unified API already carried comingSoon; drop it from the sidebar the way
the distributed page was hidden. It is listed in two metas - the parent
flattens the build folder - so both need the entry removed for the page
to actually disappear from the nav.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HWSX2tatFegkBoWULoekeU
Nothing documented how a Connected User record actually comes into
existence or how to attach your own data to it. The page opens by
rejecting the word in its own title: "syncing" is push-shaped, and the
mechanism is pull-shaped. There is no create endpoint, no bulk import
and no way to pre-provision - ByteChef learns a user exists the first
time that user authenticates, and enrichment happens afterwards.

Most of the page is the PATCH surface, where the storage shape leaks
through the free-form JSON body: name and email are promoted to real
columns only when the value is a string, everything else is stringified
because metadata values are text, the merge is additive so a key can
never be removed, and null is discarded before the merge rather than
overwriting. None of that is predictable from the OpenAPI schema, which
says only additionalProperties.

Lives in Initial Setup rather than under Connected Users because Monitor
documents the console and this documents what your backend writes. The
console page and the quick-start callout now link here for depth; the
callout keeps ownership of the auto-creation fact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HWSX2tatFegkBoWULoekeU
getConnections was declared at a literal /externalUserId segment while
also declaring externalUserId as a required path parameter, so the
generator emitted @PathVariable("externalUserId") against a route
template holding no such variable. The operation is implemented in
ConnectionApiController, so the endpoint could not have bound a request.
Restore the braces.

disableIntegrationInstanceWorkflow declared jwtBearerAuth while sitting
on an {externalUserId} path, opposite to the enable twin on the very
same path. A JWT names the user through its sub claim and needs no such
segment, so the path was right and the security block was wrong.

Six connected-user workflow operations declared no security at all, and
the execution and webhook specs declared none anywhere - no schemes, no
requirements. Declare them: Actions and Tools accept either credential
because their paths carry the user id, while App Events and Request
Trigger carry none and so take only a JWT.

Every embedded operation now declares security, and the declared scheme
agrees with the path shape in all 45 cases.

The regenerated sources are limited to the seven files carrying a real
change; the other 49 differed only in the @generated date stamp.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HWSX2tatFegkBoWULoekeU
@ivicac
ivicac merged commit aaa61ca into master Aug 25, 2026
7 checks passed
@ivicac
ivicac deleted the claude/embedded-docs-3757 branch August 25, 2026 08:27
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant