aboutcode-org / aboutcode-org/vulnerablecode

OpenAPI schema for POST /api/v3/packages does not reflect paginated and polymorphic response

Open
#2,331 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
702
Forks
328
Avg merge
3d 8h
Merged PRs (30d)
3

Description

The current OpenAPI schema incorrectly documents the response structure of the POST /api/v3/packages/ endpoint.

The schema currently lists a 201 response as a direct mapping to #/components/schemas/PackageV3:
```json
"/api/v3/packages/": {
"post": {
"operationId": "v3_packages_create",
"tags": [
"v3"
],
"requestBody": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PackageQuery"
}
},
"application/x-www-form-urlencoded": {
"schema": {
"$ref": "#/components/schemas/PackageQuery"
}
},
"multipart/form-data": {
"schema": {
"$ref": "#/components/schemas/PackageQuery"
}
}
}
},
"security": [
{
"cookieAuth": []
},
{
"tokenAuth": []
},
{}
],
"responses": {
"201": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/PackageV3"
}
}
},
"description": ""
}
}
}
},
```

However, the actual API response is paginated, and the contents of the results array vary depending on request parameters (such as the details boolean option), so the response can also contain a list of PURL strings, instead of `PackageV3` objects.

The response also has an incorrect status code in the schema (actual status code is 200).

This causes automated client generators to fail to parse the actual API responses because they expect a `201` flat object instead of the `200` paginated response structure.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.