cloudflare / cloudflare/api-schemas
workers_Worker.references.domains[].certificate_id is required in OpenAPI but omitted by API responses
- Dominant language
- No language data
- Stars
- 188
- Forks
- 69
- PR merge metrics
- No merged PRs in 30d
Description
The OpenAPI schema for `workers_Worker.references.domains[]` marks `certificate_id` as required, but live Cloudflare API responses can omit it.
Schema path:
`#/components/schemas/workers_Worker/properties/references/properties/domains/items/required`
Endpoint confirmed:
`GET /accounts/{account_id}/workers/workers/{worker_id}`
Repro:
```sh
curl -fsSL https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json \
| jq '.components.schemas.workers_Worker.properties.references.properties.domains.items.required'
```
Actual schema output:
```json
[
"id",
"hostname",
"zone_id",
"zone_name",
"certificate_id"
]
```
Then call Worker detail for a Worker that has a custom domain attached:
```sh
curl -fsS \
"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/workers/$CLOUDFLARE_WORKER_ID" \
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
| jq '.result.references.domains[] | {hostname, keys: (keys | sort), has_certificate_id: has("certificate_id")}'
```
Observed live response shape:
```json
{
"hostname": "samebase.com",
"keys": [
"hostname",
"id",
"zone_id",
"zone_name"
],
"has_certificate_id": false
}
```
Expected one of:
- API responses always include `certificate_id` for every domain reference, or
- `certificate_id` is removed from the required list in the OpenAPI schema.
Impact:
Strict clients generated from `cloudflare/api-schemas` reject otherwise successful Worker responses. In our case, an Ajv validator generated from the schema rejected the response with:
```text
/result/references/domains/0 must have required property 'certificate_id'
```
Contributor guide
Research direction
Inspect openapi.json at components.schemas.workers_Work.properties.references.properties.domains.items.required, then compare it with the GET /accounts/{account_id}/workers/workers/{worker_id} response using the provided curl and jq commands. Confirm the certificate_id mismatch with a strict Ajv validator; done means the schema and successful live response agree for domain references.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100