cloudflare / cloudflare/api-schemas

workers_Worker.references.domains[].certificate_id is required in OpenAPI but omitted by API responses

Open Beginner friendly
#45 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
188
Forks
69
PR merge metrics
No merged PRs in 30d

Description

The OpenAPI schema for `workers_Worker.references.domains[]` marks `certificate_id` as required, but live Cloudflare API responses can omit it.

Schema path:

`#/components/schemas/workers_Worker/properties/references/properties/domains/items/required`

Endpoint confirmed:

`GET /accounts/{account_id}/workers/workers/{worker_id}`

Repro:

```sh
curl -fsSL https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.json \
| jq '.components.schemas.workers_Worker.properties.references.properties.domains.items.required'
```

Actual schema output:

```json
[
"id",
"hostname",
"zone_id",
"zone_name",
"certificate_id"
]
```

Then call Worker detail for a Worker that has a custom domain attached:

```sh
curl -fsS \
"https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/workers/$CLOUDFLARE_WORKER_ID" \
-H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
| jq '.result.references.domains[] | {hostname, keys: (keys | sort), has_certificate_id: has("certificate_id")}'
```

Observed live response shape:

```json
{
"hostname": "samebase.com",
"keys": [
"hostname",
"id",
"zone_id",
"zone_name"
],
"has_certificate_id": false
}
```

Expected one of:

- API responses always include `certificate_id` for every domain reference, or
- `certificate_id` is removed from the required list in the OpenAPI schema.

Impact:

Strict clients generated from `cloudflare/api-schemas` reject otherwise successful Worker responses. In our case, an Ajv validator generated from the schema rejected the response with:

```text
/result/references/domains/0 must have required property 'certificate_id'
```

Contributor guide

Open the contributing guide

Research direction

Inspect openapi.json at components.schemas.workers_Work.properties.references.properties.domains.items.required, then compare it with the GET /accounts/{account_id}/workers/workers/{worker_id} response using the provided curl and jq commands. Confirm the certificate_id mismatch with a strict Ajv validator; done means the schema and successful live response agree for domain references.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.