dotCMS / dotCMS/core

Add OpenAPI annotations to MCP-priority REST resources

Open
#34,779 1 comment 0 reactions 0 assignees View on GitHub

A pull request for this has already been merged.

  • #34778 by @fmontes — merged
stale
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Description

The dotCMS MCP server relies on the auto-generated OpenAPI spec (openapi.yaml) to teach AI agents how to operate dotCMS. Real-world testing has shown ~40% of MCP API calls fail due to spec quality issues.

Root causes identified:

  • Only 41% (70/172) of MCP-priority endpoints have @Operation annotations, leaving them undocumented in the spec
  • ES search POST body schema incorrectly declares string instead of the actual JSON structure
  • The ES search GET variant exposes a requestBody which confuses AI agents
  • cacheTTL is typed as integer in the spec but the API expects a string
  • sortOrder is required for page operations but missing from schemas
  • FormDataMultiPart (Jersey internal) leaks into the spec on multipart endpoints instead of descriptive field schemas
  • The contentlet field in workflow fire endpoints is an opaque Map with no documentation of required fields
  • SYSTEM_FOLDER restriction for pages/file assets is undocumented
  • Naming inconsistencies (siteId/hostId/host, theme/themeId) are not documented as aliases
  • ~130 operations have auto-generated operationIds (e.g., getContent_1) instead of descriptive names

18 priority resource files need annotation work:
ESContentResourcePortlet, ContentResource, ContentTypeResource, PageResource, NavResource, WorkflowResource, CategoriesResource, TagResource (v1), LanguagesResource, FolderResource, SiteResource, ContainerResource, TemplateResource, ThemeResource, TempFileResource, WebAssetResource, RoleResource, UserResource

Acceptance Criteria
  • All ~172 HTTP methods across the 18 MCP-priority resources have @Operation with operationId, summary, and description
  • ES search GET endpoints are hidden (@Hidden), POST documented as primary
  • cacheTTL documented as string type in page endpoint descriptions
  • sortOrder documented as required in page endpoint descriptions
  • FormDataMultiPart schema references replaced with descriptive @Schema(type="object") with field descriptions
  • Contentlet field structure documented in workflow fire endpoints (required fields: contentType, title, languageId, etc.)
  • SYSTEM_FOLDER restriction documented in page and workflow endpoints
  • siteId/hostId/host aliasing documented in site endpoint descriptions
  • theme/themeId aliasing documented in template/theme descriptions
  • v1 TagResource endpoints marked deprecated = true referencing v2 API
  • Auto-generated operationIds replaced with descriptive names
  • Generated openapi.yaml summaries increase from ~244 to ~340+
  • Build compiles successfully, no business logic changes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the 18 named MCP-priority resource files and inspect how their HTTP methods currently generate the OpenAPI spec. Build the project and review the generated openapi.yaml, especially ES search, page, workflow, multipart, and v1 tag endpoints. Done means the listed annotations, schemas, aliases, deprecation markers, and descriptive operationIds are present, with a successful build and no business-logic changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi
Domain
api, documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.