Realtime transcription WebSocket event schemas require REST-only client_secret and are omitted from RealtimeServerEvent

Summary

Valid Realtime transcription WebSocket events cannot be represented correctly from the OpenAPI schema because their session property reuses the REST session-creation response schema, which requires client_secret. The event examples omit client_secret, and the schema description says the property is not present for WebSocket updates.

Separately, the main RealtimeServerEvent discriminator union omits the transcription session event variants, so generated SDK unions cannot dispatch these valid event types.

Affected schemas

• RealtimeBetaServerEventTranscriptionSessionCreated
• RealtimeBetaServerEventTranscriptionSessionUpdated
• RealtimeServerEventTranscriptionSessionUpdated
• RealtimeTranscriptionSessionCreateResponse
• RealtimeServerEvent

Minimal valid WebSocket payloads

{
  "type": "transcription_session.created",
  "event_id": "event_created",
  "session": {
    "id": "sess_1",
    "object": "realtime.transcription_session",
    "input_audio_format": "pcm16"
  }
}

{
  "type": "transcription_session.updated",
  "event_id": "event_updated",
  "session": {
    "id": "sess_1",
    "object": "realtime.transcription_session",
    "input_audio_format": "pcm16"
  }
}

Neither event includes a client secret because it is a REST-only credential.

Actual schema behavior

Both transcription event schemas point session at:

$ref: "#/components/schemas/RealtimeTranscriptionSessionCreateResponse"

That component has:

required:
  - client_secret

Its own description says:

When a session is created on the server via REST API, the session object also contains an ephemeral key. ... This property is not present when a session is updated via the WebSocket API.

The transcription_session.created and transcription_session.updated examples likewise omit client_secret, contradicting the referenced required-field list.

In addition, RealtimeServerEvent.anyOf does not include either transcription event schema. As a result, generators that build a discriminator union from RealtimeServerEvent cannot recognize these event names.

Downstream impact

This surfaces in generated SDKs rather than being specific to one language:

• A generated event-session model requires client_secret for WebSocket events where the server does not send it.
• A generated RealtimeServerEvent union has no transcription_session.created or transcription_session.updated discriminator variants.
• In openai-ruby, the Realtime WebSocket helper uses that generated union, so these valid events are returned as unknown events; if the variant is added without correcting the session schema, decoding fails because client_secret is absent.

Expected schema shape

Please model the WebSocket event session separately from the REST session-creation response, for example:

1. Add or reuse a transcription WebSocket session schema that does not require client_secret.
2. Point both transcription_session.created and transcription_session.updated event schemas at that WebSocket-specific schema.
3. Include both event schemas in the appropriate RealtimeServerEvent discriminator union used for transcription WebSocket connections.
4. Keep the REST session-creation response contract unchanged, including its client_secret requirement.

Why this appears to be a specification issue

A code generator is expected to preserve OpenAPI required fields and anyOf union membership. It cannot safely infer optionality or union variants from prose/examples that contradict the schema. Correcting the schema should allow SDKs to regenerate the right event models without language-specific patches.

Start by inspecting RealtimeTranscriptionSessionCreateResponse and the four transcription session event schemas, then compare their required fields with the minimal WebSocket payloads in the issue. Check RealtimeServerEvent.anyOf for the discriminator union. Done means WebSocket events no longer require client_secret, both transcription variants are included in the union, and the REST response still requires client_secret.