Describe the bug
Discovered during PR review: #589 (comment)
tl;dr - Authorization is incorrectly defined as a supported header in our REST transport openapi definition. In OpenAPI 3.1.0's specification (https://spec.openapis.org/oas/v3.1.0.html#fixed-fields-9), it explicitly mentions that if this parameter is defined as a header, it SHALL be ignored, which presents an inconsistency with UCP definition
To Reproduce
Compare https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json#L808 against https://spec.openapis.org/oas/v3.1.0.html#fixed-fields-9
Expected behavior
We should define authorization in a fully compatible way per OpenAPI - securitySchemes that specify all supported types (i.e. JWT/OAuth, API key, basic auth, etc.).
Screenshots
No response
Additional context
No response
Code of Conduct
Describe the bug
Discovered during PR review: #589 (comment)
tl;dr -
Authorizationis incorrectly defined as a supported header in our REST transport openapi definition. In OpenAPI 3.1.0's specification (https://spec.openapis.org/oas/v3.1.0.html#fixed-fields-9), it explicitly mentions that if this parameter is defined as a header, it SHALL be ignored, which presents an inconsistency with UCP definitionTo Reproduce
Compare https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json#L808 against https://spec.openapis.org/oas/v3.1.0.html#fixed-fields-9
Expected behavior
We should define authorization in a fully compatible way per OpenAPI -
securitySchemesthat specify all supported types (i.e. JWT/OAuth, API key, basic auth, etc.).Screenshots
No response
Additional context
No response
Code of Conduct