Chapter 4. How to write an OpenAPI document for use as a 3scale API Management OpenAPI spec If you only want to read the code, all the examples are on OAS Petstore example source code . 3scale ActiveDocs are based on the specification of RESTful web services called Swagger (from Wordnik ). This example is based on the Extended OpenAPI Specification Petstore example and draws all the specification data from the OpenAPI Specification 2.0 specification document . Prerequisites An OpenAPI Specification (OAS) compliant specification for your REST API is required to power ActiveDocs on your Developer Portal. OAS is not only a specification. It also provides a full feature framework: Servers for the specification of the resources in multiple languages (NodeJS, Scala, and others). A set of HTML/CSS/Javascripts assets that take the specification file and generate the attractive UI. A OAS codegen project , which allows generation of client libraries automatically from a Swagger-compliant server. Support to create client-side libraries in a number of modern languages. 4.1. Setting up 3scale API Management ActiveDocs and OAS ActiveDocs is an instance of OAS. With ActiveDocs, you do not have to run your own OAS server or deal with the user interface components of the interactive documentation. The interactive documentation is served and rendered from your 3scale Developer Portal. 3scale 2.8 introduced OAS 3.0 with limited support in ActiveDocs. This means that some features working with ActiveDocs, such as autocompletion, are not yet fully integrated, and consequently 3scale defaults to OAS 2.0 when creating new accounts. For more details about OAS 3.0 and ActiveDocs, refer to Section 2.1, "OpenAPI Specification 3.0 usage with 3scale API Management" . Prerequisites Ensure that the template used in the Developer Portal implements the same OAS version specified in the Admin Portal. Procedure Build a specification of your API compliant with OAS. Add the specification to your Admin Portal. Results Interactive documentation for your API is now available. API consumers can send requests to your API through your Developer Portal. If you already have an OAS-compliant specification of your API, you can add it in your Developer Portal. See the tutorial on the ActiveDocs configuration . 3scale extends OAS in several ways to accommodate certain features that are needed for Developer Portal interactive API documentation: Auto-fill of API keys. 4.2. OpenAPI document example: Petstore API To read the specification from the original source, see the OpenAPI Specification . On the OAS site, there are multiple examples of OpenAPI documents that define APIs. If you like to learn by example, you can follow the example of the Petstore API by the OAS API Team. The Petstore API is an extremely simple API. It is meant as a learning tool, not for production. Petstore API methods The Petstore API is composed of 4 methods: GET /api/pets returns all pets from the system POST /api/pets creates a new pet in the store GET /api/pets/{id} returns a pet based on a single ID DELETE /api/pets/{id} deletes a single pet based on the ID The Petstore API is integrated with 3scale, and for this reason you must add an additional parameter for authentication. For example, with the user key authentication method, an API consumer must put the user key parameter in the header of each request. For information about other authentication methods, see Authentication patterns . User key parameters user_key: {user_key} The user_key will be sent by the API consumers in their requests to your API. The API consumers will obtain those keys the 3scale administrator's Developer Portal. On receiving the key, the 3scale administrator must perform the authorization check against 3scale, using the Service Management API. More on the OpenAPI Specification For your API consumers, the documentation of your API represented in cURL calls would look like this: 4.3. Additional OAS specification information If you want your documentation to look like the OAS Petstore Documentation , you must create a Swagger-compliant specification like the associated Petstore swagger.json file. You can use this specification out-of-the-box to test your ActiveDocs. But remember that this is not your API. OAS relies on a resource declaration that maps to a hash encoded in JSON. Use the Petstore swagger.json file as an example and learn about each object. OAS object This is the root document object for the API specification. It lists all the highest level fields. info object The info object provides the metadata about the API. This content is presented in the ActiveDocs page. paths object The paths object holds the relative paths to the individual endpoints. The path is appended to the basePath to construct the full URL. The paths might be empty because of access control list (ACL) constraints. Parameters that are not objects use primitive data types. In Swagger, primitive data types are based on the types supported by the JSON-Schema Draft 4 . There is an additional primitive data type file but 3scale uses it only if the API endpoint has CORS enabled. With CORS enabled, the upload does not go through the api-docs gateway, where it would be rejected. Currently OAS supports the following dataTypes : integer with possible formats: int32 and int64. Both formats are signed. number with possible formats: float and double. plain string. string with possible formats: byte, date, date-time, password and binary. boolean. Additional resources OpenAPI Object Info Object Paths Object API Server and Base URL 4.4. OAS design and editing tools The following tools are useful for designing and editing the OpenAPI specification that defines your API: The open source Apicurio Studio enables you to design and edit your OpenAPI-based APIs in a web-based application. Apicurio Studio provides a design view, so you do not need detailed knowledge of the OpenAPI specification. The source view enables expert users to edit directly in YAML or JSON. For more details, see Getting Started with Apicurio Studio . Red Hat also provides a lightweight version of Apicurio Studio named API Designer, which is included with Fuse Online on OpenShift. For more details, see Developing and Deploying API Provider Integrations . The JSON Editor Online is useful if you are very familiar with the JSON notation. It gives a pretty format to compact JSON and provides a JSON object browser. The Swagger Editor enables you to create and edit your OAS API specification written in YAML in your browser and preview it in real time. You can also generate a valid JSON specification, which you can upload later in your 3scale Admin Portal. You can use the live demo version with limited functionality, or deploy your own OAS Editor. 4.5. ActiveDocs auto-fill of API credentials Auto-fill of API credentials is a useful extension to OAS in 3scale ActiveDocs. You can define the x-data-threescale-name field with the following values depending on your API authentication mode: user_keys : Returns the user keys for applications of the services that use API key authentication only. app_ids : Returns the IDs for applications of the services that use App ID/App Key. OAuth and OpenID Connect are also supported for backwards compatibility. app_keys : Returns the keys for applications of services that use App ID/App Key. OAuth and OpenID Connect are also supported for backwards compatibility. Note The x-data-threescale-name field is an OAS extension that is ignored outside the domain of ActiveDocs. API key authentication example The following example shows using "x-data-threescale-name": "user_keys" for API key authentication only: "parameters": [ { "name": "user_key", "in": "query", "description": "Your API access key", "required": true, "schema": { "type": "string" }, "x-data-threescale-name": "user_keys" } ] For the parameters declared with x-data-threescale-name , when you log in to the Developer Portal you will see a drop-down list with the 5 latest keys, user key, App Id or App key, according to the value configured in the specification. So you can auto-fill the input without having to copy and paste the value:

Commands:
curl -X GET "http://example.com/api/pets?tags=TAGS&limit=LIMIT" -H "user_key: {user_key}" curl -X POST "http://example.com/api/pets" -H "user_key: {user_key}" -d "{ "name": "NAME", "tag": "TAG", "id": ID }" curl -X GET "http://example.com/api/pets/{id}" -H "user_key: {user_key}" curl -X DELETE "http://example.com/api/pets/{id}" -H "user_key: {user_key}"
"parameters": [ { "name": "user_key", "in": "query", "description": "Your API access key", "required": true, "schema": { "type": "string" }, "x-data-threescale-name": "user_keys" } ]