Skip to content

Document inline request bodies in Swagger, hide browser-only routes - #1558

Merged
helpcodeai merged 1 commit into
mainfrom
docs/swagger-request-bodies
Nov 6, 2026
Merged

helpcodeai merged 1 commit into
mainfrom
docs/swagger-request-bodies

Conversation

@helpcodeai

Copy link
Copy Markdown
Contributor

What

Swagger showed an empty request body for several endpoints whose body is typed inline instead of with a DTO class. This adds @ApiBody schemas with examples for them, and hides routes that only the dashboard or a browser redirect calls.

Documented with @ApiBody:

  • POST /api/adapters/starter-pack/install
  • POST /api/knowledge-graph/nodes, PATCH /api/knowledge-graph/nodes/:id
  • POST /api/knowledge-graph/edges, PATCH /api/knowledge-graph/edges/:id
  • POST /api/connectors/:id/oauth/authorize
  • PUT /api/mcp-connections/:clientId
  • Shopee and TikTok Shop POST connectors/:id/authorize (they also get @ApiBearerAuth(), which was missing)

Hidden with @ApiExcludeEndpoint: setup-links resolve/open, TikTok Shop install, POST /api/product-events, the four login form posts, POST /api/mcp-oauth/complete, and the Shopee/TikTok Shop complete routes. The "Connector setup" and "Product events" tags are removed, because every route under them is now hidden.

@ApiBody instead of DTO classes on purpose: the global ValidationPipe uses forbidNonWhitelisted, so a DTO would start rejecting fields the handlers accept today. This PR changes documentation only, not behaviour.

Deployment modes

Same in Cloud and self-hosted: only the OpenAPI document at /api/docs changes.

Checks (in packages/backend)

  • npx tsc --noEmit -p tsconfig.json: 0 errors (after installing the locally missing baseline modules: picomatch types, @aws-sdk/client-s3, @smithy/node-http-handler, basic-ftp, ssh2).
  • npx eslint on the 12 changed files: clean.
  • npx jest --maxWorkers=4 on the 16 related specs, including common/openapi.spec.ts: 390/390 passed.
  • node scripts/generate-cli-operations.mjs --check: up to date (206 operations).
  • node scripts/generate-llms-txt.mjs --check: exit 0.

No ee/ file changed.

Routes that typed @Body() with an inline TypeScript type showed no
request schema in the OpenAPI document, because Nest cannot reflect
a type literal or an interface.

Management API: add @ApiBody schemas, examples and amcp snippets to
POST /api/adapters/starter-pack/install, the knowledge-graph node and
edge routes (POST/PATCH nodes, POST/PATCH edges), POST
/api/connectors/:id/oauth/authorize and PUT /api/mcp-connections/:id.
Also document the returnTo body of the Shopee and TikTok Shop
authorize routes and mark them as dashboard-session routes.

Browser and dashboard-internal flows are now excluded with
@ApiExcludeEndpoint: the MCP client sign-in form posts (login,
file-search session, select-servers, first-app), the OAuth, Shopee and
TikTok Shop completion routes, the TikTok Shop App Store install, the
setup-link routes and product events. The Connector setup and Product
events tags had no visible route left and are removed.

Documentation only: handlers, validation and responses are unchanged.
@helpcodeai
helpcodeai requested a review from D3nisty as a code owner November 6, 2026 13:52
@helpcodeai
helpcodeai enabled auto-merge (squash) November 6, 2026 13:52
@helpcodeai
helpcodeai merged commit bc0373b into main Nov 6, 2026
17 of 18 checks passed
@helpcodeai
helpcodeai deleted the docs/swagger-request-bodies branch November 6, 2026 14:10
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 6, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant