Problem

The sebuf protoc-gen-openapiv3 generator hardcodes required:false on every query parameter — 340/341 across the surface (only 1 is required:true). So parameters the handler treats as effectively required are documented as optional, and the request component schema's required:[…] array is contradicted by the parameter object (e.g. AnalyzeStockRequest.required:[symbol] vs the symbol query param required:false). Consumers omit them and get an empty/error 200 with no signal.

Single upstream fix

Make the generator read the proto field's requiredness (buf.validate.field.required / the (sebuf.http.query) annotation) and set the OpenAPI parameter required:true accordingly; regenerate. One codegen change flips ~30 params at once and removes the parameter-vs-component contradiction. If the external plugin can't be configured, apply it via the post-generation injector shipped in #4602.

Confirmed effectively-required params (marked required:false today)

• Aviation get-flight-status — flight_number
• Conflict get-humanitarian-summary — country_code
• ConsumerPrices list-consumer-price-movers — limit (omitted → 0 results, contradicts documented default 10)
• Economic get-bls-series / get-fred-series — series_id; list-world-bank-indicators — indicator_code
• Imagery search-imagery — bbox
• Infrastructure get-temporal-baseline — type (also a fixed allow-list)
• Intelligence compute-energy-shock — country_code; get-country-port-activity — country_code
• Leads submit-contact — name, organization, phone, email; register-interest — turnstileToken
• Market analyze-stock, backtest-stock, get-insider-transactions — symbol
• Military list-military-bases, list-military-flights — bbox (also tracked in feat(api/dx): military bbox endpoints return silent empty 200 on missing/all-zero bbox — surface 400 or debug header #4595)
• News summarize-article-cache — cache_key
• Sanctions lookup-sanction-entity — q
• Scenario get-scenario-status — jobId (handler 400s on missing)
• SupplyChain (8) — iso2 / chokepointId / fromIso2 / toIso2 on get-chokepoint-history, get-bypass-options, get-country-cost-shock, get-multi-sector-cost-shock, get-country-products, get-route-impact, get-country-chokepoint-index, get-sector-dependency, get-route-explorer-lane
• Webcam get-webcam-image — webcam_id

Acceptance criteria

• Every effectively-required param is required:true in its OpenAPI parameter object.
• No parameter marked required:false while listed in its request schema's required:[…].
• A guard test (extend the docs(api): document API-key auth contract across all OpenAPI specs (#4599 root cause #1) #4602 contract test) prevents regression.

Part of the umbrella audit #4599. Sibling workstreams: #4595 (bbox 400/router), #4602 (auth — in flight).