Annotation Interface OpenApi.SecurityScheme

Enclosing class:
OpenApi
@Target(TYPE) @Retention(CLASS) @Repeatable(OpenApi.SecuritySchemes.class) @Documented public static @interface OpenApi.SecurityScheme
OpenAPI Security Scheme Object metadata.

Supported type() values are apiKey, http, mutualTLS, oauth2, and openIdConnect. The apiKey type requires apiKeyName() and in() with query, header, or cookie. The http type requires scheme(). The mutualTLS type has no additional required fields but requires OpenAPI 3.1 or 3.2 output; generation fails when the selected document provider produces OpenAPI 3.0. The oauth2 type requires flows() with at least one configured flow. The openIdConnect type requires openIdConnectUrl().

Declarative OpenAPI generation rejects fields that do not apply to the selected type(). Prefer the type-specific annotations such as OpenApi.ApiKeySecurityScheme, OpenApi.HttpSecurityScheme, OpenApi.MutualTlsSecurityScheme, OpenApi.OAuth2SecurityScheme, and OpenApi.OidcSecurityScheme when they match the security scheme you need.

Use only on @OpenApi.Document metadata types.

  • Element Details

    • name

      String name
      Component name.
      Returns:
      name

    • type

      String type
      Scheme type. Supported values are apiKey, http, mutualTLS, oauth2, and openIdConnect.
      Returns:
      type

    • description

      String description
      Security scheme description.
      Returns:
      description
      Default:
      ""

    • apiKeyName

      String apiKeyName
      API key parameter name. Valid only when type() is apiKey, where it is required.
      Returns:
      API key parameter name
      Default:
      ""

    • scheme

      String scheme
      HTTP authorization scheme. Valid only when type() is http, where it is required.
      Returns:
      scheme
      Default:
      ""

    • bearerFormat

      String bearerFormat
      Bearer format. Valid only when type() is http and scheme() is bearer.
      Returns:
      bearer format
      Default:
      ""

    • in

      String in
      API key location. Valid only when type() is apiKey, where it is required; supported values are query, header, and cookie.
      Returns:
      location
      Default:
      ""

    • flows

      OpenApi.OAuthFlows flows
      OAuth flows. Valid only when type() is oauth2, where at least one flow must be configured.
      Returns:
      OAuth flows
      Default:
      @io.helidon.openapi.OpenApi.OAuthFlows

    • openIdConnectUrl

      String openIdConnectUrl
      OpenID Connect discovery URL. Valid only when type() is openIdConnect, where it is required.
      Returns:
      OpenID Connect discovery URL
      Default:
      ""

    • oauth2MetadataUrl

      String oauth2MetadataUrl
      OpenAPI 3.2 OAuth 2 metadata URL. Valid only when type() is oauth2.

      Rendered only for OpenAPI 3.2 output.

      Returns:
      OAuth 2 metadata URL
      Default:
      ""

    • deprecated

      boolean deprecated
      Whether the security scheme is deprecated.

      Rendered only for OpenAPI 3.2 output.

      Returns:
      deprecated flag
      Default:
      false