openapi | Tools for working with OpenAPI specifications | REST library

Short answer: It's undefined behavior.

Most OpenAPI serialization styles are based on RFC 6570, which provides guidance only for:

• primitive values,
• arrays of primitives,
• simple non-nested objects (with primitive properties).

In case of other types of values (nested objects, objects containing arrays, nested arrays, arrays of objects) the behavior is undefined.

Similarly, OpenAPI's own deepObject style is currently defined only for simple objects but not for arrays or nested objects. Here are some related comments from the OpenAPI Specification authors/maintainers:

By the way, is there a reason we couldn't have deepObject work for arrays too? [...]

Darrel: Supporting arrays as you describe was my intent. I was supposed to find some canonical implementation to use as a guideline for the behavior, but didn't get around to it.

Ron: If we end up supporting the exploded array notation, it needs to be clear that the first index is 0 (or 1, or -1, or whatever).

(source)

Ron: when we defined deepObject in the spec, we explicitly chose to not mention what happens when the object has several levels in it, but in our conversations we went with 'not supported'. ​

(source)

There's an existing feature request to extend deepObject to support arrays and nested structures:
Support deep objects for query parameters with deepObject style

Solved above problem here is the code to post a buy order on KuCoin:

I found the solution in this blog post. Thanks @juunas for this

To solve my issue I've kept the code from the initial question to hide controller methods. To hide controllers I've implemented a IActionModelConvention:

Ingress internal means "Accept only the requests coming from the project's VPC or VPC SC perimeter".

When you use API Gateway, you aren't in your VPC, it's serverless, it's in Google Cloud managed VPC. Therefore, your query are forbidden.

And because API Gateway can't be plugged to a VPC Connector (for now) and thus can't route the request to your VPC, you can't use this ingress=internal mode.

Thus, the solution is to set an ingress to all, which is not a concern is you authorize only the legit accounts to access it.

For that, check in Cloud Run service is there is allUsers granted with the roles/run.invoker in your project.

• If yes, remove it

Then, create a service account and grant it the roles/run.invoker on the Cloud Run service.

Follow this documentation

• Step 4: update the x-google-backend in your OpenAPI spec file to add the correct authentication audience when you call your Cloud Run (it's the base service URL)
• Step 5: create a gateway with a backend service account; set the service account that you created previously

At the end, only the account authenticated and authorized will be able to reach your Cloud Run service

All the unauthorized access are filtered by Google Front End and discarded before reaching your service. Therefore, your service isn't invoked for nothing and therefore your pay nothing!

Only API Gateway (and the potential other accounts that you let on the Cloud Run service) can invoke to the Cloud Run service.

So, OK, your URL is public, reachable from the wild internet, but protected with Google Front End and IAM.

A possible and promising approach is to generate the Pydantic model starting from the corresponding JSON Schema of the STIX object.

Luckily enough the JSON schemas for all the STIX 2 objects have been defined by the OASIS Open organization on the GitHub repository CTI-STIX2-JSON-Schemas.

In particular, the JSON Schema for the Attack-Pattern is available here.

Google Cloud Storage does not accept a Signed JWT for authorization. Once you create the Signed JWT you must exchange the JWT for an Access Token.

Refer to my answer here or my article for a complete example in Python.

I encourage you to switch your project to FastAPI, it isn't much different or more difficult than Flask.

FastAPI docs about generating OpenAPI schema

It will not only allow you to generate OpenAPI docs / specification easily. It is also asynchronous, much faster and modern.

See also FastAPI Alternatives, Inspiration and Comparisons to read about differences.

Especially this citation from link above should explain why doing what you try to do may not be the best idea:

Flask REST frameworks

There are several Flask REST frameworks, but after investing the time and work into investigating them, I found that many are discontinued or abandoned, with several standing issues that made them unfit.

It seems that the ORM processor doesn't exclude those base entities, and tries to attach them to a non-existent "default" persistent units. Hence the warning.

I could get rid of it by either define "default" PU or assign io.quarkus.hibernate.orm.panache.kotlin to a named one.

Welcome to StackOverflow 👋

you can make use of a button, it will depend on your SecuritySchemes authentication as well the generator you are using

and when pressing the button, you will get

images above are from SwaggerHub platform