Validation/documentation schemas attached to a route. Schema values are
intentionally unknown here — the validation plugin narrows them (Zod
schemas by default) so common stays dependency-free.
body: unknown
Request body schema.
query: unknown
Query parameter schema.
params: unknown
Path parameter schema.
headers: unknown
Header schema.
response: Readonly<Record<number, unknown>>
Response schemas keyed by status code.
tags: readonly string[]
OpenAPI tags.
summary: string
OpenAPI operation summary.
security: readonly SecurityRequirement[]
OpenAPI security requirements for this operation, overriding any
document-level default. Each entry names a scheme declared in the
document's components.securitySchemes and lists the scopes it needs
(empty for non-OAuth2 schemes such as HTTP bearer or API key).
An empty array is meaningful and is NOT the same as omitting the field: per the OpenAPI specification it declares the operation public, which is how a route opts out of a document-level requirement. Omitting the field leaves the operation inheriting whatever the document declares.
Declaring this does not enforce anything — authentication is enforced by middleware and guards. This describes the route for documentation and client generation.
Declaring is not the only way a document learns about authentication: a
requirement can instead be DERIVED from guards branded with
RouteSecurityMetadata, which is what @setu-ts/auth-plugin's
guards carry. A value declared here always wins over a derived one.