Setu-TS
    Preparing search index...

    Interface RouteSchema

    Validation/documentation schemas attached to a route. Schema values are intentionally unknown here — the validation plugin narrows them (Zod schemas by default) so common stays dependency-free.

    0.1.0

    interface RouteSchema {
        body?: unknown;
        description?: string;
        headers?: unknown;
        operationId?: string;
        params?: unknown;
        query?: unknown;
        response?: Readonly<Record<number, unknown>>;
        security?: readonly Readonly<Record<string, readonly string[]>>[];
        summary?: string;
        tags?: readonly string[];
    }
    Index
    body? description? headers? operationId? params? query? response? security? summary? tags?

    Optional Readonlybody

    body?: unknown

    Request body schema.

    description?: string

    Longer OpenAPI operation description.

    0.10.0

    headers?: unknown

    Header schema.

    operationId?: string

    Declared OpenAPI operation identifier, used verbatim instead of a derived id. Must be nonblank and unique among routes included in the document.

    0.10.0

    params?: unknown

    Path parameter schema.

    query?: unknown

    Query parameter schema.

    response?: Readonly<Record<number, unknown>>

    Response schemas keyed by status code.

    security?: readonly Readonly<Record<string, readonly string[]>>[]

    OpenAPI security requirements for this operation, overriding any document-level default. Each entry names a scheme declared in the document's components.securitySchemes and lists the scopes it needs (empty for non-OAuth2 schemes such as HTTP bearer or API key).

    An empty array is meaningful and is NOT the same as omitting the field: per the OpenAPI specification it declares the operation public, which is how a route opts out of a document-level requirement. Omitting the field leaves the operation inheriting whatever the document declares.

    Declaring this does not enforce anything — authentication is enforced by middleware and guards. This describes the route for documentation and client generation.

    Declaring is not the only way a document learns about authentication: a requirement can instead be DERIVED from guards branded with RouteSecurityMetadata, which is what @setu-ts/auth-plugin's guards carry. A value declared here always wins over a derived one.

    // Requires the `bearerAuth` scheme:
    app.router.get('/todos/:id', {
      schema: { security: [{ bearerAuth: [] }] },
      handler,
    });

    // Explicitly public, even when the document requires auth by default:
    app.router.post('/login', { schema: { security: [] }, handler });

    0.2.0

    summary?: string

    OpenAPI operation summary.

    tags?: readonly string[]

    OpenAPI tags.

    Settings
    Member Visibility

    On This Page
    Properties