Skip to content

docs: align admin OpenAPI contracts with server behavior - #2866

Open
haranishi wants to merge 2 commits into
supabase:masterfrom
haranishi:docs/admin-openapi-contracts
Open

haranishi wants to merge 2 commits into
supabase:masterfrom
haranishi:docs/admin-openapi-contracts

Conversation

@haranishi

@haranishi haranishi commented Oct 11, 2026 •

Copy link
Copy Markdown

The admin OpenAPI specification still omits supported fields and advertises SSO response shapes that differ from the handlers. Align the remaining contracts from #2859 with current master, without changing server behavior.

  • Document MFA factor fields, the audit query filter and pagination headers.
  • Correct SSO creation to HTTP 201; include supported create/update fields, resource-ID lookups and filters, domains, and HTTP 422 responses.
  • Include invite as a generated-link type.
  • Retain current master's soft-deletion request and empty-object response documentation, and its new SAML dedicated_scope fields.

Closes #2859.

Validation on 2026-11-09, head 42bfd410f8b97ae33b07c3af3c3a833a53995093, integrated with master 35307ce6c1ca59016fd820f1d77d9b6201dc2e15:

  • Prettier and git diff --check pass; all 221 local references resolve.
  • OpenAPI structure validation reports the same two existing structural errors as master, with no new errors.
  • Generated the admin client with Go 1.27.3 and the repository's pinned oapi-codegen v2.8.0. go test ./client/admin compiles and vets the generated package; it has no test files.
  • Repeated generation is byte-identical. Generated output was restored after validation; only openapi.yaml differs from master.

Generation changes existing Go client signatures for SSO identifiers, list parameters, deletion and response fields. Publishing generated-client changes needs a separate compatibility review, so none is included here. No live server or database test was performed for this documentation-only update.

Prepared with OpenAI Codex assistance.

Document the eleven discrepancies reported in the admin API contracts, including SSO fields and filters, pagination headers, and the empty user-deletion response.

Closes supabase#2859
@haranishi
haranishi marked this pull request as ready for review October 11, 2026 07:43
@haranishi
haranishi requested a review from a team as a code owner October 11, 2026 07:43
Copilot AI balanced review requested due to automatic review settings October 11, 2026 07:43

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

cemalkilic added a commit that referenced this pull request Nov 3, 2026
<!-- claude-slack-attribution -->
_Requested by **Cemal Kilic** · [Slack
thread](https://supabase.slack.com/archives/C022071RB2L/p1791968272007429?thread_ts=1791968272.007429&cid=C022071RB2L)_

**Before:** `openapi.yaml` says `DELETE /admin/users/{userId}` returns
`200` with a `UserSchema` ("User's account data.") and documents no
request body.

**After:** The spec documents what the endpoint actually returns, an
empty `{}` body, plus the optional `should_soft_delete` request body.

This fixes the OpenAPI entry for `DELETE /admin/users/{userId}` so
generated clients and docs match the server.

**How:** The `adminUserDelete` handler in `internal/api/admin.go` always
responds with `sendJSON(w, http.StatusOK, map[string]interface{}{})` for
hard delete, soft delete, and already-soft-deleted users. It optionally
reads a JSON body with `should_soft_delete`. The spec change adds an
optional `requestBody` with `should_soft_delete` (boolean, default
`false`) and replaces the `200` schema with `type: object`,
`additionalProperties: false`, `example: {}`. Only `openapi.yaml`
changes, and only this one operation. No Go changes.

Overlaps with the DELETE /admin/users/{userId} hunk in #2866 (credit to
haranishi); this is a narrow version so that endpoint can land
independently. Context: supabase/supabase-js#2758.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_0137vz1dKsd2RZigEqmeo8N3


---
_Generated by [Claude
Code](https://claude.ai/code/session_0137vz1dKsd2RZigEqmeo8N3)_

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Cemal Kılıç <cemalkilic@users.noreply.github.com>
@haranishi

Copy link
Copy Markdown
Author

Could a maintainer review this admin OpenAPI correction for #2859 at b66fbdcdcff6?

It aligns the documented request fields, pagination headers, response bodies and status codes with the existing handlers. It changes the API specification rather than adding provider behavior. The PR description lists the eleven discrepancies and the validation performed.

If any part of #2859 should be documented differently, please point out the expected contract.

@haranishi

Copy link
Copy Markdown
Author

Updated against current master 35307ce6 in 42bfd410f8b9. The SSO conflict retains both the existing admin-contract corrections and upstream’s new dedicated_scope fields. Prettier, all local-reference checks, baseline-compared OpenAPI validation, generated-client compilation and deterministic regeneration pass. Only the specification differs from master; generated code is excluded for the compatibility review described in the PR. This is ready for another look.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

openapi.yaml seems to drift from the admin handlers in several places

2 participants