feat(asm): add 403 Forbidden response to all ASM API endpoints#9
Open
dmchaledev wants to merge 1 commit into
Open
feat(asm): add 403 Forbidden response to all ASM API endpoints#9dmchaledev wants to merge 1 commit into
dmchaledev wants to merge 1 commit into
Conversation
Every endpoint was missing a 403 response, meaning SDK generators and API clients had no contract for the "valid token, wrong permissions" case — which is distinct from 401 and requires different handling (show a permissions error rather than prompting re-auth). Adds a reusable Forbidden component to components/responses and references it from all 11 endpoints in the ASM spec. https://claude.ai/code/session_01NSCBkwTnx3dp2co9rQjpWg
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every endpoint in
asm/openapi.yamlwas missing a403 Forbiddenresponse. The spec only described401 Unauthorized, which leaves a meaningful gap for SDK consumers and API client authors:401403For a security product where API keys can be scoped (e.g. read-only vs. admin), treating these identically leads to confusing UX — clients may prompt users to log in again when the real fix is a permissions change.
Changes
Forbiddenresponse component tocomponents/responseswith a clear description and example error body$ref: '#/components/responses/Forbidden'under the'403'key on all 11 endpoints:GET /assets,GET /assets/{id},PATCH /assets/{id},DELETE /assets/{id}GET /scans,POST /scans,GET /scans/{scan_id}GET /vulnerabilities,GET /vulnerabilities/{vuln_id},PATCH /vulnerabilities/{vuln_id}GET /tags,POST /tagsTest plan
validate-openapi.yml)403references were present before, so no regressions possibleForbiddencomponent renders correctly in a Swagger/Redoc viewerhttps://claude.ai/code/session_01NSCBkwTnx3dp2co9rQjpWg
Generated by Claude Code