Skip to content

Register x-oai specification extensions for OpenAPI 3.2 down-leveling#73

Open
mikekistler wants to merge 1 commit intoOAI:mainfrom
mikekistler:mdk/register-x-oai-extensions
Open

Register x-oai specification extensions for OpenAPI 3.2 down-leveling#73
mikekistler wants to merge 1 commit intoOAI:mainfrom
mikekistler:mdk/register-x-oai-extensions

Conversation

@mikekistler
Copy link
Copy Markdown
Contributor

This PR registers seven x-oai-* specification extensions that are produced by the Microsoft.OpenApi library when serializing OpenAPI 3.2 features to OpenAPI 3.0 or 3.1 documents. These extensions allow round-tripping of 3.2 fields through older spec versions.

Extensions added

Extension Object 3.2 native field
x-oai-additionalOperations Path Item additionalOperations
x-oai-name Server name
x-oai-deprecated Security Scheme deprecated
x-oai-itemSchema Media Type itemSchema
x-oai-itemEncoding Media Type itemEncoding
x-oai-prefixEncoding Media Type prefixEncoding
x-oai-deviceAuthorizationUrl OAuth Flow deviceAuthorizationUrl

All fall under the existing oai namespace which is reserved for uses defined by the OpenAPI Initiative.

Context

The Microsoft.OpenApi library uses the pattern of serializing OpenAPI 3.2 fields as x-oai-* extensions when the target version is 3.0 or 3.1. This enables tooling to preserve these values during round-trip processing even when the document uses an older OpenAPI version.

Source: https://github.com/microsoft/OpenAPI.NET/blob/main/src/Microsoft.OpenApi/Models/OpenApiPathItem.cs (and related model files)

These extensions are produced by the Microsoft.OpenApi library when
serializing OpenAPI 3.2 features to OpenAPI 3.0/3.1 documents:

- x-oai-additionalOperations: non-standard HTTP methods on Path Items
- x-oai-name: server identifier
- x-oai-deprecated: security scheme deprecation
- x-oai-itemSchema: item schema in Media Type Objects
- x-oai-itemEncoding: item encoding in Media Type Objects
- x-oai-prefixEncoding: prefix encoding in Media Type Objects
- x-oai-deviceAuthorizationUrl: device authorization URL in OAuth Flows

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@mikekistler mikekistler requested a review from a team as a code owner May 6, 2026 15:49
@mikekistler mikekistler requested review from baywet and darrelmiller May 6, 2026 20:13
@mikekistler
Copy link
Copy Markdown
Contributor Author

Tagged @darrelmiller for review because Copilot told me:

  • The x-oai-* extensions fall under the already-registered oai namespace (owned by DarrelMiller/OAI).
  • You may want to coordinate with the OAI since x-oai-* is their reserved namespace — the PR might need their sign-off or be submitted by them directly.

@karenetheridge
Copy link
Copy Markdown
Member

Given that Microsoft != OpenAPI Initiative, why was this namespace selected for these extensions?

@ralfhandl
Copy link
Copy Markdown
Contributor

Given that Microsoft != OpenAPI Initiative, why was this namespace selected for these extensions?

Because the extensions are not MSFT-specific, they are OAS-specific:

These extensions allow round-tripping of 3.2 fields through older spec versions.

I see Mike acting as a TSC member registering useful OAI specification extensions, and the MSFT tool just happens to be the first to support them.

Copy link
Copy Markdown
Contributor

@ralfhandl ralfhandl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In general:

  • List all objects where new key words can appear (even if the MSFT tool doesn't support all of them yet)
  • Mention the corresponding OAS 3.2 keyword

---

{% capture summary %}
The `x-oai-additionalOperations` extension represents HTTP method operations that are not part of the standard set defined by the target OpenAPI version. For example, the HTTP QUERY method is not a standard operation in OpenAPI 3.0 or 3.1, so it is serialized under this extension.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The `x-oai-additionalOperations` extension represents HTTP method operations that are not part of the standard set defined by the target OpenAPI version. For example, the HTTP QUERY method is not a standard operation in OpenAPI 3.0 or 3.1, so it is serialized under this extension.
The `x-oai-additionalOperations` extension represents operations for HTTP methods that are not part of the standard set defined by the Path Item Object of the target OpenAPI version. For example, the HTTP QUERY method has no standard operation in OpenAPI 3.0 or 3.1, so it is serialized under this extension.


{% capture summary %}
The `x-oai-deprecated` extension indicates that a Security Scheme Object is deprecated and SHOULD be transitioned out of usage. In OpenAPI 3.2, this becomes the native `deprecated` field on Security Scheme Objects.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In OpenAPI 3.2, this becomes the native `deprecated` field on Security Scheme Objects.


{% capture summary %}
The `x-oai-deviceAuthorizationUrl` extension specifies the URL to be used for device authorization as defined in [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628). In OpenAPI 3.2, this becomes the native `deviceAuthorizationUrl` field on OAuth Flow Objects.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In OpenAPI 3.2, this becomes the native `deviceAuthorization` field on OAuth Flow Objects.

description: Encoding properties for individual items in a multipart request part, used when targeting OpenAPI versions prior to 3.2.
schema:
$ref: "#/$defs/encodingObject"
objects: [ "mediaTypeObject" ]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
objects: [ "mediaTypeObject" ]
objects: [ "mediaTypeObject", "encodingObject" ]

Why are we using lowerCamelCase for the object names? The section headings in the prose specification use Separate Capitalized Words, and the section anchors use kebab-case.


{% capture summary %}
The `x-oai-itemEncoding` extension defines the encoding for individual items within a media type, applicable to multipart or array-based content. In OpenAPI 3.2, this becomes the native `itemEncoding` field on Media Type Objects.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In OpenAPI 3.2, this becomes the native `itemEncoding` field on Media Type Objects and Encoding Objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants