Parameters cannot contain slashes. Is this an OpenAPI thing or a Prism thing?

[mimkorn]

Hi everyone!

I'm researching contract testing tools and trying out Prism for our company's needs. We've recently written an OpenAPI spec for one of our older tiny APIs. We had this there:

paths:
  '/template-definitions/v1/{id}':
    get:
      operationId: getTemplateDefinitions
      description: SPA template definitions endpoint
      parameters:
        - name: id
          in: path
          required: true
          description: id of the template
          example: 'mtk:components/textImage'
          schema:
            type: string

However, as you can see in the example part, the id can contain : and / characters.

When I tried using this with Prism, it would throw the NO_PATH_MATCHED_ERROR. Then I temporarily rewrote the path to be like: '/template-definitions/v1/{package}/{name}': and then Prism would start passing the data through correctly. However, we have another API that would just have a path there and the amount of / would not be something we could predict. It just needs to be an arbitrary string containing slashes.

I tried to encode / as %2F, but certain webservers shield against that due to security concerns (was our case as well, so that didn't return the data).

You can see that here https://demo.magnolia-cms.com/.rest/template-definitions/v1/mtk:components%2Flink (user:pass = superuser:superuser) whereas without encoded / it works: https://demo.magnolia-cms.com/.rest/template-definitions/v1/mtk:components/link

Is this inability to pass such a path a thing of Prism, or is it from OpenAPI nonsensical to have a parameter contain slashes?

[mimkorn]

Alright, it seems like it's an OpenAPI thing, and it is specific to path parameters. OAI/OpenAPI-Specification#892 They were very interested in putting it in the specification, but not to OAS 3, and even though the importance seemed to be high, the communication from core developers didn't continue after some point. There are key players like AWS allowing for such APIs, and it seems like it's quite a common thing to do with an API, so hopefully, we'll see it in OAS at some point, but at the moment, core devs made no promises.