feat(securityscheme): add oauth2MetadataUrl support (OpenAPI 3.2) by mdaneri · Pull Request #2706 · microsoft/OpenAPI.NET

mdaneri · 2026-01-22T17:15:24Z

Pull Request

Description

Adds first-class support for OpenAPI 3.2 oauth2MetadataUrl on OAuth2 security schemes, including serialization and OpenAPI 3.2 reader support.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Other (please describe):

Related Issue(s)

Fixes #2694

Changes Made

Add OAuth2MetadataUrl to OpenApiSecurityScheme/IOpenApiSecurityScheme and reference wrapper.
Serialize oauth2MetadataUrl only for OpenAPI 3.2+ when type: oauth2.
Parse oauth2MetadataUrl in the OpenAPI 3.2 reader.
Add unit tests for serialization and parsing.

Testing

Unit tests added/updated
Integration tests added/updated
Manual testing performed
All existing tests pass

Checklist

My code follows the code style of this project
I have performed a self-review of my own code
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

Versions applicability

My change applies to the version 1.X of the library, if so PR link:
My change applies to the version 2.X of the library, if so PR link:
My change applies to the version 3.X of the library, if so PR link:
I have evaluated the applicability of my change against the other versions above.

Additional Notes

Unit tests executed locally:

test/Microsoft.OpenApi.Tests/Models/OpenApiSecuritySchemeTests.cs
test/Microsoft.OpenApi.Readers.Tests/V32Tests/OpenApiSecuritySchemeTests.cs

baywet

Thanks for the contribution!

In addition to the requested change, you'll need to refresh the public API export.

src/Microsoft.OpenApi/Models/OpenApiSecurityScheme.cs

mdaneri · 2026-01-22T18:24:01Z

Always I forget about that 😓

mdaneri · 2026-01-22T18:28:03Z

That test looks interesting! I might just borrow it and incorporate it into my project.

baywet · 2026-01-22T18:32:22Z

That test looks interesting! I might just borrow it and incorporate it into my project.

The dotnet team actually made it an analyzer, so you get feedback on build and not on tests anymore. We just haven't taken the time to update things here. See this as an example.

https://github.com/BinkyLabs/openapi-overlays-dotnet/blob/b9635b903f375498673a3ef801d7d862879e2e3b/src/lib/BinkyLabs.OpenApi.Overlays.csproj#L45

When serializing OAuth2 security schemes, the OAuth2MetadataUrl is now written as 'x-oauth2-metadata-url' for OpenAPI 3.1 and later. Updated tests and public API documentation to reflect this change.

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt

baywet · 2026-01-26T16:04:26Z

@mdaneri would you mind updating the benchmarks please?

cd performance/benchmark
dotnet run -c Release

(and commit the changes)

baywet · 2026-01-27T20:57:20Z

Hi @mdaneri
I have migrated the repository to use code analyzers in #2711, this should provide earlier feedback (on build instead of on tests) thanks to the warn as errors.
It also means there are conflicts with this PR now, apologies for the additional work.

To drive this to completion, whenever you have time, could you please:

address the comment about the interface split.
rebase (drop the old public APIs for the tests)
update the shipped apis with your changes.

Let me know if you have any additional comments or questions.

baywet · 2026-02-03T15:03:33Z

Gentle ping on this one @mdaneri

mdaneri · 2026-02-17T19:18:41Z

I'll work on this tomorrow

…tadata URL support

…rformance.Descriptions-report-github.md modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.csv modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.html modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.json modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.EmptyModels-report-github.md modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.EmptyModels-report.csv modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.EmptyModels-report.html modified: performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.EmptyModels-report.json

mdaneri · 2026-02-18T20:01:11Z

@mdaneri would you mind updating the benchmarks please?
cd performance/benchmark
dotnet run -c Release
(and commit the changes)

Done

…/OpenAPI.NET into pr/2706

baywet

Thank you for making the changes!
One minor thing to clean up

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt

Remove the IsTrimmable assembly metadata entry from test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt to update the public API baseline to reflect the attribute's removal.

Delete the approved public API snapshot used by tests (test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt). This removes the long approved PublicApi text file, likely because the public API approvals were updated or the snapshot is no longer required; update or regenerate the approved snapshot in tests if needed.

baywet · 2026-02-19T13:40:09Z

@mdaneri can you please also run the following:

# add the missing public api entries
dotnet format --diagnostics RS0016
# discard changes to cs files to avoid creating conflicts
git checkout *.cs

and then commit the text file?

Sorry for not providing the context here: I moved this repos from using custom tests for the public API surface to using the "new" dotnet analyzers. And your PR was originally created before that move, hence the "migration" here.

Expose OAuth2 metadata URL support in the public API: add OpenApiConstants.OAuth2MetadataUrl constant, introduce IOAuth2MetadataProvider with an OAuth2MetadataUrl getter (System.Uri?), and surface OAuth2MetadataUrl on OpenApiSecurityScheme (get/set) and OpenApiSecuritySchemeReference (get). This enables consumers to read/write the OAuth2 metadata URL for security schemes.

baywet

Thank you for making the changes!

mdaneri · 2026-02-19T13:44:10Z

Could you please update the contributing guide? It seems like some important information is missing. I’m afraid I might forget all of it next time! :)

baywet · 2026-02-19T14:05:19Z

Could you please update the contributing guide? It seems like some important information is missing. I’m afraid I might forget all of it next time! :)

This is an excellent suggestion, working on it.

Also adding this section for the failing benchmarks, would you mind updating them please?

Updating the benchmark information

To ensure performance of the library does not degrade over time, we have continuous benchmarks running. You might see the continuous integration failing if your pull request changed any model under src/Microsoft.OpenApi/Models.

Benchmark result for EmptyApiSchema does not match the existing benchmark result (original!=new). Allocated bytes differ: 408 != 416

To update the benchmarks, run the following script:

cd performance/benchmark
dotnet run -c Release

Then commit the report files using a "chore" commit.

baywet · 2026-02-19T14:26:38Z

also put together #2734 to address the contributing documentation gaps.

…a-url

baywet

Thank you for making the changes!

feat(securityscheme): add oauth2 metadata url support

335cee5

mdaneri requested a review from a team as a code owner January 22, 2026 17:15

baywet requested changes Jan 22, 2026

View reviewed changes

src/Microsoft.OpenApi/Models/OpenApiSecurityScheme.cs Show resolved Hide resolved

Add x-oauth2-metadata-url serialization for OAuth2 schemes

14b73bf

When serializing OAuth2 security schemes, the OAuth2MetadataUrl is now written as 'x-oauth2-metadata-url' for OpenAPI 3.1 and later. Updated tests and public API documentation to reflect this change.

baywet reviewed Jan 26, 2026

View reviewed changes

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt Outdated Show resolved Hide resolved

mdaneri and others added 3 commits February 18, 2026 20:07

Merge branch 'main' into pr/2706

dae98d6

feat(securityscheme): introduce IOAuth2MetadataProvider for OAuth2 me…

33a968b

…tadata URL support

mdaneri added 2 commits February 19, 2026 12:29

Merge branch 'feat/oauth2-metadata-url' of https://github.com/mdaneri…

97ed211

…/OpenAPI.NET into pr/2706

Merge branch 'main' into pr/2706

90a2b8d

baywet requested changes Feb 19, 2026

View reviewed changes

test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt Outdated Show resolved Hide resolved

mdaneri added 2 commits February 19, 2026 14:20

Remove IsTrimmable assembly metadata

7530465

Remove the IsTrimmable assembly metadata entry from test/Microsoft.OpenApi.Tests/PublicApi/PublicApi.approved.txt to update the public API baseline to reflect the attribute's removal.

baywet previously approved these changes Feb 19, 2026

View reviewed changes

baywet mentioned this pull request Feb 19, 2026

docs/public api #2734

Merged

mdaneri added 2 commits February 19, 2026 19:20

Merge remote-tracking branch 'upstream/main' into feat/oauth2-metadat…

e9c5d36

…a-url

chore: update benchmark baselines after OpenApiSchema model refactor

de642da

mdaneri dismissed baywet’s stale review via de642da February 19, 2026 18:32

baywet approved these changes Feb 19, 2026

View reviewed changes

baywet enabled auto-merge (squash) February 19, 2026 18:38

baywet merged commit 4509488 into microsoft:main Feb 19, 2026
8 of 9 checks passed

mdaneri deleted the feat/oauth2-metadata-url branch February 19, 2026 18:43

Conversation

mdaneri commented Jan 22, 2026

Pull Request

Description

Type of Change

Related Issue(s)

Changes Made

Testing

Checklist

Versions applicability

Additional Notes

Uh oh!

baywet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mdaneri commented Jan 22, 2026

Uh oh!

mdaneri commented Jan 22, 2026

Uh oh!

baywet commented Jan 22, 2026

Uh oh!

Uh oh!

baywet commented Jan 26, 2026

Uh oh!

baywet commented Jan 27, 2026

Uh oh!

baywet commented Feb 3, 2026

Uh oh!

mdaneri commented Feb 17, 2026

Uh oh!

mdaneri commented Feb 18, 2026

Uh oh!

baywet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

baywet commented Feb 19, 2026

Uh oh!

baywet left a comment

Choose a reason for hiding this comment

Uh oh!

mdaneri commented Feb 19, 2026

Uh oh!

baywet commented Feb 19, 2026

Updating the benchmark information

Uh oh!

baywet commented Feb 19, 2026

Uh oh!

baywet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments