Working with OpenAPI and security policy parameters

You can define API Security policy parameters in your OpenAPI specification file instead of in Application Security Manager under Security > Application Security > Parameters > Parameters List > Add Parameter. Certain parameter fields and configurations are disabled in the GUI. They are editable only in the OpenAPI specification file.

Location

If you upload an OpenAPI / Swagger file to define your parameters, the parameter’s Location field is disabled. You must update the parameter location (and any other configurations) in the OpenAPI file and re-upload it. You cannot locally update parameters via the GUI.

Note: The Location option Header and Cookie are specific to OpenAPI parameters.

Parameter Value Type

The Parameter Value Type object displays in the GUI as JSON value. In Parameter Value Type there is the option of Array value, specifying that the parameters are in an array. Array parameters can be used with path, query, header and form parameters, specifying that the parameters can appear in any location. An Array value enables the Serialization Format field. Also in Parameter Value Type there is the option of Object value, specifying that the parameters can appear in any location. This object value is defined in the OpenAPI file and is not editable from the GUI.

Serialization

There is support for serialization options as defined in Swagger 2.0.

Mixed type array

Loading of array=mixed type is not supported. If one of the following constructs is used in the OpenAPI or Swagger file, the file will fail to load. Errors and warning from loading of an OpenAPI file or a Swagger file are written to /ts/log/asm_config_server.log.

• Example 1

  Copy

  type: array
  items:
    oneOf:
      -type: string
      -type: integer

• Example 2

  Copy

  # Array of Cats and Dogs
  type:  array
  items:
    oneOf:
      - $ref: '#/components/schemas/Cat'
      - $ref: '#/components/schemas/Dog'

• Example 3

  Copy

  type:  array
  items:  {}