API First security
Before you start
Prepare an OpenAPI contract and an API-first Data Services implementation that uses tAPIContract and tAPIOperation.
Import the contract or start an update. The Assign components to operations dialog opens with the Operations and Security tabs.
Review contract security
Use the Operations tab to review the effective contract requirement after global security and operation-level overrides are applied.
- Use the Security filter to isolate protected operations or security changes.
- After an update, use the Changed filter to find operations whose effective security changed.
Use the Security tab to review the contract classification and runtime implementation coverage.
| Review item | Values |
|---|---|
| Contract security | Security required, Explicitly public, Optional authentication, No security declared, or Invalid / unresolved. |
| Runtime implementation coverage | Ready, Configuration required, or Unsupported. |
| Global security after update | Shows the global requirement after the update. An operation-level declaration can override it. |
Map security schemes to runtime profiles
In the Security schemes table, review Scheme, Contract type, Used by, Runtime profile, and Implementation status. Select Configure Security Profiles... to open Map Security Schemes to Runtime Profiles.
The dialog shows a read-only contract panel and a runtime binding panel. Select a scheme to view its source, type, operation count, scopes, and contract details.
| OpenAPI scheme | Compatible runtime profile |
|---|---|
| HTTP Basic | Basic Auth |
| HTTP Bearer, OpenID Connect, or OAuth 2.0 | JWT OIDC (Dynamic) or JWT Static |
| API key, mutual TLS, or another HTTP scheme | No runtime profile in this release |
OAuth 2.0 support validates signed JWT access tokens. The runtime does not acquire tokens or introspect opaque access tokens.
Create or select a runtime profile
For a supported scheme used by at least one operation, select Select existing to reuse a compatible profile or Create new to create one. Select Edit profile... for an existing binding, or Unmap to remove a working scheme-to-profile binding.
Select existing and Create new are available only for supported schemes used by at least one operation. Edit profile... requires a mapped profile, and Unmap requires a working binding.
New profiles use Profile name, Profile type, Provider, and provider settings. Required fields have an asterisk (*).
| Profile and provider | Required fields | Defaults and optional fields |
|---|---|---|
| Basic Auth / users.properties file | Users file path | Default path: classpath:config/users.properties. |
| JWT OIDC (Dynamic) / OpenID Connect Discovery | Issuer; Accepted audiences | OpenID configuration URL; Allowed algorithms defaults to RS256; Principal claim defaults to sub; Roles claims default to roles,realm_access.roles; Clock skew defaults to 60; JWKS cache defaults to 300. |
| JWT OIDC (Dynamic) / JWKS URL | Issuer; Accepted audiences; JWKS URL | Allowed algorithms defaults to RS256; Principal claim defaults to sub; Roles claims default to roles,realm_access.roles; Clock skew defaults to 60; JWKS cache defaults to 300. |
| JWT Static / Java keystore | Keystore path; Keystore password; Certificate alias; Issuer; Accepted audiences | Keystore type defaults to JKS; Allowed algorithms defaults to RS256; Principal claim defaults to sub; Roles claims default to roles,realm_access.roles; Clock skew defaults to 60. |
For JWT Static, Allowed algorithms is a checkbox grid containing RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and ES512. Keep at least one algorithm selected. When editing a profile, leave the stored keystore password unchanged to preserve it.
Saving validates duplicate names, missing required values, and empty algorithm selections.
Save mappings
After creating or selecting a profile, return to the mapping dialog and verify that Profile binding contains the expected profile name.
Select Save profile to create or update the runtime profile immediately. Select Save mappings to persist the current scheme-to-profile bindings. Canceling the mapping dialog discards unsaved mapping changes only.
Review operation security
After import, review the operation view in tAPIContract. It contains Operation, Path, Operation ID, Component, and Effective security.
Use Search and Method to filter operations. Select Security Settings... to reopen the mapping dialog for the current contract. On tAPIOperation, use the informational Security tab to review the effective requirement and runtime profile.
Update an existing contract
Import the updated OpenAPI contract and review the Changed filter for operations whose effective security changed.
Review the updated global requirement, contract classifications, and runtime implementation coverage. Reopen Configure Security Profiles... when a changed or new scheme needs a profile mapping.
Common UI outcomes
| UI outcome | Meaning |
|---|---|
| Ready | The security-required operation has runtime implementation coverage. |
| Configuration required | The contract requires security, but the runtime profile configuration is incomplete. |
| Unsupported or Not supported | The contract mechanism has no supported runtime profile mapping. |
| Unused | The scheme is not used by an operation and does not require a profile. |