ApiSpecSource

Where Vulnetix finds an organisation's OpenAPI and Swagger descriptions. Fields, YAML, HCL and CLI samples, and how apply treats it.

Where Vulnetix finds an organisation’s OpenAPI and Swagger descriptions. Each source is one place to read specs from: a file in a repository, a URL, a host to probe for well-known paths, or a connected API gateway or catalogue. A tenant may declare many, each named.


`apiVersion`	`vulnetix.com/v1`
`kind`	`ApiSpecSource`
Group	API inventory
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by `metadata.name`
Token and role	An owner or admin session, or a `vmt_` config management token with the owner or admin role that lists `ApiSpecSource` in its kinds. See Management tokens.
Terraform resource	`vulnetix_api_spec_source`, imported by name (see Terraform and OpenTofu)
CLI	`vulnetix config apply`, CLI v3.157.0 and later.
Pinned schema	`v1.15.0/ApiSpecSource.schema.json`
Newest schema	`latest/ApiSpecSource.schema.json`
First released in	`v1.2.0`
Print the built-in copy	`vulnetix config schema ApiSpecSource`

Minimal

Only the fields the kind requires. From examples/ApiSpecSource/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ApiSpecSource.schema.json
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: payments-openapi
spec:
  source:
    url:
      url: https://api.acme.com/openapi.json

HCL (resource vulnetix_api_spec_source)

# Only the arguments the kind requires. From config-schemas examples/ApiSpecSource/minimal.yaml.

resource "vulnetix_api_spec_source" "payments_openapi" {
  name = "payments-openapi"
  source = {
    url = {
      url = "https://api.acme.com/openapi.json"
    }
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ApiSpecSource.schema.json
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: payments-openapi
spec:
  source:
    url:
      url: https://api.acme.com/openapi.json
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/ApiSpecSource/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ApiSpecSource.schema.json
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: payments-openapi
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/API-311
spec:
  source:
    repo:
      repository: acme/payments
      path: api/openapi.yaml
  schedule: daily
  owner: payments-team
  tags: [payments, public]
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: public-api-spec
spec:
  source:
    url:
      url: https://api.acme.com/openapi.json
  probe:
    mode: exact
  schedule: hourly
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: staging-host
spec:
  source:
    host:
      host: staging.acme.com:8443
  probe:
    mode: authorized
    authorize: true
  schedule: weekly
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: edge-gateway
spec:
  source:
    connector:
      kind: aws_apigw
      ref: a1b2c3d4e5
  schedule: 6h
  owner: platform-team
  tags: [edge]

HCL (resource vulnetix_api_spec_source)

# Every argument the kind supports. From config-schemas examples/ApiSpecSource/advanced.yaml.

resource "vulnetix_api_spec_source" "payments_openapi" {
  name     = "payments-openapi"
  owner    = "payments-team"
  schedule = "daily"
  source = {
    repo = {
      path       = "api/openapi.yaml"
      repository = "acme/payments"
    }
  }
  tags = ["payments", "public"]
  labels = {
    team = "payments"
  }
  annotations = {
    ticket = "https://tracker.example.com/API-311"
  }
}

resource "vulnetix_api_spec_source" "public_api_spec" {
  name = "public-api-spec"
  probe = {
    mode = "exact"
  }
  schedule = "hourly"
  source = {
    url = {
      url = "https://api.acme.com/openapi.json"
    }
  }
}

resource "vulnetix_api_spec_source" "staging_host" {
  name = "staging-host"
  probe = {
    authorize = true
    mode      = "authorized"
  }
  schedule = "weekly"
  source = {
    host = {
      host = "staging.acme.com:8443"
    }
  }
}

resource "vulnetix_api_spec_source" "edge_gateway" {
  name     = "edge-gateway"
  owner    = "platform-team"
  schedule = "6h"
  source = {
    connector = {
      kind = "aws_apigw"
      ref  = "a1b2c3d4e5"
    }
  }
  tags = ["edge"]
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ApiSpecSource.schema.json
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: payments-openapi
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/API-311
spec:
  source:
    repo:
      repository: acme/payments
      path: api/openapi.yaml
  schedule: daily
  owner: payments-team
  tags: [payments, public]
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: public-api-spec
spec:
  source:
    url:
      url: https://api.acme.com/openapi.json
  probe:
    mode: exact
  schedule: hourly
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: staging-host
spec:
  source:
    host:
      host: staging.acme.com:8443
  probe:
    mode: authorized
    authorize: true
  schedule: weekly
---
apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: edge-gateway
spec:
  source:
    connector:
      kind: aws_apigw
      ref: a1b2c3d4e5
  schedule: 6h
  owner: platform-team
  tags: [edge]
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
`apiVersion`	string	yes		exactly `vulnetix.com/v1`	The document format version. Every kind in this release is vulnetix.com/v1.
`kind`	string	yes		exactly `ApiSpecSource`	Always ApiSpecSource.
`metadata`	object	yes		no other keys
`metadata.name`	string	yes		pattern `^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
`metadata.org`	string	no		format `uuid`	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
`metadata.labels`	object	no		map of string to string (length 0 to 256); keys match `^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$`	Free key/value labels. Stored with the object, never interpreted by the server.
`metadata.annotations`	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
`spec`	object	yes		no other keys
`spec.source`	object	yes		1 to 1 keys; no other keys	The one place this reads specs from. Exactly one of its forms is set.
`spec.source.repo`	object	no		no other keys	A spec file committed in a repository.
`spec.source.repo.repository`	string	yes		pattern `^[^/]+/[^/]+$`	owner/name on the connected forge.
`spec.source.repo.path`	string	yes		length 1 to any	Path to the file within the repository.
`spec.source.url`	object	no		no other keys	A spec served at a URL. By default the URL is fetched exactly as given; set probe to look for well-known paths under a host instead.
`spec.source.url.url`	string	yes		pattern `^https?://`; format `uri`
`spec.source.host`	object	no		no other keys	A host probed for the well-known paths that serve a spec. Needs an ownership proof or an authorization, set in probe.
`spec.source.host.host`	string	yes		pattern `^[a-zA-Z0-9.-]+(:[0-9]{1,5})?$`	A hostname, optionally with a port.
`spec.source.connector`	object	no		no other keys	A connected API gateway or catalogue the organisation already set up on the integrations page.
`spec.source.connector.kind`	string	yes		`aws_apigw`, `cloudflare_api_shield`, `swaggerhub`, `postman`, `azure_apim`, `gcp_apigee`, `kong`, `stoplight`, `readme`, `backstage`
`spec.source.connector.ref`	string	yes		length 1 to any	The gateway, API or collection id within the connector.
`spec.probe`	object	no		no other keys	How a url or host source is reached. owned probes well-known paths once an ownership proof is verified; authorized probes after the organisation asserts it is allowed to test the host; exact fetches only the given url and never guesses a path. A url source defaults to exact; a host source must be owned or authorized.
`spec.probe.mode`	string	no		`owned`, `authorized`, `exact`
`spec.probe.authorize`	boolean	no		exactly `true`	Required true when mode is authorized: the organisation asserts it may probe this host. Recorded with who applied the document.
`spec.schedule`	string	no	`daily`	`off`, `hourly`, `6h`, `daily`, `weekly`	How often the source is read. off reads only on request.
`spec.owner`	string	no		length 0 to 256	The team or person who owns the APIs this source finds. Stored and shown, never interpreted.
`spec.tags`	array of string	no		0 to 32 items; each item: length 0 to 64	Free labels applied to every spec this source finds.

Applying this kind

Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

A tenant declares many sources, each named. A source is small and wholly declared, so apply overwrites the whole row from the document: a field the document leaves out goes back to its default. Rows made this way are marked as managed by config, and the console shows them read only.

Terraform and OpenTofu

The resource is vulnetix_api_spec_source in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_api_spec_source.

Import an object that already exists by its name:

# Import an existing ApiSpecSource by its name (metadata.name).
terraform import vulnetix_api_spec_source.payments_openapi payments-openapi

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/ApiSpecSource/authorized-host.yaml from Vulnetix/config-schemas:

apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: staging-host
spec:
  source:
    host:
      host: staging.acme.com
  probe:
    mode: authorized
    authorize: true

examples/ApiSpecSource/gateway.yaml from Vulnetix/config-schemas:

apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: edge-gateway
spec:
  source:
    connector:
      kind: aws_apigw
      ref: abcdef1234
  schedule: 6h

examples/ApiSpecSource/repo.yaml from Vulnetix/config-schemas:

apiVersion: vulnetix.com/v1
kind: ApiSpecSource
metadata:
  name: payments-openapi
  labels:
    team: payments
spec:
  source:
    repo:
      repository: acme/payments
      path: api/openapi.yaml
  schedule: daily
  owner: payments-team
  tags: [payments, public]

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.