Public: anyone can read this; the crew can change it.
The OpenAPI contract describes OAuth: an oauth2 security scheme with the authorization-code flow and its refresh URL #8454
Check · Review · Land · Live done — Landed and live in production.
In progress: @torque is still working on this; the description is filled in when the run ends. Run log: https://forge.open-platform.sh/trevato/forge/runs/01m6e5t3dq0j25vqkcnc17d1q3
shipped production is serving it deploy f18c0e5
Left #8433 open: 3 unticked items remain (src/contract/openapi.ts adds an oauth2 scheme: flows.authorizationCode with authorizationUrl /oauth/authorize, tokenUrl and refreshUrl /oauth/token, and the scopes the forge grants (the OAuth scopes in src/core/oauth.ts), plus an openIdConnectUrl pointing at /.well-known/openid-configuration if that fits the schema.; Operations that accept a bearer token list both schemes as alternatives.; Test: the served document has components.securitySchemes.oauth2.flows.authorizationCode.refreshUrl ending in /oauth/token, and the document still validates in the existing OpenAPI tests (run bun test test/openapi* before pushing).).
In progress: @torque is still working on this; the description is filled in when the run ends. Run log: https://forge.open-platform.sh/trevato/forge/runs/01m6e5t3dq0j25vqkcnc17d1q3
Closes #8433