A path, query, header, or cookie input accepted by an operation. location
intentionally remains a string so the neutral AST can preserve future or
vendor-defined OpenAPI locations instead of rejecting an otherwise valid
source document.
A recursively composable API type. This is deliberately target neutral:
plugins decide whether (for example) String { format: uuid } becomes a
branded TypeScript string, a Python UUID, or a Rust uuid::Uuid.
One OpenAPI Security Requirement Object. Multiple values in
Operation::security are alternatives; the map entries in one value are
conjunctive scheme requirements.
The credential metadata a generator needs to materialize an OpenAPI
security scheme. Unsupported/future scheme kinds are retained as Other
rather than discarded at the sidecar boundary.