What goes wrong
The app's generated OpenAPI document describes no endpoints. A developer looking for stackiq's API contract finds an openapi.json with only an info block, and the only machine-readable descriptions are two hand-written JSON endpoints that cover two of the app's API families.
Evidence, re-read at c9760e0
openapi.json at the repo root contains openapi: 3.0.3 and an info block (title stackiq, version 0.2.3-unstable.20260912202721) and no paths key at all.composer.json:43 defines the script "openapi": "generate-spec", so the file is generated output; the generator finds nothing to describe in the current controllers.- Hand-written documentation endpoints:
lib/Controller/ViewController.php:373 getApiDocumentation() (GET /api/views/docs, appinfo/routes.php:186) and lib/Controller/AangebodenGebruikController.php:866 (GET /api/aangeboden-gebruik/docs, routes.php:261). The first is @NoAdminRequired (login required); the second is @PublicPage with an anonymous rate limit. Nothing in src/ calls either. (The matrix row says both are login-only; the aangeboden-gebruik one is public.)
appinfo/routes.php registers 132 routes; none of the others has a description anywhere in the repo besides the markdown pages on the docs site.
Context: VNG requirement
VNG #85 in issues.md:198-212 (public API for supply information) is marked met through OpenRegister's per-register OAS at /index.php/apps/openregister/api/registers/{id}/oas. That covers the register objects, not stackiq's own /apps/stackiq/api/* endpoints, and issues.md:208 itself notes the OAS endpoint 500s on registers with an organisation field. So this is a gap next to that requirement, not a duplicate of it.
Why it matters
Integrators (including the external VNG frontend) have no generated contract for stackiq's own endpoints, so changes to them cannot be checked or noticed from a spec.
Surfaced by the capability matrix in stackiq#1072 (merge 38b9938), row share-api-docs.
What goes wrong
The app's generated OpenAPI document describes no endpoints. A developer looking for stackiq's API contract finds an
openapi.jsonwith only an info block, and the only machine-readable descriptions are two hand-written JSON endpoints that cover two of the app's API families.Evidence, re-read at c9760e0
openapi.jsonat the repo root containsopenapi: 3.0.3and aninfoblock (titlestackiq, version0.2.3-unstable.20260912202721) and nopathskey at all.composer.json:43defines the script"openapi": "generate-spec", so the file is generated output; the generator finds nothing to describe in the current controllers.lib/Controller/ViewController.php:373getApiDocumentation()(GET /api/views/docs,appinfo/routes.php:186) andlib/Controller/AangebodenGebruikController.php:866(GET /api/aangeboden-gebruik/docs,routes.php:261). The first is@NoAdminRequired(login required); the second is@PublicPagewith an anonymous rate limit. Nothing insrc/calls either. (The matrix row says both are login-only; the aangeboden-gebruik one is public.)appinfo/routes.phpregisters 132 routes; none of the others has a description anywhere in the repo besides the markdown pages on the docs site.Context: VNG requirement
VNG #85 in
issues.md:198-212(public API for supply information) is marked met through OpenRegister's per-register OAS at/index.php/apps/openregister/api/registers/{id}/oas. That covers the register objects, not stackiq's own/apps/stackiq/api/*endpoints, andissues.md:208itself notes the OAS endpoint 500s on registers with an organisation field. So this is a gap next to that requirement, not a duplicate of it.Why it matters
Integrators (including the external VNG frontend) have no generated contract for stackiq's own endpoints, so changes to them cannot be checked or noticed from a spec.
Surfaced by the capability matrix in stackiq#1072 (merge 38b9938), row
share-api-docs.