-
Notifications
You must be signed in to change notification settings - Fork 303
Description
Describe the bug
drf_spectacular.openapi.AutoSchema asserts that "only unsafe methods can have a body" and therefore will not render a requestBody for a DELETE endpoint, even if the view function is decorated with @extend_schema(request=...). While I'm aware that the relevant standards discourage including a requestBody in a DELETE, there are nevertheless existing APIs that do expect such. The OpenAPI 3.1 spec also permits (but discourages) this pattern:
In other cases where the HTTP spec is vague (such as GET, HEAD and DELETE),
requestBodyis permitted but does not have well-defined semantics and SHOULD be avoided if possible.
It would be useful for drf-spectacular to relax this constraint so as to allow more accurately documenting such non-standard REST APIs.
At present I've worked around this in an AutoSchema subclass by overriding get_operation() to explicitly re-add the requestBody back to the appropriate set of DELETE endpoints, but it would be nice to not have to do so.
(Another more targeted approach would be to directly override _get_request_body() to remove this check but I hate to override private methods).
To Reproduce
Decorate a delete endpoint with @extend_schema(request=...) and observe that the generated schema still reports no requestBody for this endpoint.
Expected behavior
Appropriately-decorated DELETE endpoints should be represented in the generated schema with an appropriately constructed requestBody.