Skip to content

Relax "only unsafe methods can have a requestBody" constraintΒ #809

@glennmatthews

Description

@glennmatthews

Describe the bug

drf_spectacular.openapi.AutoSchema asserts that "only unsafe methods can have a body" and therefore will not render a requestBody for a DELETE endpoint, even if the view function is decorated with @extend_schema(request=...). While I'm aware that the relevant standards discourage including a requestBody in a DELETE, there are nevertheless existing APIs that do expect such. The OpenAPI 3.1 spec also permits (but discourages) this pattern:

In other cases where the HTTP spec is vague (such as GET, HEAD and DELETE), requestBody is permitted but does not have well-defined semantics and SHOULD be avoided if possible.

It would be useful for drf-spectacular to relax this constraint so as to allow more accurately documenting such non-standard REST APIs.

At present I've worked around this in an AutoSchema subclass by overriding get_operation() to explicitly re-add the requestBody back to the appropriate set of DELETE endpoints, but it would be nice to not have to do so.
(Another more targeted approach would be to directly override _get_request_body() to remove this check but I hate to override private methods).

To Reproduce

Decorate a delete endpoint with @extend_schema(request=...) and observe that the generated schema still reports no requestBody for this endpoint.

Expected behavior

Appropriately-decorated DELETE endpoints should be represented in the generated schema with an appropriately constructed requestBody.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions