HTTPS Enforcement

general > use-https-for-callbacks

Guidance / Message

{{apiContract.expression}} must use https as it is a callback url

Examples

valid

openapi: "3.0.0"
info:
  title: example API
  version: "1.0.0"
paths:
  /subscribe:
    post:
      responses:
        '201':
          description: Webhook created
      callbacks:
        myEvent:
          'https://{$request.body#/callbackUrl}'

invalid

openapi: "3.0.0"
info:
  title: example API
  version: "1.0.0"
paths:
  /subscribe:
    post:
      responses:
        '201':
          description: Webhook created
      callbacks:
        myEvent:
          'http://{$request.body#/callbackUrl}'

Applies to Callback

Constraint

Type: Declarative Validation