OpenAPI Overview

OpenAPI support is metadata-driven. Since v0.2.0 it includes security scheme support and pre-built WooCommerce domain schemas.

What is available

openapi.include=false routes are excluded by default.

Executable route args are exported automatically as path/query parameters (type, default, enum, format, minimum/maximum, minLength/maxLength, pattern, and description are carried over). List filters and pagination params no longer need a duplicate meta.parameters declaration.
Explicit meta.parameters entries override a derived parameter with the same name and in location; derived parameters without an explicit counterpart are kept.
OPTIONS operations are documented with a 204 success response (no content).
Custom meta.responses entries now replace the generated defaults for the same status code (previously the defaults won), so a route can override the success response or the default error reference.

Security scheme support: Bearer, Basic Auth, API Key, OAuth2, Cookie
Global and per-route security requirements
Pre-built WooCommerce domain schemas via BetterRoute::wooOpenApiComponents() (see WooCommerce > OpenAPI Components)

Per-operation security: [] overrides globalSecurity. Setting security to an empty array on an operation drops it from the document's global security requirement (useful for public health checks, webhooks, or auth endpoints inside an otherwise authenticated API).
RouteBuilder::publicRoute() automatically writes security: [] to the operation meta, so a route that opts out of WP auth also opts out of OpenAPI's global security.
RouteBuilder::protectedByMiddleware($security) propagates the supplied security scheme (string or array) into the operation meta when present.

strictSchemas => true exporter option — throws InvalidArgumentException on $ref to an unknown component instead of substituting a permissive placeholder
OpenApiRouteRegistrar::register() defaults to current_user_can('manage_options') — pass permissionCallback to override