Executable adapter

OpenAPI operation

Use an OpenAPI 3.x document to expose one or more public, read-only HTTPS GET operations. Vintraa freezes each reviewed path, method, and parameter list into the release.

Adapter: openapi-operation-v1
Runtime: REMOTE_HTTP
Inspection type: OPENAPI
Source: Public OpenAPI document URL

Current boundary

What Vintraa can publish

OpenAPI 3.0, 3.1, or 3.2 served from a public HTTPS URL.
GET operations explicitly marked read-only in the reviewed Vintraa manifest.
Only the reviewed path and query parameters; Vintraa rejects undeclared input keys.
No operation authentication, request body, post-execution approval, cookies, or arbitrary headers.

1 · Expose

Serve the source contract publicly

Replace the example host and identifiers with your own. Do not add API keys, tokens, customer secrets, or signing private keys to the source contract.

Source exampleyaml

openapi: 3.1.0
info:
  title: Care availability API
  version: 1.0.0
servers:
  - url: https://agent.example.com
paths:
  /availability/{location}:
    get:
      operationId: getAvailability
      summary: Read current care-home availability
      security: []
      parameters:
        - name: location
          in: path
          required: true
          schema:
            type: string
        - name: date
          in: query
          required: false
          schema:
            type: string
            format: date
      responses:
        "200":
          description: Current availability

2 · Inspect

Ask Vintraa to normalize it

Run this after the authentication example on the main developer page. An active publisher membership is required. The returned inspection is the source of truth.

Inspection requestbash · curl + jq

# Continue in the same shell after signing in and creating a publisher.
export VINTRAA_PUBLISHER_ID="replace-with-your-publisher-id"
export OPENAPI_URL="https://agent.example.com/replace-this"

curl --fail-with-body --silent --show-error \
  --request POST \
  --header "Authorization: Bearer $VINTRAA_TOKEN" \
  --header 'Content-Type: application/json' \
  --data "$(jq -nc \
    --arg source "$OPENAPI_URL" \
    '{sourceType:"OPENAPI",source:$source}')" \
  "$VINTRAA_API/publishers/$VINTRAA_PUBLISHER_ID/agent-import-inspections" | jq

3 · Review

Confirm the publishable binding

These examples show the bounded binding required at publication. Compare every field with Vintraa's inspection result and your deployed behavior.

Normalized bindingjson

{
  "type": "openapi-operation",
  "operationId": "getAvailability",
  "method": "GET",
  "path": "/availability/{location}",
  "parameters": [
    { "name": "location", "in": "path", "required": true },
    { "name": "date", "in": "query", "required": false }
  ],
  "requestBody": false,
  "securityRequired": false,
  "readOnly": true
}

Representative sandbox inputjson

{
  "location": "leeds",
  "date": "2026-09-01"
}

Runtime behavior

What Vintraa sends

01
The first OpenAPI server URL becomes the reviewed runtime endpoint. Server variables need defaults.
02
Each input key must match one reviewed path or query parameter. Path values are URL-encoded.
03
The inspection response is the authoritative normalized manifest; review it before registration.

Rejected at publication or runtime

Not currently publishable

POST, PUT, PATCH, DELETE, or any other mutating operation.
API-key, OAuth, bearer-token, cookie, mTLS, or other credential passthrough.
Redirect following, runtime URL selection, endpoint drift, or undeclared headers.

4 · Exercise and submit

Publication checklist

01
The document and runtime endpoint are public HTTPS URLs.
02
Every action retained for publication is GET, read-only, body-free, and unauthenticated.
03
The sandbox run succeeds against the same endpoint and operation that will be submitted.
04
The frozen release contains no secrets and does not rely on redirects or credential passthrough.

Continue to the release path Check platform support