OptionalauthorizeOptionalcontactOptionaldescriptionOptionaldocsServe /openapi.json and the /docs page (default true). false
serves neither; the routes added with addRoute() work the same.
OptionalexternalOptionallicenseOptionalroutesWhich of the app's own routes (not addRoute()'s) the spec lists:
'described' (the default), those a describeRoute() describes, on
the route or its group; 'all', every route; false, none.
OptionalscalarThe Scalar API reference script /docs loads. Default: a pinned
@scalar/api-reference release from jsDelivr, with its SRI hash.
'local': the one of the installed @scalar/api-reference, served by
the app at /docs/scalar.js (nothing is loaded from a CDN).
{ file }: that bundle (standalone.js) from disk, served the same
way. { src, integrity }: a script by URL with its sha384-… hash.
false serves /openapi.json without the page.
OptionalsecurityOptionalsecurityOpenAPI security scheme objects, by name (as in the spec's components).
OptionalserversOptionaltags
Whether a request may read
/openapi.jsonand/docs:falseanswers 403, a Response is sent as it is (a 401 asking for Basic auth, say). These routes come before middleware added to the app afterinitialize(), so an auth middleware there does not cover them.