DELETE endpoints aren't being validated

[DonaldNgai]

I have this code

class DeleteQuerySchema(BaseModel):
    queryId: str

@query_bp.route("/delete/<string:client_id>", methods=["DELETE"])
@spec.validate(json=DeleteQuerySchema, resp=Response(HTTP_200=MessageSchema), tags=[query_bp.name])
def delete_query(client_id):
    """
    Delete a query for a given client.
    Expects JSON with {"queryId": "..."} in the body.
    """
    query_data = request.context.json
    
    logger.info(request.context)
    logger.info(request)
    # query_services.delete(f"clients/{client_id}/queries", query_data.queryId)
    return {"message": "Query deleted successfully"}

But based on my testing, the schema isn't used to validate the DELETE request, it also doesn't show up in the request.context

[kemingy]

Yes, it's because

The DELETE method has no defined semantics for the message body, so this should be empty.

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/DELETE
• https://stackoverflow.com/questions/299628/is-an-entity-body-allowed-for-an-http-delete-request

So I suggest you try query instead of json here.

[DonaldNgai]

Okay thanks! That makes sense. While I'm here, I was also wondering, when specifying an endpoint to use a security theme, is there any validation built in as well?

Right now, I just see it as an identifier in the Openapi docs but nothing else.

[kemingy]

The security schema will be validated by pydantic as well. (to make sure they are in the correct format)

For more information, check the example: https://github.com/0b01001001/spectree/blob/main/examples/security_demo.py