Skip to content

feat: generate-spec command article#337

Open
sobanieca-redocly wants to merge 1 commit into
mainfrom
feat/article-on-generate-spec
Open

feat: generate-spec command article#337
sobanieca-redocly wants to merge 1 commit into
mainfrom
feat/article-on-generate-spec

Conversation

@sobanieca-redocly

Copy link
Copy Markdown
Contributor

What/Why/How?

A new article for generate-spec command in Redocly CLI. To be published once drift article lands (#332) and when
generate-spec command is released (Redocly/redocly-cli#2937)

Reference

Testing

Screenshots (optional)

Check yourself

  • Code is linted
  • Tested
  • All new/updated code is covered with tests

Security

  • Security impact of change has been considered
  • Code follows company security practices and guidelines

@sobanieca-redocly
sobanieca-redocly marked this pull request as ready for review July 15, 2026 14:13

@redocly redocly Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

marketing-site AI Review: 🟢 Completed

Reunite Agent has reviewed your changes and found 2 potential issue(s).

Note

Low Risk

This PR only adds a new documentation article and introduces no code or behavioral changes, resulting in zero operational risk.

Overview

Adds a new blog post introducing the experimental generate-spec command in the Redocly CLI. The article covers:

  • How the command deterministically infers OpenAPI 3.1 descriptions from recorded HTTP traffic (such as HAR or Kong logs).
  • A practical demonstration using the Redocly Cafe API as an example.
  • Details on the optional --with-ai flag, which refines baseline descriptions using AI providers like Claude, Codex, or Cursor.
  • Necessary warnings regarding data privacy and the command's experimental status.


```bash
redocly proxy --target https://api.cafe.redocly.com --har ./cafe.har
```

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: High

The proxy command records full HTTP exchanges, including credentials and PII. Move the 'Capture in a sandboxed environment' warning to the recording section to ensure users avoid capturing sensitive production data.

{% admonition type="warning" name="Traffic leaves your machine" %}
`--with-ai` sends samples of the recorded traffic - URLs, query strings, request and response bodies - to the selected AI provider.
Capture in a sandboxed environment with synthetic data, and make sure the traffic contains no secrets or personal data you are not allowed to share.
{% /admonition %}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severity: Medium

Deterministic inference can leak PII from traffic into the generated spec via enum values. Present the synthetic data advice as a general requirement for all modes, not just for AI-assisted refinement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant