[OAS] Security roles: Add `meta:{id}` to plugin schemas for named OAS components by Copilot · Pull Request #262305 · elastic/kibana

Copilot · 2026-04-09T14:41:30Z

Without meta:{id} on kbn-config-schema objects, the OAS generator emits anonymous inline schemas at every endpoint instead of reusable named $ref components — making the spec harder for downstream tools (e.g. Terraform provider codegen) to consume.

Changes

Route schemas (`server/routes/authorization/roles/`)

Added meta:{id} to all inline schema.object() calls across route files:

File	Schema ID(s)
`get.ts`	`security_get_role_params`, `security_get_role_query`
`get_all.ts`	`security_get_all_roles_query`
`put.ts`	`security_put_role_params`, `security_put_role_query`
`delete.ts`	`security_delete_role_params`
`query.ts`	`security_query_roles_request`

Model schemas (`model/`)

put_payload.ts → security_role_put_payload
bulk_create_or_update_payload.ts → security_bulk_create_or_update_roles_request

Sub-schemas (`@kbn/security-plugin-types-server`)

Named the reusable building blocks in role_schema.ts:

elasticsearchRoleSchema → security_role_elasticsearch_privileges
Indices entry → security_role_index_privilege
Remote indices entry → security_role_remote_index_privilege
Remote cluster entry → security_role_remote_cluster_privilege
Kibana privileges entry → security_role_kibana_privileges_entry

Example — before vs. after for the PUT body:

// Before: anonymous inline object at every endpoint
return schema.object({ description, metadata, elasticsearch, kibana });

// After: emits $ref: '#/components/schemas/security_role_put_payload'
return schema.object(
  { description, metadata, elasticsearch, kibana },
  { meta: { id: 'security_role_put_payload' } }
);

OAS breaking change allowlist

Added entries in packages/kbn-api-contracts/allowlist.json for all 6 affected endpoints. The data shape is identical — only the OAS representation changes from inline to $ref.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

ci-stats.kibana.dev
- Triggering command: /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node scripts/yarn_install_scripts.js run ldd 0.8.2 jest-unit-tests.yml .yml /lib/node_modules/npm/bin/node-gyp-bin/ldd t/health_gateway/lib/ld-linux.so.2 t/health_gateway--version dd /lib64/ld-linux-x86-64.so.2 b/li�� erated/elasticses/^$[0-9]$/v\1/g erated/elasticsearch/composable/^system$ n/node-gyp-bin/ldd erated/elasticseldd erated/elasticse/home/REDACTED/.cache/ms-playwright/webkit-2272/minibrowser-wpe/sys/lib/libjxl.so.0.8 dd .2 (dns block)
- Triggering command: /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node scripts/kbn bootstrap plugins/shared/maps/public/conne/home/REDACTED/work/kibana/kibana/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/scripts/rules/test_cases/signals/home/REDACTED/work/_temp/ghcca-node/node .dev�� tabbed_table_list_view.devdocs.json pes_png_common.devdocs.json plugins/shared/maps/public/conne/home/REDACTED/work/kibana/kibana/x-pack/solutions/security/plugins/security_solut/usr/lib plugins/shared/msort t.ts (dns block)
- Triggering command: /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node node scripts/jest x-pack/platform/plugins/shared/security/server/routes/authorization/roles/model/put_payload.test.ts ldd s/li�� src/core/packages/chrome/browser/home/REDACTED/.nvm/.cache/bin/node-v22.22.0-linux-x64/files/LICENhead src/core/packages/chrome/browser/home/REDACTED/.nvm/.cache/bin/node-v22.22.0-linux-x64/files/READM-n n/ldd submodules | heagit src/core/packageconfig n/node-gyp-bin/luser.email ldd nibr�� _console/ecs/generated/elasticse. _console/ecs/generated/elasticsearch/composable/component/host.json x86-64.so.2 _console/ecs/gensed _console/ecs/gen-e _console/ecs/gens/^$[0-9]$/v\1/g x86-64.so.2 (dns block)
clients3.google.com
- Triggering command: /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon run :build-webpack /lib64/ld-linux-x86-64.so.2 b/li�� s/chrome/browser/home/REDACTED/.nvm/README.md s/chrome/browser/home/REDACTED/.nvm/ROADMAP.md s/npm/bin/node-gyp-bin/ldd d -n 10 s/chrome/navigat/home/REDACTED/.cache/ms-playwright/webkit-2272/minibrowser-wpe/sys/li�� s/chrome/navigat/home/REDACTED/.nvm/nvm-exec .2 b/li�� e_errors.yaml .yaml x86-64.so.2 e_errors_with_reldd e_logs.yaml l_active_recovered_alert.yaml x86-64.so.2 (dns block)
detectportal.firefox.com
- Triggering command: /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon run :build-webpack /lib64/ld-linux-x86-64.so.2 b/li�� s/chrome/browser/home/REDACTED/.nvm/README.md s/chrome/browser/home/REDACTED/.nvm/ROADMAP.md s/npm/bin/node-gyp-bin/ldd d -n 10 s/chrome/navigat/home/REDACTED/.cache/ms-playwright/webkit-2272/minibrowser-wpe/sys/li�� s/chrome/navigat/home/REDACTED/.nvm/nvm-exec .2 b/li�� e_errors.yaml .yaml x86-64.so.2 e_errors_with_reldd e_logs.yaml l_active_recovered_alert.yaml x86-64.so.2 (dns block)
google.com
- Triggering command: /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon /home/REDACTED/work/kibana/kibana/node_modules/@moonrepo/core-linux-x64-gnu/moon run :build-webpack /lib64/ld-linux-x86-64.so.2 b/li�� s/chrome/browser/home/REDACTED/.nvm/README.md s/chrome/browser/home/REDACTED/.nvm/ROADMAP.md s/npm/bin/node-gyp-bin/ldd d -n 10 s/chrome/navigat/home/REDACTED/.cache/ms-playwright/webkit-2272/minibrowser-wpe/sys/li�� s/chrome/navigat/home/REDACTED/.nvm/nvm-exec .2 b/li�� e_errors.yaml .yaml x86-64.so.2 e_errors_with_reldd e_logs.yaml l_active_recovered_alert.yaml x86-64.so.2 (dns block)
googlechromelabs.github.io
- Triggering command: /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node /home/REDACTED/.nvm/versions/node/v22.22.0/bin/node install.js pi_logic.ts ldd b/li�� ts st.ts e_modules/npm/bin/node-gyp-bin/ldd naRoleSchema s ogic.ts /lib64/ld-linux-x86-64.so.2 nibr�� s/lib/libbrotlicommon.so.1 x-pack/platform/plugins/shared/fleet/server/conf/home/REDACTED/work/kibana/kibana/x-pack/platform/--version .2 x-pack/platform/ldd x-pack/platform//home/REDACTED/.cache/ms-playwright/webkit-2272/minibrowser-wpe/sys/lib/libsoup-3.0.so.0.7.4 yp-bin/ldd .2 (dns block)
iojs.org
- Triggering command: /usr/bin/curl curl -q --fail --compressed -L -s REDACTED -o - kbn-data-forge/e--norc kbn-data-forge/e--noprofile $0; sep=RS } kbn-�� kbn-data-forge/example_config/success_and_error_log_messages/esql_flapping_alert.yaml kbn-data-forge/example_config/anomalies_by_type/change_point_detection.yaml kbn-data-forge/example_config/anomalies_by_type/contextual_anomaly.yaml kbn-data-forge/etr kbn-data-forge/e[:upper:] kbn-data-forge/e[:lower:] kbn-data-forge/example_config/ramp_up_then_down.yaml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

elasticmachine · 2026-04-09T14:41:48Z

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

Click to trigger kibana-pull-request for this PR!
Click to trigger kibana-deploy-project-from-pr for this PR!
Click to trigger kibana-deploy-cloud-from-pr for this PR!
Click to trigger kibana-entity-store-performance-from-pr for this PR!
Click to trigger kibana-storybooks-from-pr for this PR!

Adds `meta:{id}` to all schema objects in the security role authorization routes so the OAS generator produces named $ref components instead of anonymous inline objects. This makes the generated OpenAPI spec easier to consume for downstream tools like the Terraform provider. Schemas named: - security_role_put_payload (put_payload.ts) - security_bulk_create_or_update_roles_request (bulk_create_or_update_payload.ts) - security_query_roles_request (query.ts) - security_get_role_params / security_get_role_query (get.ts) - security_get_all_roles_query (get_all.ts) - security_put_role_params / security_put_role_query (put.ts) - security_delete_role_params (delete.ts) - security_role_elasticsearch_privileges (role_schema.ts) - security_role_index_privilege / security_role_remote_index_privilege - security_role_remote_cluster_privilege (role_schema.ts) - security_role_kibana_privileges_entry (role_schema.ts) Also adds allowlist entries for the OAS breaking changes these introduce. Agent-Logs-Url: https://github.com/elastic/kibana/sessions/47d3f542-a577-47ed-ac07-9d4f361615a1 Co-authored-by: kc13greiner <21210601+kc13greiner@users.noreply.github.com>

elasticmachine · 2026-04-10T18:08:47Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: 056f247

Failed CI Steps

Check OAS Snapshot

cc @kc13greiner @Copilot

Initial plan

b2e30b1

Copilot AI assigned Copilot and kc13greiner Apr 9, 2026

Copilot started work on behalf of kc13greiner April 9, 2026 15:06 View session

Copilot AI linked an issue Apr 9, 2026 that may be closed by this pull request

[OAS] Security roles: Add meta:{id} to plugin schemas for named OAS components #261261

Closed

Copilot AI changed the title ~~[WIP] Add meta:id to plugin schemas for named OAS components~~ [OAS] Security roles: Add meta:{id} to plugin schemas for named OAS components Apr 9, 2026

Copilot finished work on behalf of kc13greiner April 9, 2026 15:35

Copilot AI requested a review from kc13greiner April 9, 2026 15:35

kc13greiner closed this Apr 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[OAS] Security roles: Add `meta:{id}` to plugin schemas for named OAS components#262305

[OAS] Security roles: Add `meta:{id}` to plugin schemas for named OAS components#262305
Copilot wants to merge 2 commits intomainfrom
copilot/add-meta-id-to-plugin-schemas

Copilot AI commented Apr 9, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Apr 9, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Route schemas (server/routes/authorization/roles/)

Model schemas (model/)

Sub-schemas (@kbn/security-plugin-types-server)

OAS breaking change allowlist

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

elasticmachine commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Apr 10, 2026

⏳ Build in-progress, with failures

Failed CI Steps

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 9, 2026 •

edited

Loading

Route schemas (`server/routes/authorization/roles/`)

Model schemas (`model/`)

Sub-schemas (`@kbn/security-plugin-types-server`)

elasticmachine commented Apr 9, 2026 •

edited

Loading