SDK Updates: v1.0.0

[postman]

SDK updates

Added

• Generated .github/workflows/release.yml workflow for automated releases to Maven Central (Sonatype). Publishing is enabled by default; the release workflow's first step skips publishing—succeeding, not failing—when the required Maven Central / GPG repository secrets are not all set, publishing.releaseBranch in the generate request selects the trigger branch, and deployment is idempotent on re-runs
• Added support for GraphQL schema-derived SDK generation with Java-idiomatic SDK-root methods alongside generated services
• Added rawGraphql and rawGraphqlAsync methods for executing arbitrary GraphQL documents with strongly-typed variables and responses
• Generated GraphQL methods now include operation-specific response models with support for snippets and example projects
• Generated release.yml release workflows now publish by default and no longer expose the publishing.enabled request toggle; each workflow's first step skips publishing—succeeding, not failing—when its required registry secret (e.g. NPM_TOKEN, PYPI_API_TOKEN, Maven/GPG) is unset. Go and PHP need no registry secret and always publish (git tag + GitHub release).
• Generated SDKs now include class-level bearer token authorization for OAuth2 (authorizationCode, implicit, password flows) and OpenID Connect security schemes; callers supply a token once at client construction instead of attaching the Authorization header per request

Changed

• Generated release.yml release workflows now publish by default and no longer expose the publishing.enabled request toggle; each workflow's first step skips publishing—succeeding, not failing—when its required registry secret (e.g. NPM_TOKEN, PYPI_API_TOKEN, Maven/GPG) is unset. Go and PHP need no registry secret and always publish (git tag + GitHub release).

Fixed

• GraphQL ID variables in generated Java and Kotlin examples now use runnable placeholder values instead of empty strings
• Multipart requests with self-referential models (e.g., circular references like CatalogObject → CatalogItem → variations[] → CatalogObject) now generate and compile successfully instead of causing a stack overflow during generation
• GraphQL operation response models now include only the fields selected in the query, preventing deserialization failures when SDKs deserialize partial GraphQL responses that omit unrequested fields
• Path parameters embedded within URL segments (OData-style routes like companies({{companyId}})) are now correctly extracted and made available to generated SDK methods
• API key authentication now properly resolves collection variables in header names and falls back to Authorization when the resolved name is invalid, preventing Headers.append runtime errors in generated SDKs
• Server URLs with doubled schemes (e.g., https://protocol://server/api/version from unresolved Postman variables) now parse correctly; the real base path is recoverable and requests route to the correct endpoint

Added

• Generated .github/workflows/release.yml workflow for automated releases to Maven Central (Sonatype); configure publishing via publishing.enabled and publishing.releaseBranch in the generate request, with idempotent deployment handling for re-runs

Changed

• Server URL normalization now handles prose-bearing values from OpenAPI specs and Postman collections, extracting the first valid https?:// URL token and falling back gracefully when no URL can be found

Fixed

• Generated SDK class Javadoc comments now properly escape block comment terminators and angle brackets from collection descriptions
• Environment enum names now remain valid when placeholder server URLs result in invalid identifiers; invalid enum names fall back to SERVER with deduplication to prevent conflicts
• Environment enum now defers URL validation to request time, preventing static initializer crashes when specs contain unresolvable template placeholders

Added

• GraphQL schema mapper now translates GraphQL Query and Mutation root fields into ApiContext service methods with kind: 'graphql', mapping field arguments to variablesSchema and return types to both responseDataSchema and GraphQL-aware responseEnvelopeSchema for downstream generators
• Shared GraphQL schema type mapper for translating GraphQL schema types (objects, input objects, enums, scalars) into generator-friendly internal structures (Models, Schemas, EnumModels), with conservative fallback behavior for unsupported constructs (interfaces, unions)
• API key authentication helper now resolves both parameter name and location from security schemes, enabling language generators to route credentials to headers, query parameters, or cookies as declared in the spec

Fixed

• OpenAPI specs with path-style internal $ref (e.g., #/paths/~1api~1v2~1warehouses/get/responses/202) now resolve correctly instead of throwing invalid reference errors
• The sdkConfig.inferServiceNames: false option now prevents service fragmentation; when disabled, all requests collapse into a single root service named after sdkName, restoring the flat client surface for collections converted from OpenAPI specs
• Generated SDKs now use the correct apikey header name when generated from Postman collections with omitted in field (Postman implicitly defaults to header; SDKs were previously selecting the wrong scheme from the spec)
• Postman-collection-derived SDKs no longer expose Accept and Content-Type as method parameters; both are transport-layer headers managed by the SDK itself, and exposing them (especially Postman's default Accept: application/json) caused 406 NotAcceptable errors against endpoints with different declared response types
• OpenAPI specs that declare Accept or Content-Type as header parameters no longer surface them as method parameters, bringing the generator into compliance with OpenAPI 3.0 §4.7.12.1
• Response content type is now correctly inferred from Postman saved-response examples instead of hard-coded to application/json; JSON examples with unparseable bodies (e.g. placeholder strings) are downgraded to text/plain to match postman2openapi's inference
• Postman collections with leftover Content-Type: application/json headers on multipart and urlencoded requests (common on image uploads and form submissions) now generate SDKs that send the correct content type; the generator now follows body.mode instead of request-level headers for these cases
• Postman collections with author-documented variable values (e.g. instance: 'instance (Instance name)', endpoint: 'https://api.example.com (Domain of your API)') now generate SDKs with correct URLs and method signatures; the postman-mapper strips trailing (description) annotations, drops self-referential placeholder values that would otherwise inline as constant URL segments instead of path parameters, and defensively coerces non-string variable values (numbers, booleans, null)

Security

• SDK name, package name, and version fields are now sanitized at ingestion to prevent template injection attacks; user-controlled identifiers interpolated into generated source code no longer risk enabling EJS escape sequences that could execute arbitrary code on downstream consumers
• Service and model names derived from OpenAPI specs (operation tags → service names, schema titles and $ref paths → model names) are now sanitized at the api-context layer to prevent injection attacks; word-boundary characters (space, dot, hyphen, underscore) are preserved so per-language naming strategies can still split tokens, while escape characters that could break out of generated literals are removed

Fixed

• Java SDK example snippets no longer crash when a collection has no non-deprecated methods
• Environment URLs with special characters are now safely escaped in generated code

Fixed

• Inline models with naming conflicts now disambiguate using ancestor context instead of numeric suffixes
• Duplicate structurally-identical models inferred from Postman V3 request examples are now collapsed into single canonical definitions
• Generated SDKs derived from Postman collections with unresolved variable placeholders in server URLs (e.g., https://{{subdomain}}.api.example.com) no longer fail during client initialization with URI parsing errors

Features

• Code snippets now include realistic example values that respect the field's OpenAPI format (e.g., ISO date strings, valid UUIDs, email addresses) (de335a9)

Bug Fixes

• Fixed service and operation mapping for OpenAPI v3 specs to maintain parity with v2-generated output (a75a29f)
• Fixed base URL variable substitution for OpenAPI v3 specs (7c8057a)

Spec changes

Your Java SDK has been generated for the first time from your spec.