SDK Updates: v1.0.0

[postman]

SDK updates

Added

• Generated .github/workflows/release.yml workflow for automated releases and PyPI publishing. Publishing is enabled by default; the release workflow's first step skips publishing—succeeding, not failing—when the PYPI_API_TOKEN repository secret is not set, and publishing.releaseBranch in the generate request selects the trigger branch
• Generated Python SDKs from GraphQL schemas now expose GraphQL root methods on the SDK class and async SDK class, enabling direct calls like sdk.my_graphql_query(variables) in addition to service-level access
• Added raw_graphql escape hatch to execute custom GraphQL queries directly against the GraphQL endpoint
• Generated Python SDKs now include the GraphQL variable and response models needed by root SDK methods, with proper imports on the SDK surface
• Python BaseModel now includes model_validate_partial() method for constructing model instances from recursive/pruned GraphQL response data without requiring all fields marked as required in the schema
• Generated Python SDKs from GraphQL schemas now properly serialize nested GraphQL input objects (e.g., filter parameters) in variable dictionaries
• Python-specific GraphQL SDK generation with name disambiguation for root field collisions
• Generated release.yml release workflows now publish by default and no longer expose the publishing.enabled request toggle; each workflow's first step skips publishing—succeeding, not failing—when its required registry secret (e.g. NPM_TOKEN, PYPI_API_TOKEN, Maven/GPG) is unset. Go and PHP need no registry secret and always publish (git tag + GitHub release).
• Generated SDKs now include class-level bearer token authorization for OAuth2 (authorizationCode, implicit, password flows) and OpenID Connect security schemes; callers supply a token once at client construction instead of attaching the Authorization header per request

Changed

• Generated release.yml release workflows now publish by default and no longer expose the publishing.enabled request toggle; each workflow's first step skips publishing—succeeding, not failing—when its required registry secret (e.g. NPM_TOKEN, PYPI_API_TOKEN, Maven/GPG) is unset. Go and PHP need no registry secret and always publish (git tag + GitHub release).

Fixed

• Generated Python SDKs now advertise Python >= 3.9 as the minimum required version, matching the pyproject.toml requirement
• Service methods no longer crash when the API returns a 200 with an empty or non-JSON body; the call now returns None instead of raising a Pydantic ValidationError or ApiError
• from typing import Any is now emitted in every generated model file, fixing NameError: name 'Any' is not defined in complex (oneOf/anyOf) and error models
• Spec property names that begin with an underscore (e.g. _id) are now sanitized to a valid Pydantic field name (the original key is preserved on the wire via the field alias), fixing the "Fields must not use names with leading underscores" import error
• Generated models now validate Field(pattern=...) with Python's re engine instead of the default Rust engine, so patterns using look-ahead no longer crash model import with a regex parse error
• Generated model files now unconditionally include from __future__ import annotations, enabling deferred evaluation of forward references in field annotations, so models with nested or cross-referenced types no longer raise NameError: name <Model> is not defined at import time
• Request bodies with custom (non-JSON/text/binary) content types are now typed Any instead of the lowercase any, which resolved to the builtin any() and crashed @cast_models with TypeError: any() takes no keyword arguments
• Enums declared as integer/number but whose values aren't actually numeric (e.g. ["1 - All", "2 - None"]) now generate a str enum instead of crashing at import with ValueError: invalid literal for int()
• Enum members whose distinct values normalise to the same key (e.g. YYYY.MM.DD and YYYYMMDD) are now disambiguated instead of crashing with TypeError: Attempted to reuse key
• Raw binary request bodies (e.g. application/octet-stream, file uploads) are now sent as raw data instead of being routed through json=, which crashed with TypeError: Object of type bytes is not JSON serializable
• Field validation no longer crashes with TypeError: Subscripted generics cannot be used with class and instance checks when a field type is a subscripted generic (e.g. List[str], Dict[str, int]); the runtime origin type is used for the isinstance check
• GraphQL operation response models now include only the fields selected in the query, preventing deserialization failures when SDKs deserialize partial GraphQL responses that omit unrequested fields
• Path parameters embedded within URL segments (OData-style routes like companies({{companyId}})) are now correctly extracted and made available to generated SDK methods
• API key authentication now properly resolves collection variables in header names and falls back to Authorization when the resolved name is invalid, preventing Headers.append runtime errors in generated SDKs
• Server URLs with doubled schemes (e.g., https://protocol://server/api/version from unresolved Postman variables) now parse correctly; the real base path is recoverable and requests route to the correct endpoint

Added

• Generated .github/workflows/release.yml workflow for automated releases and PyPI publishing (controlled by publishing.enabled and publishing.releaseBranch in the generate request)

Changed

• Server URL normalization now handles prose-bearing values from OpenAPI specs and Postman collections, extracting the first valid https?:// URL token and falling back gracefully when no URL can be found

Fixed

• PyPI publish step in generated release workflow now includes skip-existing: true to allow re-running workflows without failure
• typing.Any-typed fields no longer raise TypeError at runtime during validation
• Generated SDKs now construct cleanly when server URLs contain prose (like "POST https://api.example.com"), malformed values fall back to a placeholder, and relative paths and non-HTTP schemes like grpc:// are preserved
• IPv6 host URLs are automatically bracketed per RFC 3986 (e.g., https://[2001:db8::1]/v1) to prevent validation errors; colon-heavy authorities that are not valid IPv6 literals now fall back to a placeholder instead of producing an Invalid IPv6 URL error
• Requests to operations without a request body no longer send an empty JSON payload with a Content-Type: application/json header, so strict servers no longer reject them with HTTP 415
• Pattern validation using regex fields now works reliably; patterns with Python-incompatible constructs (look-behind, atomic groups, possessive quantifiers, conditional groups, Unicode escapes, named backreferences) are safely translated or skipped instead of crashing at schema load
• Pattern validation in Pydantic fields now respects backslash escapes correctly in raw strings

Changed

• Model exports in models/__init__.py now use PEP 562 __getattr__ for lazy loading; classes are imported on first access and cached rather than eagerly loaded at module-import time, significantly reducing startup time for SDKs with large model counts
• Generated registries for lazy model loading are now deduplicated to avoid duplicate dict key warnings in consumer codebases

Fixed

• Forward reference resolution in Pydantic models with circular dependencies now works correctly; model_rebuild() is batched across all eligible BaseModels after all models are loaded into the module namespace
• ApiError now properly displays the HTTP status code and message when converted to a string or printed in tracebacks (previously showed only the class path)
• API key snippets no longer override the api_key_header parameter with a placeholder value; the SDK's default header name from the spec is now used
• Snippet code for isAnySchema parameters no longer crashes with NameError: name 'Any' is not defined and now honors spec-provided examples
• Parameters typed Any no longer crash at runtime with TypeError: typing.Any cannot be used with isinstance()
• Imports no longer fail with ImportError: cannot import name 'Any' from <sdk>.models
• Environment URLs with missing hosts (e.g., https:///) no longer raise ValueError at SDK import time
• File-upload snippets no longer crash with FileNotFoundError for missing test fixtures
• Enum member names with leading/trailing underscores (e.g., _FOO_) are now properly sanitized
• Property names that collapse to a single underscore after non-ASCII character removal are now renamed to avoid Pydantic validation errors

Added

• GraphQL schema mapper now translates GraphQL Query and Mutation root fields into ApiContext service methods with kind: 'graphql', mapping field arguments to variablesSchema and return types to both responseDataSchema and GraphQL-aware responseEnvelopeSchema for downstream generators
• Shared GraphQL schema type mapper for translating GraphQL schema types (objects, input objects, enums, scalars) into generator-friendly internal structures (Models, Schemas, EnumModels), with conservative fallback behavior for unsupported constructs (interfaces, unions)
• GraphQL scalar mapping strategy now translates built-in GraphQL scalars (ID, String, Int, Float, Boolean) and the common Upload extension scalar into shared schema types, with custom scalars conservatively mapping to ANY while preserving original names in typeDefinition for downstream specialization
• GraphQL endpoint transport normalization utility now resolves GraphQL base URLs and endpoints into the standard SDK environment model, supporting absolute URLs, relative paths, and default endpoint inference while maintaining compatibility with per-language transport implementations
• API key authentication helper now resolves both parameter name and location from security schemes, enabling language generators to route credentials to headers, query parameters, or cookies as declared in the spec
• Schema-derived GraphQL services are now grouped deterministically by root operation type (Query and Mutation), ensuring stable SDK surfaces across regenerations even when the schema defines custom root type names
• Generated SDKs with GraphQL operations now emit operation-based snippet representations alongside the existing endpoint-based snippets, allowing richer documentation for schemas where multiple operations share the same transport endpoint

Fixed

• GET and HEAD operations no longer carry request bodies, eliminating spurious 415 Unsupported Media Type errors when Postman collections have bodies attached to these methods (the spec-derived SDKs now correctly surface GET/HEAD as bodyless across all languages)
• OpenAPI specs with path-style internal $ref (e.g., #/paths/~1api~1v2~1warehouses/get/responses/202) now resolve correctly instead of throwing invalid reference errors
• The sdkConfig.inferServiceNames: false option now prevents service fragmentation; when disabled, all requests collapse into a single root service named after sdkName, restoring the flat client surface for collections converted from OpenAPI specs
• Generated SDKs now use the correct apikey header name when generated from Postman collections with omitted in field (Postman implicitly defaults to header; SDKs were previously selecting the wrong scheme from the spec)
• Postman-collection-derived SDKs no longer expose Accept and Content-Type as method parameters; both are transport-layer headers managed by the SDK itself, and exposing them (especially Postman's default Accept: application/json) caused 406 NotAcceptable errors against endpoints with different declared response types
• OpenAPI specs that declare Accept or Content-Type as header parameters no longer surface them as method parameters, bringing the generator into compliance with OpenAPI 3.0 §4.7.12.1
• Response content type is now correctly inferred from Postman saved-response examples instead of hard-coded to application/json; JSON examples with unparseable bodies (e.g. placeholder strings) are downgraded to text/plain to match postman2openapi's inference
• Postman collections with leftover Content-Type: application/json headers on multipart and urlencoded requests (common on image uploads and form submissions) now generate SDKs that send the correct content type; the generator now follows body.mode instead of request-level headers for these cases
• Postman collections with author-documented variable values (e.g. instance: 'instance (Instance name)', endpoint: 'https://api.example.com (Domain of your API)') now generate SDKs with correct URLs and method signatures; the postman-mapper strips trailing (description) annotations, drops self-referential placeholder values that would otherwise inline as constant URL segments instead of path parameters, and defensively coerces non-string variable values (numbers, booleans, null)

Security

• SDK name, package name, and version fields are now sanitized at ingestion to prevent template injection attacks; user-controlled identifiers interpolated into generated source code no longer risk enabling EJS escape sequences that could execute arbitrary code on downstream consumers
• Service and model names derived from OpenAPI specs (operation tags → service names, schema titles and $ref paths → model names) are now sanitized at the api-context layer to prevent injection attacks; word-boundary characters (space, dot, hyphen, underscore) are preserved so per-language naming strategies can still split tokens, while escape characters that could break out of generated literals are removed
• Free-text SDK metadata fields (homepage, author name/email) are now sanitized at the config ingestion chokepoint to prevent template injection through generated build manifests; literal break-out characters (quotes, backticks, braces, angle-brackets, backslash) are stripped while ordinary prose (URLs, descriptive sentences, names with punctuation) is preserved

Fixed

• Models and oneOf/anyOf unions whose names collide with Pydantic symbols (Field, TypeAdapter), typing constructs (Optional, Union, List, Any, Annotated, TYPE_CHECKING), enum.Enum, or local SDK utilities (BaseModel, BaseError) are now disambiguated with a numeric suffix (e.g., Field1, List2), preventing import shadowing that would crash SDKs at class-definition time
• Regex patterns containing literal double-quote characters in validators are now properly escaped, resolving Black formatter crashes when processing schemas like certain Identifier patterns
• Generated service methods that collide with BaseService auth helpers and instance attributes are now suffixed with an underscore to prevent shadowing
• Models with List[Any] or Dict[str, Any] properties now correctly import typing.Any, fixing import errors that made SDKs unusable
• Models with Any type fields now correctly import typing.Any, even when those fields live on deeply-nested submodels
• Models that reference error-response schemas as fields now correctly use the Pydantic data class variant, preventing PydanticSchemaGenerationError at import time
• Error-response models within oneOf and anyOf unions now correctly emit the data class variant
• Complex model dependencies are no longer discarded when recursively imported

Added

• GraphQL schema mapper now translates GraphQL Query and Mutation root fields into ApiContext service methods with kind: 'graphql', mapping field arguments to variablesSchema and return types to both responseDataSchema and GraphQL-aware responseEnvelopeSchema for downstream generators
• Shared GraphQL schema type mapper for translating GraphQL schema types (objects, input objects, enums, scalars) into generator-friendly internal structures (Models, Schemas, EnumModels), with conservative fallback behavior for unsupported constructs (interfaces, unions)
• API key authentication helper now resolves both parameter name and location from security schemes, enabling language generators to route credentials to headers, query parameters, or cookies as declared in the spec

Fixed

• OpenAPI specs with path-style internal $ref (e.g., #/paths/~1api~1v2~1warehouses/get/responses/202) now resolve correctly instead of throwing invalid reference errors
• The sdkConfig.inferServiceNames: false option now prevents service fragmentation; when disabled, all requests collapse into a single root service named after sdkName, restoring the flat client surface for collections converted from OpenAPI specs
• Generated SDKs now use the correct apikey header name when generated from Postman collections with omitted in field (Postman implicitly defaults to header; SDKs were previously selecting the wrong scheme from the spec)
• Postman-collection-derived SDKs no longer expose Accept and Content-Type as method parameters; both are transport-layer headers managed by the SDK itself, and exposing them (especially Postman's default Accept: application/json) caused 406 NotAcceptable errors against endpoints with different declared response types
• OpenAPI specs that declare Accept or Content-Type as header parameters no longer surface them as method parameters, bringing the generator into compliance with OpenAPI 3.0 §4.7.12.1
• Response content type is now correctly inferred from Postman saved-response examples instead of hard-coded to application/json; JSON examples with unparseable bodies (e.g. placeholder strings) are downgraded to text/plain to match postman2openapi's inference
• Postman collections with leftover Content-Type: application/json headers on multipart and urlencoded requests (common on image uploads and form submissions) now generate SDKs that send the correct content type; the generator now follows body.mode instead of request-level headers for these cases
• Postman collections with author-documented variable values (e.g. instance: 'instance (Instance name)', endpoint: 'https://api.example.com (Domain of your API)') now generate SDKs with correct URLs and method signatures; the postman-mapper strips trailing (description) annotations, drops self-referential placeholder values that would otherwise inline as constant URL segments instead of path parameters, and defensively coerces non-string variable values (numbers, booleans, null)

Security

• SDK name, package name, and version fields are now sanitized at ingestion to prevent template injection attacks; user-controlled identifiers interpolated into generated source code no longer risk enabling EJS escape sequences that could execute arbitrary code on downstream consumers
• Service and model names derived from OpenAPI specs (operation tags → service names, schema titles and $ref paths → model names) are now sanitized at the api-context layer to prevent injection attacks; word-boundary characters (space, dot, hyphen, underscore) are preserved so per-language naming strategies can still split tokens, while escape characters that could break out of generated literals are removed

Fixed

• Environment URLs with special characters are now safely escaped in generated code

Fixed

• Inline models with naming conflicts now disambiguate using ancestor context instead of numeric suffixes
• Duplicate structurally-identical models inferred from Postman V3 request examples are now collapsed into single canonical definitions
• Generated SDKs derived from Postman collections with unresolved variable placeholders in server URLs (e.g., https://{{subdomain}}.api.example.com) no longer fail during client initialization with URI parsing errors

Features

• Code snippets now include realistic example values that respect the field's OpenAPI format (e.g., ISO date strings, valid UUIDs, email addresses) (de335a9)

Bug Fixes

• Fixed service and operation mapping for OpenAPI v3 specs to maintain parity with v2-generated output (a75a29f)
• Fixed base URL variable substitution for OpenAPI v3 specs (7c8057a)

Spec changes

Your Python SDK has been generated for the first time from your spec.