Java

The following section covers the components of Java frameworks and their library components that NightVision’s API Discovery capability can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please get in touch with our support team at support@nightviz.ai, and we can add this as a new feature.

Java EE / Jakarta EE

javax.annotation / jakarta.annotation

Library Component	Description
Generated (Java EE/Jakarta EE)	Used to mark source code that has been generated.
security.DenyAll (Java EE /Jakarta EE)	Specifies that no security roles are allowed to access the endpoint
security.PermitAll (Java EE /Jakarta EE)	Specifies that all security roles are allowed to access the endpoint
security.RolesAllowed (Java EE /Jakarta EE)	Specifies the list of security roles permitted to access endpoint

javax.servlet.http / jakarta.servlet.http

Library Component	Description
HttpServletRequest Java EE/Jakarta EE	Provides request information for HTTP servlets
HttpServletResponse Java EE /Jakarta EE	Provides response information for HTTP servlets

JAX-RS / Jersey

javax.ws.rs.core

Library Component	Description
MediaType	An abstraction for a media type
Context	Used to inject information into a class field, bean property or method parameter.

javax.ws.rs

Library Component	Description
GET	Indicates that the annotated method responds to HTTP GET requests.
POST	Indicates that the annotated method responds to HTTP POST requests.
PUT	Indicates that the annotated method responds to HTTP PUT requests.
DELETE	Indicates that the annotated method responds to HTTP DELETE requests.
HEAD	Indicates that the annotated method responds to HTTP HEAD requests.
OPTIONS	Indicates that the annotated method responds to HTTP OPTIONS requests.
ApplicationPath	Identifies the application path that serves as the base URI for all resource URIs provided by Path. May only be applied to a subclass of Application.
Path	Identifies the URI path that a resource class or class method will serve requests for.
PathParam	Binds the value of a URI template parameter or a path segment containing the template parameter to a resource method parameter, resource class field, or resource class bean property.
QueryParam	Binds the value(s) of a HTTP query parameter to a resource method parameter, resource class field, or resource class bean property.
FormParam	Binds the value(s) of a form parameter contained within a request entity body to a resource method parameter.
HttpMethod	Associates the name of a HTTP method with an annotation.

Spring Boot

NightVision supports the annotations below for classes, interfaces, methods and parameters.

org.springframework.stereotype

Library Component	Description
Controller	Indicates that an annotated class is a “Controller” (e.g. a web controller).

org.springframework.web.bind.annotation

Library Component	Description
RequestMapping	Annotation for mapping web requests onto methods in request-handling classes with flexible method signatures.
RestController	A convenience annotation that is itself annotated with @Controller and @ResponseBody.
ResponseBody	Annotation that indicates a method return value should be bound to the web response body. Supported for annotated handler methods.
DeleteMapping	Annotation for mapping HTTP DELETE requests onto specific handler methods.
GetMapping	Annotation for mapping HTTP GET requests onto specific handler methods.
PatchMapping	Annotation for mapping HTTP PATCH requests onto specific handler methods.
PostMapping	Annotation for mapping HTTP POST requests onto specific handler methods.
PutMapping	Annotation for mapping HTTP PUT requests onto specific handler methods.
PathVariable	Annotation which indicates that a method parameter should be bound to a URI template variable. Supported for RequestMapping annotated handler methods.

org.springframework.data.rest.core.annotation

Library Component	Description
RepositoryRestResource	Annotation marking a repository class to autogenerate routes and handlers for CRUD operations over that repository
RestResource	Annotation marking a Repository to influence how it is exported and what the routes will be links.

Micronaut

io.micronaut.http

Library Component	Description
HttpHeaders	Constants for common HTTP headers
HttpHeaders.accept	Return a list of accepted MediaType instances
HttpHeaders.contentType	Get the request or response content type
HttpHeaders.getAuthorization	Get the Authorization header
HttpHeaders.getContentType	Get the Content-Type header
HttpHeaders.getOrigin	Get the Origin header
HttpMethod	Enum containing the valid HTTP methods
HttpParameters	Represents HTTP query parameters parsed from the request URI
HttpRequest	Interface to access HTTP request properties
HttpRequest.getHeaders	Get the HttpHeaders object for the request
HttpRequest.getParameters	Get the HTTP parameters from the URI query string
HttpResponse	Interface to access HTTP response properties and set response status codes
HttpStatus	Represents HTTP status codes
MediaType	Represents a media type

io.micronaut.http.annotation

Library Component	Description
Body	Indicates that the method argument is bound from the HTTP body
Consumes	Indicates the MediaTypes consumed by a particular component
Controller	Indicates that the role of a class is a controller within an application
CookieValue	Indicates that the method argument is bound from an HTTP cookie
CustomHttpMethod	Indicates that the method receives a request with a non-standard method
Delete	Indicates that the method receives a DELETE request
Error	Maps a method to an error route
Get	Indicates that the method receives a GET request
Head	Indicates that the method receives a HEAD request
Header	Indicates that the method argument is bound from an HTTP header
Options	Indicates that the method receives an OPTIONS request
Part	Indicates that the method argument is bound from a specific part of a “multipart/form-data” request
Patch	Indicates that the method receives a PATCH request
PathVariable	Binds a parameter exclusively from a path variable
Post	Indicates that the method receives a POST request
Produces	Indicates the MediaTypes produced by a particular component
Put	Indicates that the method receives a PUT request
QueryValue	Binds a method parameter to a value in the query string or path of the URI
RequestAttribute	Indicates that a method argument is bound to an HTTP request attribute
RequestBean	Used to bind Bindable parameters to a Bean object
Status	Sets alternative HttpStatus response code when applied to a method
Trace	Indicates that the method receives a TRACE request

io.micronaut.security

Library Component	Description
annotation.Secured	Secures a class or method according to the given security rules
rules.SecurityRule	Informs the SecurityFilter filter what to do with the given request

Authentication and security schemes

NightVision reads authentication and authorization guards on Java routes and records them as OpenAPI security schemes. See the Framework Support Index for how schemes, the x-roles extension, and the x-unsound marker are represented.

Spring Security

The HttpSecurity DSL is interpreted to derive both the per-route authorization rules and the security scheme(s) the filter chain enforces.

DSL method	Effect
authorizeHttpRequests, authorizeRequests	Open an authorization rule block; authorizeHttpRequests also applies deny-by-default to unmatched routes
antMatchers, requestMatchers, mvcMatchers	Scope a rule to path patterns (and optionally an HTTP method)
anyRequest	Apply the terminal rule to every route not matched by an earlier rule
authenticated, fullyAuthenticated	Require authentication
permitAll	Allow anonymous access
denyAll	No principal may access (modeled as authenticated-at-minimum)
hasRole, hasAnyRole	Require authentication with the named roles (mapped to the ROLE_ authority prefix)
hasAuthority, hasAnyAuthority	Require authentication with the named authorities (kept verbatim)
.access("...")	Interpret a SpEL authorization expression; expressions only partially modeled are flagged x-unsound
httpBasic, formLogin, oauth2Login, oauth2ResourceServer().jwt(), oauth2ResourceServer().opaqueToken()	Register the corresponding security scheme (see mapping below)
WebSecurity.ignoring().requestMatchers(...)	Bypass the filter chain entirely, leaving matching routes anonymous

Spring method security

Method-level annotations are honored only when method security is enabled by @EnableMethodSecurity or the legacy @EnableGlobalMethodSecurity on a configuration class; the prePostEnabled, securedEnabled, and jsr250Enabled flags gate each annotation family. When no enablement annotation is found in the scanned sources the annotations are still honored for recall, but the route is flagged x-unsound.

Annotation	Enablement flag	Notes
@PreAuthorize, @PostAuthorize	prePostEnabled (on by default)	SpEL expression parsed for roles and permissive (permitAll/isAnonymous) disjuncts
@Secured({"ROLE_X"})	securedEnabled	Values kept verbatim (no ROLE_ prefix added)
@RolesAllowed, @PermitAll, @DenyAll (JSR-250)	jsr250Enabled	Precedence within a scope: @DenyAll over @RolesAllowed over @PermitAll

JAX-RS

JSR-250 annotations on resource classes and methods are read directly (method scope overrides class scope):

Annotation	Effect
@RolesAllowed({...})	Require authentication, carrying the declared role names
@DenyAll	No principal may access
@PermitAll	Anonymous access

A ContainerRequestFilter that calls setSecurityContext(...) registers a representative scheme; when its body compares the Authorization header against a "Bearer"/"Basic" literal the transport is refined accordingly, otherwise HTTP basic (the servlet-container default challenge) is assumed and the route is flagged x-unsound.

Security scheme mapping

Mechanism	OpenAPI Security Scheme
httpBasic, JAX-RS container default	http, scheme basic
oauth2ResourceServer().jwt()	http, scheme bearer, bearerFormat JWT
oauth2Login, oauth2ResourceServer().opaqueToken()	oauth2
formLogin	apiKey in a cookie (JSESSIONID)

When one filter chain enforces several mechanisms, the primary scheme is chosen by specificity (JWT, then OAuth2, then Basic, then session). Role and authority names are emitted as the x-roles extension, except SCOPE_-prefixed authorities on an oauth2/openIdConnect scheme, which are carried (prefix stripped) as OAuth2 scopes on the requirement.