Python

The following section covers the Python framework and library components that NightVision Source Intelligence can detect and use to generate OpenAPI documentation. If a component that you use is not supported, please get in touch with our support team at support@nightviz.ai, and we can add this as a new feature.

Django

Library Component	Description
django.http.QueryDict	In Django, GET or POST parameters can be accessed using the `QueryDict` class, which is a dictionary-like object containing the query parameters.
django.HttpRequest	Represents an HTTP request, including methods and data sent by the client.
django.urls.resolvers.RoutePattern	Represents a route pattern used for URL routing.
django.conf.settings	Represents Django’s settings configuration.
django.conf.urls.url()	Function to define a URL pattern in Django.
django.conf.urls.include()	Function to include other URL patterns from a different module or app.
django.urls.path()	Function to define URL patterns with routing based on paths.
django.urls.include()	Function to include other URL configurations in your Django project.
django.urls.re_path()	Function to define complex URL patterns using regular expressions.
django.views.generic.View	A base class for all class-based views in Django.

DRF (Django REST framework)

Library Component	Description
rest_framework.generics.GenericAPIView	A base class for all generic views in DRF, providing common functionality.
rest_framework.generics.CreateAPIView	Provides a view that handles HTTP POST requests to create a new object.
rest_framework.generics.DestroyAPIView	Provides a view that handles HTTP DELETE requests to delete an object.
rest_framework.generics.ListAPIView	Provides a view that handles HTTP GET requests to list objects.
rest_framework.generics.ListCreateAPIView	Provides a view that handles both HTTP GET (list) and POST (create) requests.
rest_framework.generics.RetrieveAPIView	Provides a view that handles HTTP GET requests to retrieve a single object.
rest_framework.generics.RetrieveDestroyAPIView	Provides a view that handles HTTP GET (retrieve) and DELETE (destroy) requests.
rest_framework.generics.RetrieveUpdateAPIView	Provides a view that handles HTTP GET (retrieve), PUT (update), and PATCH (partial update) requests.
rest_framework.generics.RetrieveUpdateDestroyAPIView	Provides a view that handles HTTP GET, PUT, PATCH, and DELETE requests for a single object.
rest_framework.generics.UpdateAPIView	Provides a view that handles HTTP PUT and PATCH requests to update an object.
rest_framework.mixins.Mixin	A base class for mixins in DRF.
rest_framework.mixins.CreateModelMixin	Provides create behavior for DRF views.
rest_framework.mixins.DestroyModelMixin	Provides destroy behavior for DRF views.
rest_framework.mixins.ListModelMixin	Provides list behavior for DRF views.
rest_framework.mixins.RetrieveModelMixin	Provides retrieve behavior for DRF views.
rest_framework.mixins.UpdateModelMixin	Provides update and partial_update behavior for DRF views.
rest_framework.serializers.Field	The base class for all DRF serializer fields.
rest_framework.serializers.Serializer	The base class for defining custom serializers in DRF.
rest_framework.views.APIView	The base class for all DRF views, handling the HTTP protocol and dispatching to appropriate methods.
rest_framework.viewsets.ViewSet	A viewset whose HTTP methods are bound to named actions by a router or as_view() mapping.
rest_framework.viewsets.ViewSetMixin	The base routing behavior used by custom viewset classes.
rest_framework.viewsets.GenericViewSet	A base class for all DRF viewsets, providing default implementations for actions.
rest_framework.viewsets.ModelViewSet	A viewset that provides default CRUD (Create, Retrieve, Update, Delete) operations.
rest_framework.viewsets.ReadOnlyModelViewSet	A viewset that provides default read-only operations (Retrieve, List).

DRF extensions (https://chibisov.github.io/drf-extensions/docs)

Library Component	Description
rest_framework_extensions.routers.ExtendedDefaultRouter	An extended version of DRF’s DefaultRouter, providing additional functionality.
rest_framework_extensions.routers.ExtendedSimpleRouter	An extended version of DRF’s SimpleRouter, providing additional functionality.

Flask

Library Component	Description
flask.request request.args request.cookies request.files request.form request.headers	A global object representing the incoming request data.
flask.Flask	The central object of a Flask application, representing the web application.
flask.Blueprint	Class that provides a way to organize Flask applications by grouping related routes and views.
flask.views.MethodView	A class-based view that dispatches request methods (GET, POST, etc.) to appropriate handlers.
flask.views.RouteCallable	Represents a callable route in Flask views
flask.views.View	The base class for creating class-based views in Flask.

Flask-RESTful

Library Component	Description
flask_restful.Api	The central class for creating a Flask-RESTful API.
flask_restful.Resource	Represents a REST resource in Flask-RESTful, with methods corresponding to HTTP verbs (GET, POST, etc.)

FastAPI

Library Component	Description
fastapi.FastAPI	The central object of a FastAPI app, representing the web application.
fastapi.APIRouter	The entity used to organize routes into reusable modular groups
pydantic.BaseModel	A base class for models used as inputs/outputs of FastAPI app’s routes
fastapi.Response	A base response class used for manually contructing the response in a route handler
fastapi.HTTPException	An exception class used to signal errors in route handlers
fastapi.Header, fastapi.Cookie	Typing annotations used to indicate expected input data for route handlers
fastapi.status	A module that stores all the HTTP codes used as status codes in route handlers

Starlette

NightVision follows Starlette route tables through Starlette and Router, including nested Route, Mount, and Host entries. It recognizes constructor route lists and routes added with route, add_route, mount, and host, including mounted ASGI applications whose internal routes cannot be resolved. Function handlers and HTTPEndpoint classes are interpreted for parameters, responses, security, and sink hints.

WebSocket routes are recognized as routing objects but are not emitted as OpenAPI HTTP operations.

Connexion

NightVision supports Connexion 2.x and 3.x applications created with App, FlaskApp, or AsyncApp. It reads OpenAPI 3 and Swagger 2 documents passed to add_api, applies document and call-site base paths, and resolves handlers from explicit operationId values, x-openapi-router-controller / x-swagger-router-controller, and RestyResolver conventions.

The source handler is still analyzed after the specification supplies the route, parameters, request body, responses, and security requirements. This lets the generated operation include reachable sink hints and source metadata while preserving the contract Connexion actually serves.

Authentication and security schemes

NightVision reads authentication guards on Python routes and records them as OpenAPI security schemes. See the Framework Support Index for how schemes, the x-roles extension, and the x-unsound marker are represented.

FastAPI

FastAPI security classes wired through Depends() or Security() (as an Annotated dependency, a default parameter value, or a route/router dependencies=[...] list) are read directly from their constructor arguments:

Library Component	OpenAPI Security Scheme
fastapi.security.HTTPBearer	HTTP bearer
fastapi.security.HTTPBasic	HTTP basic
fastapi.security.HTTPDigest	HTTP digest
fastapi.security.APIKeyHeader / APIKeyQuery / APIKeyCookie	API key in a header, query parameter, or cookie (name read from the constructor)
fastapi.security.OAuth2PasswordBearer, OAuth2AuthorizationCodeBearer, OAuth2	OAuth2 (flow and scopes catalog read from the constructor)
fastapi.security.OpenIdConnect	OpenID Connect
fastapi.Security(dependency, scopes=[...])	Carries the required OAuth2 scopes onto the operation’s requirement

A hand-rolled dependency function is also recognized heuristically (and flagged x-unsound) when it reads a credential (Header()/Cookie() or an auth-named parameter) and raises HTTPException(401)/HTTPException(403).

Flask

Recognized by resolved import identity (a decorator, or an entry in a View/MethodView decorators = [...] list):

Library Component	OpenAPI Security Scheme
flask_login.login_required	Session cookie
flask_jwt_extended.jwt_required	HTTP bearer (JWT)
flask_httpauth.HTTPBasicAuth / HTTPTokenAuth / HTTPDigestAuth (@auth.login_required)	HTTP basic; HTTP bearer, or API key in a header for a custom header=; HTTP digest
flask_security.auth_required ("token", "session", "basic")	HTTP bearer, session cookie, HTTP basic
flask_praetorian.auth_required / roles_required	HTTP bearer (JWT); roles_required role names are emitted as x-roles

A hand-rolled @app.before_request / @blueprint.before_request hook is recognized heuristically (and flagged x-unsound) when it reads a credential and issues a 401/403 challenge; blueprint hooks are scoped to their blueprint.

Django

Django REST Framework authentication_classes (class-level or view-level) are resolved to their scheme, unchanged by this release apart from being routed through the shared security helper.

Role names other than OAuth2 scopes are emitted as the x-roles extension. Heuristic derivations - custom FastAPI dependencies, hand-rolled Flask before_request hooks, a flask_httpauth token scheme with a non-standard scheme name, and stacked guards modeled as alternatives - are flagged x-unsound.

DAST sink hints

Python operations from Django and Django REST Framework, Flask and Flask-RESTful, FastAPI, Starlette, and Connexion can carry x-nv-dast-sinks. In addition to the shared SQL, process, request, redirect, template, dynamic-code, and upload classes, Python recognizes modeled calls to the OpenAI, Anthropic, and LangChain SDKs as llm-query, with llm-tool-call when tools are registered. See DAST sink hints for the vocabulary and interpretation.