Fix security.txt API field name docs#28139
Merged
caley-b merged 1 commit intoproductionfrom Feb 13, 2026
Merged
Conversation
Co-authored-by: elithrar <elithrar@users.noreply.github.com>
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
Contributor
|
Preview URL: https://1495c70d.preview.developers.cloudflare.com Files with changes (up to 15) |
Collaborator
|
@KaydeeDee see the notes here. Stainless is generating an incorrect schema. |
caley-b
approved these changes
Feb 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Here's a summary of the investigation and fix:
Analysis
Validation against RFC 9116
The security.txt specification (RFC 9116, Section 2.5.8) defines the field as
Preferred-Languages(hyphenated). This is the field name used in the actual.well-known/security.txtfile format. For the JSON API representation, Cloudflare's API uses snake_case convention.Validation against the actual API endpoint
The issue reporter's curl response confirms the API returns
preferred_languages(snake_case):What's wrong in the current docs
The auto-generated API reference at
/api/resources/security_txt/showspreferredLanguages(camelCase) in both the GET response and PUT request examples. This comes from the OpenAPI schema in the externalcloudflare/api-schemasrepo (commitf472d1636b1d5956c87cd02cfed0cf3e37b9a39f), which defines the property aspreferredLanguages. The latest commit (2548aabddafdfd002db9789ca16b6b2c7502daba, Feb 3 2026) still has this bug.What was fixed
The API reference pages are auto-generated from the external
cloudflare/api-schemasrepository and cannot be corrected in this docs repo (no local override mechanism exists). The root fix needs to happen incloudflare/api-schemasby renamingpreferredLanguagestopreferred_languagesin thesecurity-center_securityTxtschema.What I did fix in this PR:
src/content/docs/security-center/infrastructure/security-file.mdxdocumenting that the correct API field name ispreferred_languages(snake_case)The upstream OpenAPI schema fix in
cloudflare/api-schemasshould be filed separately to correct the auto-generated API reference.Closes #27994
github run