open-webui/backend/open_webui/utils
Classic298 1932ca649e
fix: stop sending OpenAPI tool server path and query parameters in the request body (#29717)
Tool calls to an OpenAPI tool server put every argument the model returned into the JSON request body, including the parameters that were already substituted into the URL. Servers that validate their input strictly (additionalProperties: false) answered 422 "unexpected property", so reads worked and every write through an endpoint with a path or query parameter failed.

The body is now built from the model's arguments minus the operation's declared parameters, keeping any name the requestBody schema declares as a property of its own, so an endpoint that wants the resource id in the body as well as in the path still gets it.

The filter only runs when the resolved body schema lists its properties. A free-form, composed or non-JSON body offers nothing to check a name against, so those requests go out exactly as before.

src/lib/apis/index.ts carries the same request builder for direct tool server connections and had the same bug, so it gets the same fix.

Fixes #29716
2026-09-06 17:01:26 -04:00
..
access_control fix: keep folder parent references acyclic (#28748) 2026-08-24 17:06:19 -04:00
images perf: build debug log messages lazily so disabled debug logs cost nothing (#27834) 2026-07-31 19:09:01 -05:00
mcp refac 2026-06-29 11:56:00 -05:00
telemetry refac(telemetry): drop deprecated semconv SpanAttributes subclass (#25784) 2026-06-29 02:05:34 -05:00
actions.py fix: enforce action availability and model access on the chat action route (#27243) 2026-07-23 12:23:05 -04:00
anthropic.py perf: stop re-parsing the whole tool-argument buffer on every streamed chunk (#28858) 2026-08-31 01:18:05 -04:00
asgi_middleware.py refac 2026-08-24 18:29:36 -04:00
ask_user.py fix: a rejected ask_user call ending the turn with no reply (#29252) 2026-08-31 00:17:21 -04:00
audit.py perf: build debug log messages lazily so disabled debug logs cost nothing (#27834) 2026-07-31 19:09:01 -05:00
auth.py fix: revoke existing sessions when a password changes (#28725) 2026-08-17 13:56:29 -07:00
automations.py refac 2026-08-31 01:06:15 -04:00
calendar.py refac 2026-08-29 16:14:32 -04:00
channels.py refac 2026-03-17 17:58:01 -05:00
chat.py fix: surface upstream errors on arena models instead of crashing (#29662) 2026-09-04 17:17:02 -04:00
chat_fork.py refac 2026-07-23 02:54:56 -04:00
chat_id.py refac 2026-07-26 21:12:14 -04:00
chat_variables.py perf: stabilize the model registry signature across workers (#29264) 2026-08-30 16:12:31 -04:00
code_interpreter.py refac 2026-07-31 17:41:14 -04:00
context_compaction.py refac 2026-08-23 13:36:53 -04:00
embeddings.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
files.py refac 2026-08-31 00:11:13 -04:00
filter.py refac 2026-08-31 01:29:36 -04:00
groups.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
headers.py refac 2026-08-24 18:38:29 -04:00
json_codec.py perf: write task payloads to Redis as bytes (#28833) 2026-08-20 12:58:52 -07:00
json_response.py perf: optional orjson JSON codec behind ENABLE_ORJSON (#27583) 2026-07-27 03:45:37 -04:00
logger.py perf: stop formatting every exported log record twice under OTEL log export (#27840) 2026-08-10 23:13:52 -06:00
memory.py refac 2026-08-10 19:28:21 -06:00
middleware.py fix: normalize a tool call name sent as null (#29690) 2026-09-06 17:00:03 -04:00
misc.py refac 2026-08-31 00:39:16 -04:00
model_ids.py refac 2026-07-26 23:09:22 -04:00
models.py refac 2026-08-31 00:53:55 -04:00
notifications.py refac 2026-07-27 19:39:36 -04:00
oauth.py chore: keep OAuth token payloads out of logs (#29709) 2026-09-06 16:19:23 -04:00
payload.py refac 2026-08-16 22:56:19 -07:00
pdf_generator.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
plugin.py perf: build info log messages lazily so raising the log level actually saves work (#27837) 2026-08-02 15:39:10 -05:00
rate_limit.py refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
redis.py fix: Set default Redis socket timeout to None (#27104) 2026-07-27 00:30:00 -04:00
response.py refac 2026-08-17 00:57:57 -07:00
sanitize.py refac 2026-03-17 17:58:01 -05:00
security_headers.py refac 2026-08-24 18:29:36 -04:00
session_pool.py fix: long streamed lines no longer abort the response (#28114) 2026-08-25 12:16:37 -04:00
subagents.py chore: format 2026-08-25 16:53:53 -04:00
task.py refac 2026-06-19 00:16:06 +02:00
terminals.py refac 2026-08-19 22:48:32 -07:00
timers.py fix: index the chat queries that make large SQLite instances unusable (#27663) 2026-08-23 16:11:54 -05:00
tool_approval.py chore: format 2026-08-25 16:53:53 -04:00
tools.py fix: stop sending OpenAPI tool server path and query parameters in the request body (#29717) 2026-09-06 17:01:26 -04:00
validate.py refac 2026-07-27 19:39:36 -04:00
valves.py refac 2026-07-31 17:41:14 -04:00
webhook.py perf: build debug log messages lazily so disabled debug logs cost nothing (#27834) 2026-07-31 19:09:01 -05:00