From d2fa57724a42bdfe8cfd25997f9acd246650433c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 28 Jun 2026 11:36:52 +0000
Subject: [PATCH] fix(asm): add missing 429 responses and document rate-limit
 headers

The spec description stated that X-RateLimit-Limit and X-RateLimit-Remaining
are returned on every response, but neither header was modelled anywhere and
only 2 of 13 endpoints declared a 429. This adds a reusable components/headers
block for those two headers, wires them into the RateLimited response component,
and adds the 429 ref to the 11 endpoints that were missing it so SDK generators
and the Redoc UI surface rate-limit behaviour consistently across all operations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016vt7EkXkUc1W7w79ox4oHE
---
 asm/openapi.yaml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/asm/openapi.yaml b/asm/openapi.yaml
index e59374d..aabbef3 100644
--- a/asm/openapi.yaml
+++ b/asm/openapi.yaml
@@ -125,6 +125,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
     patch:
       operationId: updateAsset
       summary: Update asset
@@ -151,6 +153,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
     delete:
       operationId: archiveAsset
       summary: Archive asset
@@ -167,6 +171,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
 
   /scans:
     get:
@@ -199,6 +205,8 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '429':
+          $ref: '#/components/responses/RateLimited'
     post:
       operationId: triggerScan
       summary: Trigger scan
@@ -255,6 +263,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
 
   /vulnerabilities:
     get:
@@ -308,6 +318,8 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '429':
+          $ref: '#/components/responses/RateLimited'
 
   /vulnerabilities/{vuln_id}:
     parameters:
@@ -336,6 +348,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
     patch:
       operationId: updateVulnerability
       summary: Update vulnerability
@@ -362,6 +376,8 @@ paths:
           $ref: '#/components/responses/Forbidden'
         '404':
           $ref: '#/components/responses/NotFound'
+        '429':
+          $ref: '#/components/responses/RateLimited'
 
   /tags:
     get:
@@ -385,6 +401,8 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '429':
+          $ref: '#/components/responses/RateLimited'
     post:
       operationId: createTag
       summary: Create tag
@@ -418,6 +436,8 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '429':
+          $ref: '#/components/responses/RateLimited'
 
   /tags/{tag_id}:
     parameters:
@@ -527,6 +547,18 @@ components:
         pattern: '^tag_[a-z0-9]{16}$'
       example: tag_0001aabbccdd0001
 
+  headers:
+    X-RateLimit-Limit:
+      description: Maximum number of requests allowed per minute for this API key
+      schema:
+        type: integer
+        example: 600
+    X-RateLimit-Remaining:
+      description: Number of requests remaining in the current one-minute window
+      schema:
+        type: integer
+        example: 542
+
   responses:
     Unauthorized:
       description: Missing or invalid API key
@@ -571,6 +603,10 @@ components:
           schema:
             type: integer
           description: Seconds until the rate limit window resets
+        X-RateLimit-Limit:
+          $ref: '#/components/headers/X-RateLimit-Limit'
+        X-RateLimit-Remaining:
+          $ref: '#/components/headers/X-RateLimit-Remaining'
       content:
         application/json:
           schema: