fix(users): declare userId path param on update-user and delete-user by ravihighlevel · Pull Request #356 · GoHighLevel/highlevel-api-docs

ravihighlevel · 2026-11-13T13:08:30Z

Summary

In both apps/users.json and apps/v3/users-v3.json, PUT and DELETE /users/{userId} use the {userId} placeholder but don't declare a matching in: path parameter. Code generators then build a call that needs an argument the input schema doesn't contain. This PR copies the userId parameter that get-user already declares to update-user and delete-user, in both files.

Refs #326. This covers only the users part of that issue; the other operations belong to other teams.

Source of truth

The same fix is already in the users service's spec in marketplace-backend (docs/public/users/users.json and users-v3.json). It hasn't reached this repo because the automated sync is failing. This PR publishes the userId fix by hand; the next working sync will overwrite these files with the full upstream spec.

Verification

40 lines added (two parameter blocks per file); no other changes and formatting is unchanged.
The path-parameter check script from 11 operations reference a path placeholder that is not declared as a parameter #326, run across apps/**/*.json, no longer reports anything for users. Before this change it reported 4 (2 per file).

🤖 Generated with Claude Code

PUT and DELETE /users/{userId} used the {userId} placeholder without a matching in: path parameter, in both the v2 and v3 specs. Copy the parameter already declared on get-user. Refs #326 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

orca-security-us · 2026-11-13T13:09:19Z

apps/v3/users-v3.json:536

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:22Z

apps/v3/users-v3.json:448

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:25Z

apps/v3/users-v3.json:2192

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
password has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:28Z

apps/v3/users-v3.json:1657

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
password has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:31Z

apps/v3/users-v3.json:2712

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:34Z

apps/v3/users-v3.json:625

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:37Z

apps/v3/users-v3.json:178

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:40Z

apps/v3/users-v3.json:351

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:43Z

apps/v3/users-v3.json:267

⚪️ [INFO] Object Without Required Property

Details:
OpenAPI v3 specification objects lack required fields defined by the standard,
causing schema validation failures and potential client integration issues.
Missing required properties prevent proper API documentation parsing and code
generation. Include all mandatory fields as specified in the OpenAPI 3.0
specification.

Recommendation:
tags has all required fields

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:46Z

apps/v3/users-v3.json:541

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:49Z

apps/users.json:185

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:52Z

apps/users.json:268

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:55Z

apps/users.json:692

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:09:58Z

apps/v3/users-v3.json:361

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:01Z

apps/v3/users-v3.json:458

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:04Z

apps/v3/users-v3.json:183

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:07Z

apps/users.json:533

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:10Z

apps/users.json:538

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:13Z

apps/users.json:356

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Location-Access' has no scopes defined for security scheme of type
'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us · 2026-11-13T13:10:16Z

apps/users.json:180

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Details:
OpenAPI security requirements define scopes for authentication schemes, but only
OAuth2 and OpenID Connect support scope-based authorization. Specifying scopes
for API Key or HTTP authentication types creates invalid configurations that fail
validation. Remove scopes from security requirements using authentication types
that do not support them.

Recommendation:
'security.Agency-Access' has no scopes defined for security scheme of type 'http'

💡 Reply /orca fix to have Orca suggest an AI-generated fix for this finding.

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 50	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	apps/users.json	View in code
	Template Path With No Corresponding Path Parameter	apps/users.json	View in code
	Template Path With No Corresponding Path Parameter	apps/users.json	View in code
	Template Path With No Corresponding Path Parameter	apps/users.json	View in code
	Unknown Property	apps/users.json	View in code
	Unknown Property	apps/users.json	View in code
	Unknown Property	apps/users.json	View in code
	Unknown Property	apps/users.json	View in code
	Unknown Property	apps/users.json	View in code
	Security Requirement Object With Wrong Scopes	...pps/v3/users-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...pps/v3/users-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...pps/v3/users-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...pps/v3/users-v3.json	View in code
	Security Requirement Object With Wrong Scopes	...pps/v3/users-v3.json	View in code
...	...	...	...

code-quality-gates · 2026-11-13T13:12:51Z

Quality Gate Results

⚠️ 1 Warning(s) — non-blocking, please review
✅ 6 Passed

⚠️ Warnings (non-blocking — worth reviewing)

dependency_license_check (1 item) — detailed results (inline comments only on changed lines) · 📖 docs

🔍 View detailed quality gate results

orca-security-us Bot reviewed Nov 13, 2026

View reviewed changes

ghl-karan-kaneria approved these changes Nov 13, 2026

View reviewed changes

Conversation

ravihighlevel commented Nov 13, 2026

Summary

Source of truth

Verification

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Object Without Required Property

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment

⚪️ [INFO] Security Requirement Object With Wrong Scopes

Uh oh!

orca-security-us Bot Nov 13, 2026

Choose a reason for hiding this comment