OpenAPI in ASP.NET Core: Generate API Documentation

Human-readable API documentation goes stale. A machine-readable one can't — the API and its description are kept in lockstep.

You've now called REST APIs, deserialized their JSON, and learned the conventions that make them predictable. But how did you know, in a real project, exactly which fields a response contains, which are optional, or what values a status code could return? Someone had to write that down somewhere. If it's a hand-maintained wiki page, it drifts out of date the moment the API changes and nobody remembers to update the docs. OpenAPI is the industry's answer: a precise, machine-readable description of an API's shape, generated from — and kept honest by — the API's own code.

In this lesson, you'll learn what an OpenAPI document actually is, why it exists, how to read one at a conceptual level, and what it unlocks — interactive documentation and generated client code — even though you won't build a full API server until a later, Advanced-tier module.

What Is It?

The Simple Explanation

An OpenAPI document is a JSON (or YAML) file that fully describes an HTTP API — every endpoint, every HTTP verb it supports, every request and response shape, every possible status code — in a standard format that both humans and tools can read. Think of it as a precise, structured blueprint of an API, instead of a prose description that a person wrote by hand and might forget to update.

The Technical Definition

The OpenAPI Specification (formerly known as Swagger, the name still commonly used for tools built around it) defines a schema for describing REST APIs: paths (URLs) and the operations (HTTP verbs) available on each, request parameters and bodies with their expected types, response shapes per status code, and authentication requirements — all expressed as structured JSON/YAML rather than free-form text. An OpenAPI document (sometimes called a "spec") for a specific API is a file conforming to that schema, typically generated automatically from the API's own source code so it can never drift out of sync with the real behavior.

Why Does It Exist?

The Problem — Documentation That Isn't Enforced Goes Stale

A hand-written API reference document is disconnected from the actual running code — nothing stops a developer from changing an endpoint's behavior without remembering to update the wiki page describing it. Multiply that across dozens of endpoints and many releases, and hand-maintained docs reliably drift from reality. A consumer trusting stale docs writes client code against a contract that no longer matches what the server actually does — bugs that are maddening to track down, because the code "should" work according to the documentation.

The Solution — Derive the Documentation From the Code Itself

Instead of a human separately describing the API in prose, tooling inspects the API's actual routes, parameter types, and response types directly from the code (in .NET, this is commonly done via Microsoft.AspNetCore.OpenApi or similar libraries, generating the document automatically at build or run time) and produces the OpenAPI document from that. Because the document is derived from the real implementation rather than typed by hand, it can't drift the way prose documentation does — if the code changes, regenerating the document reflects that change automatically.

Big Picture

openapi.json — generated from the API's actual code

The theme across all three: because the document is structured and machine-readable, tools can build useful things on top of it automatically — none of which would be possible from a prose wiki page, no matter how well-written.

How It Works

Reading an OpenAPI Document — A Guided Tour

You don't need to write one by hand at this stage to benefit from knowing how to read one. Here's a small, annotated fragment for a single endpoint:

{
  "openapi": "3.0.1",
  "info": { "title": "Orders API", "version": "v1" },
  "paths": {
    "/orders/{orderId}": {
      "get": {
        "summary": "Get an order by ID",
        "parameters": [
          { "name": "orderId", "in": "path", "required": true, "schema": { "type": "integer" } }
        ],
        "responses": {
          "200": {
            "description": "The order was found",
            "content": {
              "application/json": {
                "schema": { "$ref": "#/components/schemas/OrderDto" }
              }
            }
          },
          "404": { "description": "No order exists with that ID" }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "OrderDto": {
        "type": "object",
        "properties": {
          "orderId": { "type": "integer" },
          "total": { "type": "number" },
          "isPaid": { "type": "boolean" }
        }
      }
    }
  }
}

Simple Example

The fragment above already tells you almost everything you'd need to write a .NET client for that one endpoint, without ever having read the server's source code — because it precisely matches the patterns from the previous two lessons:

// Derived directly from the OpenAPI document above:
// - the URL template "/orders/{orderId}"
// - the "get" verb
// - a 200 response shaped like OrderDto
// - a 404 meaning "not found"

public record OrderDto(int OrderId, decimal Total, bool IsPaid);

public class OrdersClient(HttpClient httpClient)
{
    public async Task<OrderDto?> GetOrderAsync(int orderId)
    {
        var response = await httpClient.GetAsync($"orders/{orderId}");

        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
            return null;

        response.EnsureSuccessStatusCode();
        return await response.Content.ReadFromJsonAsync<OrderDto>();
    }
}

Notice this is precisely the shape of client code you already know how to write, from lessons 130–132 — the OpenAPI document is simply what let you write it correctly without guessing, and it's exactly this predictability that lets tools generate this same code automatically, rather than a developer typing it by hand.

Real-World Example

Picture two teams at a company: one owns a Shipping API, the other builds an Order Processing worker that needs to call it. Without OpenAPI, the Order Processing team would read a wiki page (hoping it's current), guess at field names, and find out about mismatches only when a real call fails in an unexpected way. With OpenAPI in the picture, the workflow looks different:

1. The Shipping API generates its OpenAPI document automatically as part of its build
   (its actual endpoint code is the source of truth — nobody hand-writes the spec)

2. The Order Processing team points a client-generation tool at that document

3. The tool generates a full C# client — DTOs, methods, everything —
   matching the Shipping API's real, current contract

4. When the Shipping API's next release changes a field, its OpenAPI document
   changes too, automatically — regenerating the client surfaces the
   mismatch as a compile error, not a mysterious runtime failure weeks later

The Order Processing team never hand-wrote a single DTO or endpoint URL for the Shipping API — every piece of that OrdersClient-style code from the Simple Example above could, in a real project with this tooling in place, be generated directly from the document instead.

Analogy

Under the Hood

Common Confusion

"Swagger" and "OpenAPI" get used interchangeably, but they're not quite the same thing

OpenAPI was originally called the "Swagger Specification." The specification itself was later donated to the OpenAPI Initiative and renamed "OpenAPI," but "Swagger" stuck around as the brand name for a family of tools built around it — Swagger UI (renders interactive docs from a document), Swagger Editor, and others. In casual conversation, "generate the Swagger" and "generate the OpenAPI spec" usually mean the same thing — the tool name has outlived the specification's original name.

The OpenAPI document describes the API — it doesn't run the API

It's easy to conflate "we have OpenAPI set up" with "our API is documented and correct." The document is a description generated from the running API's code — it reflects what the code does, but a bug in the actual endpoint logic is still a bug, even if the auto-generated document describes the (buggy) behavior perfectly accurately. Accurate documentation and correct behavior are two different guarantees; OpenAPI only strengthens the first one.

Common Mistakes

Mistake 1 — Treating a hand-edited OpenAPI document as trustworthy

Manually tweaking a generated OpenAPI document to "fix" a description, then never touching it again — the next time the document is regenerated from the actual code, that manual edit is silently overwritten, or worse, the document now describes something the code doesn't actually do.

Treat a generated OpenAPI document as a reflection of the real code, not a hand-editable artifact — if the description is wrong, fix the code's own annotations/attributes so the correct description gets regenerated automatically every time.

Mistake 2 — Assuming "we have an OpenAPI document" means "our API is well-designed"

Generating an OpenAPI document from an API that isn't RESTful at all (everything funneled through one generic POST endpoint) and assuming the presence of a spec somehow fixes that design problem — it doesn't; it just precisely documents an awkward design.

OpenAPI documents whatever the API actually does — good design (from lesson 132) and accurate documentation (this lesson) are separate concerns; you need both.

When Should I Use It?

• As a consumer, look for an OpenAPI document (often served at a URL like /openapi/v1.json or linked from interactive docs) before hand-reading an unfamiliar API's endpoints one by one — it's usually the fastest, most reliable way to understand exactly what's available.
• As a future API builder (covered hands-on in the later, Advanced-tier ASP.NET Core module), enabling OpenAPI generation is close to free with modern .NET tooling and pays for itself the moment any other team — or your own frontend — needs to consume the API.
• A tiny internal script that only ever talks to one hardcoded, unchanging endpoint you wrote yourself doesn't gain much from generated client tooling — OpenAPI earns its keep once more than one consumer, or a changing API surface, enters the picture.

Mental Model

Key Takeaway

Check Your Understanding

You've completed Part V by seeing how APIs describe themselves in a machine-readable way. Let's check your understanding of why that matters — and wrap up the whole module.

You've completed Part V — Modern .NET Dev. You now understand how a .NET application configures itself, logs what it does, and talks to the outside world over HTTP, JSON, and REST — the exact foundation the Advanced-tier ASP.NET Core module will build full web APIs on top of.