geniespec 0.1.2.dev9__tar.gz → 0.1.2.dev11__tar.gz

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: geniespec
-Version: 0.1.2.dev9
+Version: 0.1.2.dev11
 Summary: Generate API code from an api.yaml spec
 License-Expression: MIT
 Requires-Dist: jinja2>=3.1.6
@@ -68,6 +68,64 @@ resources:
 
 Fields use it like any other type (`type: ViewContent`, also inside `List` and `Mapping`). `python-server` generates a `ViewContentV1` pydantic discriminated union in `resources`; `typescript-client` generates a `ViewContentV1` union type and a `viewContentV1FromObject` function that builds the member class named by the discriminator (and throws for unknown values).
 
+`type: Uuid` is a string that must be a valid UUID. It works anywhere `String` does, including as a primary attribute in paths. `python-server` types it as `uuid.UUID`, so pydantic rejects other strings with a 400, internal methods get `uuid.UUID` objects and responses write them in the standard lowercase hyphenated form; `typescript-client` types it as `string`.
+
+`type: BigInt` is an integer of any size that travels as a JSON string, because JSON numbers past 2^53 lose precision in JavaScript. `python-server` types it as `int` (a `BigInt` alias in `resources`), accepts `"123"` or `123` in requests, always writes it as a string and documents it as `{"type": "string"}`; `typescript-client` types it as `bigint`, parsed with `BigInt(...)` and sent with `String(...)`.
+
+## Rate limits
+
+Name rate limits at the top level, then pick one per transition with `rateLimit`. `defaultRateLimit` applies to every transition that doesn't set one, and `rateLimit: none` turns it off for a transition, the same way `defaultAuthentication` and `authentication` work:
+
+```yaml
+rateLimits:
+  - name: standard-read
+    perMinute: 30
+    perHour: 300
+  - name: public-read
+    perMinute: 30
+    perHour: 300
+    keyBy: ip
+defaultRateLimit: standard-read
+transitions:
+  - action: GET-HEALTH
+    method: GET
+    authentication: none
+    rateLimit: public-read
+```
+
+A rate limit needs at least one of `perMinute`, `perFiveMinutes`, `perHour` and `perDay`. `keyBy` is `user` (the default) or `ip`. Requests over any window are rejected with a 429. Limits keyed by `user` count per authenticated user, so a transition using one needs `authentication`. `python-server` writes each rate limit as a `RATE_LIMIT_<NAME>` kiba-core `RateLimitConfig` and passes it to `route`; keying by `ip` needs kiba-core's `OriginIpMiddleware`. `typescript-client` ignores rate limits.
+
+## API docs
+
+Transitions can set `operationId`, `summary`, `description`, `tags` and `extensions`, and attributes, request fields and response fields can set a `description`:
+
+```yaml
+resources:
+  - singleName: Member
+    collectionName: Members
+    attributes:
+      - name: member-id
+        type: Uuid
+        isPrimary: true
+        description: The member's id.
+    transitions:
+      - action: GET
+        operationId: getMember
+        summary: Get a member
+        description: Returns one member.
+        tags: [Members]
+        extensions: {deprecated: true}
+```
+
+`python-server` passes the transition fields to kiba-core's `route`, whose `OpenApiSchemaGenerator` documents every route with an `operationId` (and skips the rest); `extensions` reach `OpenApiExtension`s as `metadata['extensions']`. Field descriptions become pydantic `Field(description=...)`, so they show up in the request and response schemas. Each `operationId` must be unique, so a transition that generates more than one route (for example `GET` on a resource with unique attributes) can't set one. `typescript-client` ignores these fields.
+
+## Overrides
+
+`overrides` keep an API that existed before genie working the same way once it moves to genie. They are meant to be dropped in the next major version of that API.
+
+- `shouldPrefixParentName: false` on a child resource names it without its parent's name: `Agent` under `User` stays `Agent` (not `UserAgent`), so its primary attribute is `agent-id` rather than `user-agent-id` and its fields keep their names. Its path is unchanged (`/users/{userId}/agents/{agentId}`).
+- `responseFieldName` on a `GET`, `LIST`, `CREATE` or `UPDATE` transition renames the field its response puts the resource in (for example `memories` instead of `agentMemories`). Custom transitions name it with `responseField`.
+
 # Development
 
 ```
@@ -82,7 +140,9 @@ make install-typescript-client
 make test-typescript-client
 ```
 
-Merges to `main` publish a dev version to PyPI. To release, bump `version` in `pyproject.toml` in a PR, then run the Release workflow on `main` (Actions → Release → Run workflow). It tags `vX.Y.Z` and the Publish workflow publishes it. Only the release workflow can push version tags.
+Merges to `main` publish a dev version to PyPI, except for changes that only touch the landing page. To release, bump `version` in `pyproject.toml` in a PR, then run the Release workflow on `main` (Actions → Release → Run workflow). It tags `vX.Y.Z` and the Publish workflow publishes it. Only the release workflow can push version tags.
+
+`landing/` is the static site for geniespec.com (plain HTML, CSS and JS, no build step). Preview it with `python3 -m http.server --directory landing`. Merges that touch it sync it to the kiba sites bucket and invalidate CloudFront (`.github/workflows/landing-deploy.yml`).
 
 # Things that need work
 

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/README.md

@@ -54,6 +54,64 @@ resources:
 
 Fields use it like any other type (`type: ViewContent`, also inside `List` and `Mapping`). `python-server` generates a `ViewContentV1` pydantic discriminated union in `resources`; `typescript-client` generates a `ViewContentV1` union type and a `viewContentV1FromObject` function that builds the member class named by the discriminator (and throws for unknown values).
 
+`type: Uuid` is a string that must be a valid UUID. It works anywhere `String` does, including as a primary attribute in paths. `python-server` types it as `uuid.UUID`, so pydantic rejects other strings with a 400, internal methods get `uuid.UUID` objects and responses write them in the standard lowercase hyphenated form; `typescript-client` types it as `string`.
+
+`type: BigInt` is an integer of any size that travels as a JSON string, because JSON numbers past 2^53 lose precision in JavaScript. `python-server` types it as `int` (a `BigInt` alias in `resources`), accepts `"123"` or `123` in requests, always writes it as a string and documents it as `{"type": "string"}`; `typescript-client` types it as `bigint`, parsed with `BigInt(...)` and sent with `String(...)`.
+
+## Rate limits
+
+Name rate limits at the top level, then pick one per transition with `rateLimit`. `defaultRateLimit` applies to every transition that doesn't set one, and `rateLimit: none` turns it off for a transition, the same way `defaultAuthentication` and `authentication` work:
+
+```yaml
+rateLimits:
+  - name: standard-read
+    perMinute: 30
+    perHour: 300
+  - name: public-read
+    perMinute: 30
+    perHour: 300
+    keyBy: ip
+defaultRateLimit: standard-read
+transitions:
+  - action: GET-HEALTH
+    method: GET
+    authentication: none
+    rateLimit: public-read
+```
+
+A rate limit needs at least one of `perMinute`, `perFiveMinutes`, `perHour` and `perDay`. `keyBy` is `user` (the default) or `ip`. Requests over any window are rejected with a 429. Limits keyed by `user` count per authenticated user, so a transition using one needs `authentication`. `python-server` writes each rate limit as a `RATE_LIMIT_<NAME>` kiba-core `RateLimitConfig` and passes it to `route`; keying by `ip` needs kiba-core's `OriginIpMiddleware`. `typescript-client` ignores rate limits.
+
+## API docs
+
+Transitions can set `operationId`, `summary`, `description`, `tags` and `extensions`, and attributes, request fields and response fields can set a `description`:
+
+```yaml
+resources:
+  - singleName: Member
+    collectionName: Members
+    attributes:
+      - name: member-id
+        type: Uuid
+        isPrimary: true
+        description: The member's id.
+    transitions:
+      - action: GET
+        operationId: getMember
+        summary: Get a member
+        description: Returns one member.
+        tags: [Members]
+        extensions: {deprecated: true}
+```
+
+`python-server` passes the transition fields to kiba-core's `route`, whose `OpenApiSchemaGenerator` documents every route with an `operationId` (and skips the rest); `extensions` reach `OpenApiExtension`s as `metadata['extensions']`. Field descriptions become pydantic `Field(description=...)`, so they show up in the request and response schemas. Each `operationId` must be unique, so a transition that generates more than one route (for example `GET` on a resource with unique attributes) can't set one. `typescript-client` ignores these fields.
+
+## Overrides
+
+`overrides` keep an API that existed before genie working the same way once it moves to genie. They are meant to be dropped in the next major version of that API.
+
+- `shouldPrefixParentName: false` on a child resource names it without its parent's name: `Agent` under `User` stays `Agent` (not `UserAgent`), so its primary attribute is `agent-id` rather than `user-agent-id` and its fields keep their names. Its path is unchanged (`/users/{userId}/agents/{agentId}`).
+- `responseFieldName` on a `GET`, `LIST`, `CREATE` or `UPDATE` transition renames the field its response puts the resource in (for example `memories` instead of `agentMemories`). Custom transitions name it with `responseField`.
+
 # Development
 
 ```
@@ -68,7 +126,9 @@ make install-typescript-client
 make test-typescript-client
 ```
 
-Merges to `main` publish a dev version to PyPI. To release, bump `version` in `pyproject.toml` in a PR, then run the Release workflow on `main` (Actions → Release → Run workflow). It tags `vX.Y.Z` and the Publish workflow publishes it. Only the release workflow can push version tags.
+Merges to `main` publish a dev version to PyPI, except for changes that only touch the landing page. To release, bump `version` in `pyproject.toml` in a PR, then run the Release workflow on `main` (Actions → Release → Run workflow). It tags `vX.Y.Z` and the Publish workflow publishes it. Only the release workflow can push version tags.
+
+`landing/` is the static site for geniespec.com (plain HTML, CSS and JS, no build step). Preview it with `python3 -m http.server --directory landing`. Merges that touch it sync it to the kiba sites bucket and invalidate CloudFront (`.github/workflows/landing-deploy.yml`).
 
 # Things that need work
 

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "geniespec"
-version = "0.1.2.dev9"
+version = "0.1.2.dev11"
 description = "Generate API code from an api.yaml spec"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ repository = "https://github.com/kibalabs/genie"
 
 [dependency-groups]
 dev = [
-    "kiba-build==0.1.11.dev15",
+    "kiba-build==0.1.11.dev24",
     "kiba-core[core-api,requester]>=0.5.3.dev87,<0.5.4",
 ]
 
@@ -31,7 +31,3 @@ build-backend = "uv_build"
 
 [tool.pytest.ini_options]
 pythonpath = ["src"]
-
-[tool.bumpversion]
-search = 'version = "{current_version}"'
-replace = 'version = "{new_version}"'

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "geniespec"
-version = "0.1.2.dev9"
+version = "0.1.2.dev11"
 description = "Generate API code from an api.yaml spec"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ repository = "https://github.com/kibalabs/genie"
 
 [dependency-groups]
 dev = [
-    "kiba-build==0.1.11.dev15",
+    "kiba-build==0.1.11.dev24",
     "kiba-core[core-api,requester]>=0.5.3.dev87,<0.5.4",
 ]
 
@@ -31,8 +31,3 @@ build-backend = "uv_build"
 
 [tool.pytest.ini_options]
 pythonpath = ["src"]
-
-# NOTE(krishan711): without this, bumping the version also rewrites dependency pins that contain it (e.g. 0.1.1 inside kiba-build==0.1.11.dev15)
-[tool.bumpversion]
-search = "version = \"{current_version}\""
-replace = "version = \"{new_version}\""

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/src/geniespec/api_schema.yaml

@@ -45,11 +45,46 @@ properties:
     items:
       type: string
   defaultAuthentication:
+    type:
+      - "null"
+      - string
+    pattern: '^[a-z][a-z0-9_-]*$'
+  rateLimits:
+    type: array
+    items:
+      $ref: '#/definitions/RateLimit'
+  defaultRateLimit:
     type:
       - "null"
       - string
     pattern: '^[a-z][a-z0-9-]*$'
 definitions:
+  RateLimit:
+    type: object
+    additionalProperties: false
+    required:
+      - name
+    properties:
+      name:
+        type: string
+        pattern: '^[a-z][a-z0-9-]*$'
+      perMinute:
+        type: integer
+        minimum: 1
+      perFiveMinutes:
+        type: integer
+        minimum: 1
+      perHour:
+        type: integer
+        minimum: 1
+      perDay:
+        type: integer
+        minimum: 1
+      keyBy:
+        type: string
+        enum:
+          - user
+          - ip
   EnumValues:
     type: array
     minItems: 1
@@ -123,6 +158,8 @@ definitions:
         type: boolean
       isDeprecated:
         type: boolean
+      description:
+        type: string
       defaultValue:
         type:
           - string
@@ -171,6 +208,12 @@ definitions:
         type: array
         items:
           type: string
+      overrides:
+        type: object
+        additionalProperties: false
+        properties:
+          shouldPrefixParentName:
+            type: boolean
   BaseTransition:
     type: object
     additionalProperties: false
@@ -192,6 +235,11 @@ definitions:
       responseField:
         $ref: '#/definitions/ResponseField'
       authentication:
+        type:
+          - "null"
+          - string
+        pattern: '^[a-z][a-z0-9_-]*$'
+      rateLimit:
         type:
           - "null"
           - string
@@ -202,6 +250,21 @@ definitions:
           - json
           - stream
           - redirect
+      operationId:
+        type: string
+        pattern: '^[A-Za-z][A-Za-z0-9_]*$'
+      summary:
+        type: string
+      description:
+        type: string
+      tags:
+        type: array
+        items:
+          type: string
+      extensions:
+        type: object
+      overrides:
+        $ref: '#/definitions/TransitionOverrides'
   Transition:
     type: object
     additionalProperties: false
@@ -223,6 +286,11 @@ definitions:
       responseField:
         $ref: '#/definitions/ResponseField'
       authentication:
+        type:
+          - "null"
+          - string
+        pattern: '^[a-z][a-z0-9_-]*$'
+      rateLimit:
         type:
           - "null"
           - string
@@ -240,6 +308,28 @@ definitions:
           - collection
       isIndirectAction:
         type: boolean
+      operationId:
+        type: string
+        pattern: '^[A-Za-z][A-Za-z0-9_]*$'
+      summary:
+        type: string
+      description:
+        type: string
+      tags:
+        type: array
+        items:
+          type: string
+      extensions:
+        type: object
+      overrides:
+        $ref: '#/definitions/TransitionOverrides'
+  TransitionOverrides:
+    type: object
+    additionalProperties: false
+    properties:
+      responseFieldName:
+        type: string
+        pattern: '^[a-z][A-Za-z0-9-]*$'
   RootTransition:
     type: object
     allOf:
@@ -283,6 +373,8 @@ definitions:
           - 'null'
       isDeprecated:
         type: boolean
+      description:
+        type: string
       maxValue:
         type:
           - string
@@ -329,6 +421,8 @@ definitions:
         type: boolean
       isList:
         type: boolean
+      description:
+        type: string
   Exception:
     type: object
     additionalProperties: false

{geniespec-0.1.2.dev9 → geniespec-0.1.2.dev11}/src/geniespec/genie.py

@@ -32,6 +32,7 @@ from geniespec.renderable_types import RenderableOneOf
 from geniespec.renderable_types import RenderableOneOfMember
 from geniespec.renderable_types import RenderableOperation
 from geniespec.renderable_types import RenderableParameter
+from geniespec.renderable_types import RenderableRateLimit
 from geniespec.renderable_types import RenderableRawTypes
 from geniespec.renderable_types import RenderableResource
 from geniespec.renderable_types import RenderableString
@@ -46,6 +47,7 @@ from geniespec.types import ComplexTypes
 from geniespec.types import FieldSources
 from geniespec.types import KibaApi
 from geniespec.types import PrimitiveTypes
+from geniespec.types import RateLimitKeys
 from geniespec.types import RequestField
 from geniespec.types import Resource
 from geniespec.types import ResponseField
@@ -114,7 +116,7 @@ class Renderer:
         method = transition.method or defaultMethods.get(transition.action.upper(), 'POST')
         return RenderableMethod(method=RenderableString.from_upper_case_string(string=method))
 
-    def _action_operation(self, transition: BaseTransition, endpoint: RenderableEndpoint, knownTypeNames: dict[str, str], defaultAuthentication: str | None, isIndirectAction: bool = False) -> RenderableOperation:
+    def _action_operation(self, transition: BaseTransition, endpoint: RenderableEndpoint, knownTypeNames: dict[str, str], defaultAuthentication: str | None, defaultRateLimit: str | None, isIndirectAction: bool = False) -> RenderableOperation:
         method = self._transition_to_renderable_method(transition=transition)
         fields = [self._request_field_to_renderable_parameter(requestField=requestField, knownTypeNames=knownTypeNames) for requestField in transition.requestFields]
         isQuery = method.method.upperCaseString == 'GET'
@@ -125,6 +127,7 @@ class Renderer:
             body=None if isQuery else fields,
             responseFields=[self._response_field_to_renderable_field(responseField=transition.responseField, knownTypeNames=knownTypeNames)] if transition.responseField is not None else None,
             authentication=transition.authentication or defaultAuthentication,
+            rateLimit=transition.rateLimit or defaultRateLimit,
             isIndirectAction=isIndirectAction,
             responseType=transition.responseType,
         )
@@ -196,6 +199,7 @@ class Renderer:
             isRequired=requestField.isRequired,
             isDeprecated=requestField.isDeprecated,
             source=requestField.source,
+            description=requestField.description,
         )
 
     def _response_field_to_renderable_field(self, responseField: ResponseField, knownTypeNames: dict[str, str]) -> RenderableField:
@@ -211,6 +215,7 @@ class Renderer:
                 mappingValueTypes=responseField.mappingValueTypes,
                 enumValues=responseField.enumValues,
             ),
+            description=responseField.description,
         )
 
     def _attribute_to_renderable_attribute(self, attribute: Attribute, knownTypeNames: dict[str, str], isNullable: bool | None = None) -> RenderableAttribute:
@@ -233,6 +238,7 @@ class Renderer:
             isAccessibleIndependently=attribute.isAccessibleIndependently,
             isSettable=attribute.isSettable,
             isNullable=attribute.isNullable,
+            description=attribute.description,
         )
 
     def _attribute_to_renderable_parameter(self, attribute: Attribute, isRequired: bool, knownTypeNames: dict[str, str], shouldUseDefault: bool = True) -> RenderableParameter:
@@ -251,11 +257,25 @@ class Renderer:
             defaultValue=attribute.defaultValue if shouldUseDefault else None,
             isRequired=isRequired,
             isDeprecated=attribute.isDeprecated,
+            description=attribute.description,
         )
 
+    @staticmethod
+    def _operation_documentation(transition: BaseTransition) -> dict[str, object]:
+        return {'operationId': transition.operationId, 'summary': transition.summary, 'description': transition.description, 'tags': transition.tags, 'extensions': transition.extensions}
+
+    def _with_transition_fields(self, operation: RenderableOperation, transition: BaseTransition, isStandard: bool) -> RenderableOperation:
+        update = self._operation_documentation(transition=transition)
+        responseFieldName = transition.overrides.responseFieldName
+        if responseFieldName is not None:
+            if not isStandard or not operation.responseFields:
+                raise SemanticValidationException(message=f'Only GET, LIST, CREATE and UPDATE transitions can override responseFieldName: {transition.action}')
+            update['responseFields'] = [field.model_copy(update={'name': RenderableString.from_kebab_case_string(string=responseFieldName)}) for field in operation.responseFields]
+        return operation.model_copy(update=update)
+
     @staticmethod
     def _resource_full_name(resource: Resource, name: str) -> str:
-        return f'{resource.parentResource or ""}{name}'
+        return f'{resource.parentResource or ""}{name}' if resource.overrides.shouldPrefixParentName else name
 
     def _resource_to_renderable_resource(self, resource: Resource, knownTypeNames: dict[str, str]) -> RenderableResource:
         attributes = [self._attribute_to_renderable_attribute(attribute=attribute, knownTypeNames=knownTypeNames) for attribute in resource.attributes]
@@ -287,7 +307,9 @@ class Renderer:
 
     @staticmethod
     def _relative_name(name: RenderableString, anchor: RenderableResource | None) -> RenderableString:
-        return RenderableString(string=name.string[len(anchor.singleName.string) :]) if anchor is not None else name
+        if anchor is None or name.string[: len(anchor.singleName.string)] != anchor.singleName.string:
+            return name
+        return RenderableString(string=name.string[len(anchor.singleName.string) :])
 
     def _resource_component(self, resource: RenderableResource, attribute: RenderableAttribute | None, anchor: RenderableResource | None) -> ResourceEndpointComponent:
         return ResourceEndpointComponent(
@@ -344,7 +366,7 @@ class Renderer:
     def _is_string_mapping(renderableType: RenderableType) -> bool:
         return isinstance(renderableType, MappingRenderableType) and renderableType.keyType.rawType == PrimitiveTypes.STRING and renderableType.valueType.rawType == PrimitiveTypes.STRING
 
-    def _operation_errors(self, operation: RenderableOperation) -> list[str]:
+    def _operation_errors(self, operation: RenderableOperation, rateLimitsByName: dict[str, RenderableRateLimit]) -> list[str]:
         lastComponent = operation.endpoint.components[-1] if operation.endpoint.components else None
         name = lastComponent.actionName.kebabCaseString if isinstance(lastComponent, ActionEndpointComponent) and lastComponent.actionName is not None else operation.method.method.upperCaseString
         parametersBySource: dict[str, list[RenderableParameter]] = collections.defaultdict(list)
@@ -369,6 +391,12 @@ class Renderer:
                 for parameter in operation.parameters
                 if parameter.source == FieldSources.REQUEST and (parameter.fieldType.isList or isinstance(parameter.fieldType, MappingRenderableType) or parameter.fieldType.rawType not in FORM_FIELD_RAW_TYPES)
             ]
+        if operation.rateLimit not in (None, 'none'):
+            rateLimit = rateLimitsByName.get(operation.rateLimit)
+            if rateLimit is None:
+                errors.append(f'{name}: unknown rate limit {operation.rateLimit}')
+            elif rateLimit.keyBy == RateLimitKeys.USER and operation.authentication in (None, 'none'):
+                errors.append(f'{name}: rate limit {operation.rateLimit} is keyed by user, so the transition needs authentication')
         return errors
 
     @staticmethod
@@ -414,6 +442,9 @@ class Renderer:
         }
         resourceErrors = [f'Duplicate type name: {name}' for name, count in collections.Counter(fullResourceNames + enumNames + oneOfNames).items() if count > 1]
         resourceErrors += [f'Unknown parent resource {resource.parentResource} for {resource.singleName}' for resource in api.resources if resource.parentResource is not None and resource.parentResource not in fullResourceNames]
+        resourceErrors += [f'Duplicate rate limit: {name}' for name, count in collections.Counter(rateLimit.name for rateLimit in api.rateLimits).items() if count > 1]
+        resourceErrors += ['Rate limit none is reserved for transitions without a rate limit' for rateLimit in api.rateLimits if rateLimit.name == 'none']
+        resourceErrors += [f'Rate limit {rateLimit.name} needs at least one of perMinute, perFiveMinutes, perHour or perDay' for rateLimit in api.rateLimits if all(window is None for window in (rateLimit.perMinute, rateLimit.perFiveMinutes, rateLimit.perHour, rateLimit.perDay))]
         resourcesByName = dict(zip(fullResourceNames, api.resources, strict=False))
         renderableOneOfs: list[RenderableOneOf] = []
         for oneOf in api.oneOfs:
@@ -440,11 +471,16 @@ class Renderer:
         if resourceErrors:
             raise SemanticValidationException(message='\n'.join(resourceErrors))
         renderableOperations = [
-            self._action_operation(
+            self._with_transition_fields(
+                operation=self._action_operation(
+                    transition=transition,
+                    endpoint=RenderableEndpoint(components=[ActionEndpointComponent(actionName=RenderableString.from_separated_string(string=transition.action, separator='-'))]),
+                    knownTypeNames=knownTypeNames,
+                    defaultAuthentication=api.defaultAuthentication,
+                    defaultRateLimit=api.defaultRateLimit,
+                ),
                 transition=transition,
-                endpoint=RenderableEndpoint(components=[ActionEndpointComponent(actionName=RenderableString.from_separated_string(string=transition.action, separator='-'))]),
-                knownTypeNames=knownTypeNames,
-                defaultAuthentication=api.defaultAuthentication,
+                isStandard=False,
             )
             for transition in api.transitions
         ]
@@ -475,6 +511,10 @@ class Renderer:
             exceptions=renderableExceptions,
             enums=[RenderableEnum(name=RenderableString.from_pascal_case_string(string=enum.name), values=enum.values) for enum in api.enums],
             oneOfs=renderableOneOfs,
+            rateLimits=[
+                RenderableRateLimit(name=RenderableString.from_kebab_case_string(string=rateLimit.name), perMinute=rateLimit.perMinute, perFiveMinutes=rateLimit.perFiveMinutes, perHour=rateLimit.perHour, perDay=rateLimit.perDay, keyBy=rateLimit.keyBy)
+                for rateLimit in api.rateLimits
+            ],
         )
         renderableResources: list[RenderableResource] = [self._resource_to_renderable_resource(resource=resource, knownTypeNames=knownTypeNames) for resource in api.resources]
         uncoveredTransitions: list[str] = []
@@ -482,6 +522,8 @@ class Renderer:
             processableResource = self._get_processable_resource(renderableResource=renderableResource, allResources=renderableResources, knownTypeNames=knownTypeNames)
             endpoints = self._get_resource_endpoints(processableResource=processableResource)
             for transition in resource.transitions:
+                authentication = transition.authentication or api.defaultAuthentication
+                rateLimit = transition.rateLimit or api.defaultRateLimit
                 operationCount = len(renderableApi.operations)
                 method: RenderableMethod = self._transition_to_renderable_method(transition=transition)
                 if transition.isIndirectAction and transition.action.upper() in {'DELETE', 'CREATE', 'UPDATE', 'GET', 'LIST'}:
@@ -490,7 +532,7 @@ class Renderer:
                     raise SemanticValidationException(message=f'Only custom transitions can set a responseType: {transition.action}')
                 if transition.action.upper() == 'DELETE':
                     for endpoint in endpoints.individualEndpoints:
-                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=None, responseFields=[], authentication=transition.authentication or api.defaultAuthentication))
+                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=None, responseFields=[], authentication=authentication, rateLimit=rateLimit))
                 elif transition.action.upper() == 'CREATE':
                     parentResource = processableResource.parent.processableResource if processableResource.parent is not None else None
                     isOneToOne = (processableResource.renderableResource.primaryAttribute == parentResource.renderableResource.primaryAttribute) if parentResource is not None else False
@@ -502,17 +544,17 @@ class Renderer:
                     body += [self._request_field_to_renderable_parameter(requestField=requestField, knownTypeNames=knownTypeNames) for requestField in transition.requestFields]
                     returnValue = RenderableField(name=processableResource.renderableResource.singleName, fieldType=RenderableType(rawType='class', className=processableResource.renderableResource.singleName, isNullable=False, isList=False))
                     for endpoint in endpoints.collectionEndpoints:
-                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=body or None, responseFields=[returnValue], authentication=transition.authentication or api.defaultAuthentication))
+                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=body or None, responseFields=[returnValue], authentication=authentication, rateLimit=rateLimit))
                 elif transition.action.upper() == 'UPDATE':
                     returnValue = RenderableField(name=processableResource.renderableResource.singleName, fieldType=RenderableType(rawType='class', className=processableResource.renderableResource.singleName, isNullable=False, isList=False))
                     body = [self._attribute_to_renderable_parameter(attribute=attribute, isRequired=False, knownTypeNames=knownTypeNames, shouldUseDefault=False) for attribute in resource.attributes if attribute.isUpdatable]
                     body += [self._request_field_to_renderable_parameter(requestField=requestField, knownTypeNames=knownTypeNames) for requestField in transition.requestFields]
                     for endpoint in endpoints.individualEndpoints:
-                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=body or None, responseFields=[returnValue], authentication=transition.authentication or api.defaultAuthentication))
+                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=body or None, responseFields=[returnValue], authentication=authentication, rateLimit=rateLimit))
                 elif transition.action.upper() == 'GET':
                     returnValue = RenderableField(name=processableResource.renderableResource.singleName, fieldType=RenderableType(rawType='class', className=processableResource.renderableResource.singleName, isNullable=False, isList=False))
                     for endpoint in endpoints.individualEndpoints:
-                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=None, responseFields=[returnValue], authentication=transition.authentication or api.defaultAuthentication))
+                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=None, body=None, responseFields=[returnValue], authentication=authentication, rateLimit=rateLimit))
                     endpointsAccessibleWithUnique = [endpoint for endpoint in endpoints.collectionEndpoints if isinstance(endpoint.components[-1], ResourceEndpointComponent)]
                     uniqueAttributes = [attribute for attribute in resource.attributes if attribute.isUnique and not attribute.isPrimary and not attribute.shouldDisableGetEndpoint and not attribute.isAccessibleIndependently]
                     for endpoint in endpointsAccessibleWithUnique:
@@ -529,12 +571,12 @@ class Renderer:
                                     ),
                                 ]
                             )
-                            renderableApi.operations.append(RenderableOperation(method=method, endpoint=getByUniqueEndpoint, query=None, body=None, responseFields=[returnValue], authentication=transition.authentication or api.defaultAuthentication))
+                            renderableApi.operations.append(RenderableOperation(method=method, endpoint=getByUniqueEndpoint, query=None, body=None, responseFields=[returnValue], authentication=authentication, rateLimit=rateLimit))
                 elif transition.action.upper() == 'LIST':
                     returnValue = RenderableField(name=processableResource.renderableResource.collectionName, fieldType=RenderableType(rawType='class', className=processableResource.renderableResource.singleName, isNullable=False, isList=True))
                     query = [self._request_field_to_renderable_parameter(requestField=requestField, knownTypeNames=knownTypeNames) for requestField in transition.requestFields]
                     for endpoint in endpoints.collectionEndpoints:
-                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=query or None, body=None, responseFields=[returnValue], authentication=transition.authentication or api.defaultAuthentication))
+                        renderableApi.operations.append(RenderableOperation(method=method, endpoint=endpoint, query=query or None, body=None, responseFields=[returnValue], authentication=authentication, rateLimit=rateLimit))
                 else:  # Else it's a custom action
                     if transition.operatesOn == 'individual':
                         customEndpoints = endpoints.individualEndpoints
@@ -544,15 +586,20 @@ class Renderer:
                         raise KibaException(message=f'Resource {processableResource.renderableResource.singleName.pascalCaseString} has custom transition with invalid operatesOn field: {transition.operatesOn}')
                     for endpoint in customEndpoints:
                         customEndpoint = RenderableEndpoint(components=[*endpoint.components, ActionEndpointComponent(actionName=RenderableString.from_separated_string(string=transition.action, separator='-'))])
-                        renderableApi.operations.append(self._action_operation(transition=transition, endpoint=customEndpoint, knownTypeNames=knownTypeNames, defaultAuthentication=api.defaultAuthentication, isIndirectAction=transition.isIndirectAction))
+                        renderableApi.operations.append(self._action_operation(transition=transition, endpoint=customEndpoint, knownTypeNames=knownTypeNames, defaultAuthentication=api.defaultAuthentication, defaultRateLimit=api.defaultRateLimit, isIndirectAction=transition.isIndirectAction))
+                isStandard = transition.action.upper() in {'CREATE', 'UPDATE', 'GET', 'LIST'}
+                renderableApi.operations[operationCount:] = [self._with_transition_fields(operation=operation, transition=transition, isStandard=isStandard) for operation in renderableApi.operations[operationCount:]]
                 if len(renderableApi.operations) == operationCount:
                     uncoveredTransitions.append(f'{renderableResource.singleName.pascalCaseString} {transition.action}')
         if uncoveredTransitions:
             raise SemanticValidationException(
                 message=f'Transitions with no endpoint: {", ".join(uncoveredTransitions)}. Item transitions need a primary attribute, collection transitions need direct access or a parent resource, and CREATE is not supported on one-to-one child resources.'
             )
-        operationErrors = [error for operation in renderableApi.operations for error in self._operation_errors(operation=operation)]
+        rateLimitsByName = {rateLimit.name.kebabCaseString: rateLimit for rateLimit in renderableApi.rateLimits}
+        operationErrors = [error for operation in renderableApi.operations for error in self._operation_errors(operation=operation, rateLimitsByName=rateLimitsByName)]
         operationErrors += self._file_errors(resources=renderableResources, exceptions=renderableExceptions)
+        operationIdCounts = collections.Counter(operation.operationId for operation in renderableApi.operations if operation.operationId is not None)
+        operationErrors += [f'Duplicate operationId: {operationId}' for operationId, count in operationIdCounts.items() if count > 1]
         if operationErrors:
             raise SemanticValidationException(message='\n'.join(operationErrors))
         renderableApi.resources.extend(renderableResources)