schemathesis 4.3.6__tar.gz → 4.3.8__tar.gz

{schemathesis-4.3.6 → schemathesis-4.3.8}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.30.8
+        uses: github/codeql-action/init@v4.30.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.30.8
+        uses: github/codeql-action/autobuild@v4.30.9
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.30.8
+        uses: github/codeql-action/analyze@v4.30.9

{schemathesis-4.3.6 → schemathesis-4.3.8}/CHANGELOG.md

@@ -1,6 +1,25 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.6...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.8...HEAD) - TBD
+
+## [4.3.8](https://github.com/schemathesis/schemathesis/compare/v4.3.7...v4.3.8) - 2025-10-21
+
+### :wrench: Changed
+
+- Display mutation metadata in `negative_data_rejection` failures if available. Currently, only available for the coverage phase.
+- Support `items` inside `requestBody` during dependency inference.
+
+## [4.3.7](https://github.com/schemathesis/schemathesis/compare/v4.3.6...v4.3.7) - 2025-10-20
+
+### :bug: Fixed
+
+- Properly fix an empty list to `phases.coverage.unexpected-methods` disabling testing of unexpected HTTP methods.
+- Import all checks inside `Case.validate_response`. It is relevant for manually constructing `Case` instances outside of Schemathesis tests. [#3184](https://github.com/schemathesis/schemathesis/discussions/3184)
+
+### :wrench: Changed
+
+- Infer subresource dependencies in responses.
+- Avoid creating resources that are not objects.
 
 ## [4.3.6](https://github.com/schemathesis/schemathesis/compare/v4.3.5...v4.3.6) - 2025-10-20
 

{schemathesis-4.3.6 → schemathesis-4.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.6
+Version: 4.3.8
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.3.6 → schemathesis-4.3.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.6"
+version = "4.3.8"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/config/_phases.py

@@ -102,7 +102,7 @@ class CoveragePhaseConfig(DiffBase):
     ) -> None:
         self.enabled = enabled
         self.generate_duplicate_query_parameters = generate_duplicate_query_parameters
-        self.unexpected_methods = unexpected_methods or DEFAULT_UNEXPECTED_METHODS
+        self.unexpected_methods = unexpected_methods if unexpected_methods is not None else DEFAULT_UNEXPECTED_METHODS
         self.generation = generation or GenerationConfig()
         self.checks = checks or ChecksConfig()
         self._is_default = (

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/core/jsonschema/bundler.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any
 
 from schemathesis.core.errors import InfiniteRecursiveReference
@@ -24,6 +25,14 @@ class BundleError(Exception):
         return f"Cannot bundle `{self.reference}`: expected JSON Schema (object or boolean), got {to_json_type_name(self.value)}"
 
 
+@dataclass
+class Bundle:
+    schema: JsonSchema
+    name_to_uri: dict[str, str]
+
+    __slots__ = ("schema", "name_to_uri")
+
+
 class Bundler:
     """Bundler tracks schema ids stored in a bundle."""
 
@@ -34,16 +43,16 @@ class Bundler:
     def __init__(self) -> None:
         self.counter = 0
 
-    def bundle(self, schema: JsonSchema, resolver: RefResolver, *, inline_recursive: bool) -> JsonSchema:
+    def bundle(self, schema: JsonSchema, resolver: RefResolver, *, inline_recursive: bool) -> Bundle:
         """Bundle a JSON Schema by embedding all references."""
         # Inlining recursive reference is required (for now) for data generation, but is unsound for data validation
         if not isinstance(schema, dict):
-            return schema
+            return Bundle(schema=schema, name_to_uri={})
 
         # Track visited URIs and their local definition names
         inlining_for_recursion: set[str] = set()
         visited: set[str] = set()
-        uri_to_def_name: dict[str, str] = {}
+        uri_to_name: dict[str, str] = {}
         defs = {}
 
         has_recursive_references = False
@@ -52,11 +61,11 @@ class Bundler:
 
         def get_def_name(uri: str) -> str:
             """Generate or retrieve the local definition name for a URI."""
-            name = uri_to_def_name.get(uri)
+            name = uri_to_name.get(uri)
             if name is None:
                 self.counter += 1
                 name = f"schema{self.counter}"
-                uri_to_def_name[uri] = name
+                uri_to_name[uri] = name
             return name
 
         def bundle_recursive(current: JsonSchema | list[JsonSchema]) -> JsonSchema | list[JsonSchema]:
@@ -162,13 +171,13 @@ class Bundler:
             for value in defs.values():
                 if isinstance(value, dict):
                     result.update(value)
-            return result
+            return Bundle(schema=result, name_to_uri={})
 
         if defs:
             bundled[BUNDLE_STORAGE_KEY] = defs
-        return bundled
+        return Bundle(schema=bundled, name_to_uri={v: k for k, v in uri_to_name.items()})
 
 
-def bundle(schema: JsonSchema, resolver: RefResolver, *, inline_recursive: bool) -> JsonSchema:
+def bundle(schema: JsonSchema, resolver: RefResolver, *, inline_recursive: bool) -> Bundle:
     """Bundle a JSON Schema by embedding all references."""
     return Bundler().bundle(schema, resolver, inline_recursive=inline_recursive)

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/generation/case.py

@@ -4,7 +4,7 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Mapping
 
 from schemathesis import transport
-from schemathesis.checks import CHECKS, CheckContext, CheckFunction, run_checks
+from schemathesis.checks import CHECKS, CheckContext, CheckFunction, load_all_checks, run_checks
 from schemathesis.core import NOT_SET, SCHEMATHESIS_TEST_CASE_HEADER, NotSet, curl
 from schemathesis.core.failures import FailureGroup, failure_report_title, format_failures
 from schemathesis.core.transport import Response
@@ -251,6 +251,10 @@ class Case:
         __tracebackhide__ = True
         from requests.structures import CaseInsensitiveDict
 
+        # In some cases checks may not be loaded.
+        # For example - non-Schemathesis tests that manually construct `Case` instances
+        load_all_checks()
+
         response = Response.from_any(response)
 
         config = self.operation.schema.config.checks_config_for(

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/adapter/parameters.py

@@ -38,11 +38,13 @@ FORM_MEDIA_TYPES = frozenset(["multipart/form-data", "application/x-www-form-url
 class OpenApiComponent(ABC):
     definition: Mapping[str, Any]
     is_required: bool
+    name_to_uri: dict[str, str]
     adapter: SpecificationAdapter
 
     __slots__ = (
         "definition",
         "is_required",
+        "name_to_uri",
         "adapter",
         "_optimized_schema",
         "_unoptimized_schema",
@@ -142,9 +144,11 @@ class OpenApiParameter(OpenApiComponent):
     """OpenAPI operation parameter."""
 
     @classmethod
-    def from_definition(cls, *, definition: Mapping[str, Any], adapter: SpecificationAdapter) -> OpenApiParameter:
+    def from_definition(
+        cls, *, definition: Mapping[str, Any], name_to_uri: dict[str, str], adapter: SpecificationAdapter
+    ) -> OpenApiParameter:
         is_required = definition.get("required", False)
-        return cls(definition=definition, is_required=is_required, adapter=adapter)
+        return cls(definition=definition, is_required=is_required, name_to_uri=name_to_uri, adapter=adapter)
 
     @property
     def name(self) -> str:
@@ -174,12 +178,14 @@ class OpenApiBody(OpenApiComponent):
 
     media_type: str
     resource_name: str | None
+    name_to_uri: dict[str, str]
 
     __slots__ = (
         "definition",
         "is_required",
         "media_type",
         "resource_name",
+        "name_to_uri",
         "adapter",
         "_optimized_schema",
         "_unoptimized_schema",
@@ -195,6 +201,7 @@ class OpenApiBody(OpenApiComponent):
         is_required: bool,
         media_type: str,
         resource_name: str | None,
+        name_to_uri: dict[str, str],
         adapter: SpecificationAdapter,
     ) -> OpenApiBody:
         return cls(
@@ -202,6 +209,7 @@ class OpenApiBody(OpenApiComponent):
             is_required=is_required,
             media_type=media_type,
             resource_name=resource_name,
+            name_to_uri=name_to_uri,
             adapter=adapter,
         )
 
@@ -211,6 +219,7 @@ class OpenApiBody(OpenApiComponent):
         *,
         definition: Mapping[str, Any],
         media_type: str,
+        name_to_uri: dict[str, str],
         adapter: SpecificationAdapter,
     ) -> OpenApiBody:
         return cls(
@@ -218,6 +227,7 @@ class OpenApiBody(OpenApiComponent):
             is_required=True,
             media_type=media_type,
             resource_name=None,
+            name_to_uri=name_to_uri,
             adapter=adapter,
         )
 
@@ -273,19 +283,24 @@ def extract_parameter_schema_v3(parameter: Mapping[str, Any]) -> JsonSchema:
     return media_type_object.get("schema", {})
 
 
-def _bundle_parameter(parameter: Mapping, resolver: RefResolver, bundler: Bundler) -> dict:
+def _bundle_parameter(
+    parameter: Mapping, resolver: RefResolver, bundler: Bundler
+) -> tuple[dict[str, Any], dict[str, str]]:
     """Bundle a parameter definition to make it self-contained."""
     _, definition = maybe_resolve(parameter, resolver, "")
     schema = definition.get("schema")
+    name_to_uri = {}
     if schema is not None:
         definition = {k: v for k, v in definition.items() if k != "schema"}
         try:
-            definition["schema"] = bundler.bundle(schema, resolver, inline_recursive=True)
+            bundled = bundler.bundle(schema, resolver, inline_recursive=True)
+            definition["schema"] = bundled.schema
+            name_to_uri = bundled.name_to_uri
         except BundleError as exc:
             location = parameter.get("in", "")
             name = parameter.get("name", "<UNKNOWN>")
             raise InvalidSchema.from_bundle_error(exc, location, name) from exc
-    return cast(dict, definition)
+    return cast(dict, definition), name_to_uri
 
 
 OPENAPI_20_DEFAULT_BODY_MEDIA_TYPE = "application/json"
@@ -308,15 +323,17 @@ def iter_parameters_v2(
     form_data_media_types = media_types or (OPENAPI_20_DEFAULT_FORM_MEDIA_TYPE,)
 
     form_parameters = []
+    form_name_to_uri = {}
     bundler = Bundler()
     for parameter in chain(definition.get("parameters", []), shared_parameters):
-        parameter = _bundle_parameter(parameter, resolver, bundler)
+        parameter, name_to_uri = _bundle_parameter(parameter, resolver, bundler)
         if parameter["in"] in HEADER_LOCATIONS:
             check_header_name(parameter["name"])
 
         if parameter["in"] == "formData":
             # We need to gather form parameters first before creating a composite parameter for them
             form_parameters.append(parameter)
+            form_name_to_uri.update(name_to_uri)
         elif parameter["in"] == ParameterLocation.BODY:
             # Take the original definition & extract the resource_name from there
             resource_name = None
@@ -330,17 +347,20 @@ def iter_parameters_v2(
                     definition=parameter,
                     is_required=parameter.get("required", False),
                     media_type=media_type,
+                    name_to_uri=name_to_uri,
                     resource_name=resource_name,
                     adapter=adapter,
                 )
         else:
-            yield OpenApiParameter.from_definition(definition=parameter, adapter=adapter)
+            yield OpenApiParameter.from_definition(definition=parameter, name_to_uri=name_to_uri, adapter=adapter)
 
     if form_parameters:
         form_data = form_data_to_json_schema(form_parameters)
         for media_type in form_data_media_types:
             # Individual `formData` parameters are joined into a single "composite" one.
-            yield OpenApiBody.from_form_parameters(definition=form_data, media_type=media_type, adapter=adapter)
+            yield OpenApiBody.from_form_parameters(
+                definition=form_data, media_type=media_type, name_to_uri=form_name_to_uri, adapter=adapter
+            )
 
 
 def iter_parameters_v3(
@@ -356,11 +376,11 @@ def iter_parameters_v3(
 
     bundler = Bundler()
     for parameter in chain(definition.get("parameters", []), shared_parameters):
-        parameter = _bundle_parameter(parameter, resolver, bundler)
+        parameter, name_to_uri = _bundle_parameter(parameter, resolver, bundler)
         if parameter["in"] in HEADER_LOCATIONS:
             check_header_name(parameter["name"])
 
-        yield OpenApiParameter.from_definition(definition=parameter, adapter=adapter)
+        yield OpenApiParameter.from_definition(definition=parameter, name_to_uri=name_to_uri, adapter=adapter)
 
     request_body_or_ref = operation.get("requestBody")
     if request_body_or_ref is not None:
@@ -372,6 +392,7 @@ def iter_parameters_v3(
         for media_type, content in request_body["content"].items():
             resource_name = None
             schema = content.get("schema")
+            name_to_uri = {}
             if isinstance(schema, dict):
                 content = dict(content)
                 if "$ref" in schema:
@@ -379,7 +400,8 @@ def iter_parameters_v3(
                 try:
                     to_bundle = cast(dict[str, Any], schema)
                     bundled = bundler.bundle(to_bundle, resolver, inline_recursive=True)
-                    content["schema"] = bundled
+                    content["schema"] = bundled.schema
+                    name_to_uri = bundled.name_to_uri
                 except BundleError as exc:
                     raise InvalidSchema.from_bundle_error(exc, "body") from exc
             yield OpenApiBody.from_definition(
@@ -387,6 +409,7 @@ def iter_parameters_v3(
                 is_required=required,
                 media_type=media_type,
                 resource_name=resource_name,
+                name_to_uri=name_to_uri,
                 adapter=adapter,
             )
 
@@ -400,6 +423,7 @@ def build_path_parameter_v2(kwargs: Mapping[str, Any]) -> OpenApiParameter:
 
     return OpenApiParameter.from_definition(
         definition={"in": ParameterLocation.PATH.value, "required": True, "type": "string", "minLength": 1, **kwargs},
+        name_to_uri={},
         adapter=v2,
     )
 
@@ -414,6 +438,7 @@ def build_path_parameter_v3_0(kwargs: Mapping[str, Any]) -> OpenApiParameter:
             "schema": {"type": "string", "minLength": 1},
             **kwargs,
         },
+        name_to_uri={},
         adapter=v3_0,
     )
 
@@ -428,6 +453,7 @@ def build_path_parameter_v3_1(kwargs: Mapping[str, Any]) -> OpenApiParameter:
             "schema": {"type": "string", "minLength": 1},
             **kwargs,
         },
+        name_to_uri={},
         adapter=v3_1,
     )
 

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/adapter/responses.py

@@ -226,7 +226,7 @@ def _prepare_schema(schema: JsonSchema, resolver: RefResolver, scope: str, nulla
 def _bundle_in_scope(schema: JsonSchema, resolver: RefResolver, scope: str) -> JsonSchema:
     resolver.push_scope(scope)
     try:
-        return bundle(schema, resolver, inline_recursive=False)
+        return bundle(schema, resolver, inline_recursive=False).schema
     except RefResolutionError as exc:
         raise InvalidSchema.from_reference_resolution_error(exc, None, None) from None
     finally:

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/checks.py

@@ -14,7 +14,7 @@ from schemathesis.core.failures import Failure
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.transport import Response
 from schemathesis.generation.case import Case
-from schemathesis.generation.meta import CoveragePhaseData
+from schemathesis.generation.meta import CoveragePhaseData, TestPhase
 from schemathesis.openapi.checks import (
     AcceptedNegativeData,
     EnsureResourceAvailability,
@@ -227,9 +227,27 @@ def negative_data_rejection(ctx: CheckContext, response: Response, case: Case) -
         and response.status_code not in allowed_statuses
         and not has_only_additional_properties_in_non_body_parameters(case)
     ):
+        extra_info = ""
+        phase = case.meta.phase
+        if phase and phase.name == TestPhase.COVERAGE and isinstance(phase.data, CoveragePhaseData):
+            parts: list[str] = []
+            if "Missing" in phase.data.description:
+                extra_info = f"\nInvalid component: {phase.data.description}"
+            else:
+                if phase.data.parameter:
+                    parts.append(f"parameter `{phase.data.parameter}`")
+                location = phase.data.parameter_location
+                if location:
+                    parts.append(f"in {location.name.lower()}")
+                description = phase.data.description.lower()
+                if parts:
+                    parts.append(f"({description})")
+                else:
+                    parts.append(f"{description}")
+                extra_info = "\nInvalid component: " + " ".join(parts)
         raise AcceptedNegativeData(
             operation=case.operation.label,
-            message=f"Invalid data should have been rejected\nExpected: {', '.join(config.expected_statuses)}",
+            message=f"Invalid data should have been rejected\nExpected: {', '.join(config.expected_statuses)}{extra_info}",
             status_code=response.status_code,
             expected_statuses=config.expected_statuses,
         )

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/schemas.py

@@ -406,7 +406,9 @@ class BaseOpenAPISchema(BaseSchema):
                     and operation.get_parameter(name=param_name, location=param_location) is not None
                 ):
                     continue
-                operation.add_parameter(OpenApiParameter.from_definition(definition=param, adapter=self.adapter))
+                operation.add_parameter(
+                    OpenApiParameter.from_definition(definition=param, name_to_uri={}, adapter=self.adapter)
+                )
         self.dispatch_hook("before_init_operation", HookContext(operation=operation), operation)
         return operation
 

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/stateful/dependencies/inputs.py

@@ -1,12 +1,13 @@
 from __future__ import annotations
 
-from typing import TYPE_CHECKING, Iterator
+from typing import TYPE_CHECKING, Any, Iterator
 
 from schemathesis.core import media_types
 from schemathesis.core.errors import MalformedMediaType
 from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
 from schemathesis.core.jsonschema.types import get_type
 from schemathesis.core.parameters import ParameterLocation
+from schemathesis.specs.openapi.adapter.parameters import resource_name_from_ref
 from schemathesis.specs.openapi.stateful.dependencies import naming
 from schemathesis.specs.openapi.stateful.dependencies.models import (
     CanonicalizationCache,
@@ -179,6 +180,14 @@ GENERIC_FIELD_NAMES = frozenset(
 )
 
 
+def _maybe_resolve_bundled(root: dict[str, Any], schema: dict[str, Any]) -> dict[str, Any]:
+    # Right now, the body schema comes bundled to dependency analysis
+    if BUNDLE_STORAGE_KEY in root and "$ref" in schema:
+        key = schema["$ref"].split("/")[-1]
+        return root[BUNDLE_STORAGE_KEY][key]
+    return schema
+
+
 def _resolve_body_dependencies(
     *,
     body: OpenApiBody,
@@ -190,12 +199,30 @@ def _resolve_body_dependencies(
     if not isinstance(schema, dict):
         return
 
-    # Right now, the body schema comes bundled to dependency analysis
-    if BUNDLE_STORAGE_KEY in schema and "$ref" in schema:
-        schema_key = schema["$ref"].split("/")[-1]
-        resolved = schema[BUNDLE_STORAGE_KEY][schema_key]
-    else:
-        resolved = schema
+    resolved = _maybe_resolve_bundled(schema, schema)
+
+    # For `items`, we'll inject an array with extracted resource
+    items = resolved.get("items", {})
+    if items is not None:
+        resource_name = naming.from_path(operation.path)
+
+        if "$ref" in items:
+            schema_key = items["$ref"].split("/")[-1]
+            original_ref = body.name_to_uri[schema_key]
+            resource_name = resource_name_from_ref(original_ref)
+            resource = resources.get(resource_name)
+            if resource is None:
+                resource = ResourceDefinition.inferred_from_parameter(name=resource_name, parameter_name=None)
+                resources[resource_name] = resource
+                field = None
+            else:
+                field = None
+            yield InputSlot(
+                resource=resource,
+                resource_field=field,
+                parameter_name=0,
+                parameter_location=ParameterLocation.BODY,
+            )
 
     # Inspect each property that could be a part of some other resource
     properties = resolved.get("properties", {})
@@ -272,7 +299,7 @@ def update_input_field_bindings(resource_name: str, operations: OperationMap) ->
     for operation in operations.values():
         for input_slot in operation.inputs:
             # Skip inputs not using this resource
-            if input_slot.resource.name != resource_name:
+            if input_slot.resource.name != resource_name or isinstance(input_slot.parameter_name, int):
                 continue
 
             # Re-match parameter to upgraded resource fields

{schemathesis-4.3.6 → schemathesis-4.3.8}/src/schemathesis/specs/openapi/stateful/dependencies/models.py

@@ -58,17 +58,24 @@ class DependencyGraph:
                     links: dict[str, LinkDefinition] = {}
                     for input_slot in consumer.inputs:
                         if input_slot.resource is output_slot.resource:
-                            body_pointer = build_response_body_pointer(
-                                output_slot.pointer, input_slot.resource_field, output_slot.cardinality
-                            )
+                            if input_slot.resource_field is not None:
+                                body_pointer = extend_pointer(
+                                    output_slot.pointer, input_slot.resource_field, output_slot.cardinality
+                                )
+                            else:
+                                # No resource field means use the whole resource
+                                body_pointer = output_slot.pointer
                             link_name = f"{consumer.method.capitalize()}{input_slot.resource.name}"
                             parameters = {}
-                            request_body = {}
+                            request_body: dict[str, Any] | list = {}
                             # Data is extracted from response body
                             if input_slot.parameter_location == ParameterLocation.BODY:
-                                request_body = {
-                                    input_slot.parameter_name: f"$response.body#{body_pointer}",
-                                }
+                                if isinstance(input_slot.parameter_name, int):
+                                    request_body = [f"$response.body#{body_pointer}"]
+                                else:
+                                    request_body = {
+                                        input_slot.parameter_name: f"$response.body#{body_pointer}",
+                                    }
                             else:
                                 parameters = {
                                     f"{input_slot.parameter_location.value}.{input_slot.parameter_name}": f"$response.body#{body_pointer}",
@@ -76,7 +83,10 @@ class DependencyGraph:
                             existing = links.get(link_name)
                             if existing is not None:
                                 existing.parameters.update(parameters)
-                                existing.request_body.update(request_body)
+                                if isinstance(existing.request_body, dict) and isinstance(request_body, dict):
+                                    existing.request_body.update(request_body)
+                                else:
+                                    existing.request_body = request_body
                                 continue
                             links[link_name] = LinkDefinition(
                                 operation_ref=f"#/paths/{consumer_path}/{consumer.method}",
@@ -110,7 +120,9 @@ class DependencyGraph:
                     continue
                 resource = self.resources[input.resource.name]
                 if (
-                    input.resource_field not in resource.fields and resource.name not in known_mismatches
+                    input.resource_field not in resource.fields
+                    and resource.name not in known_mismatches
+                    and input.resource_field is not None
                 ):  # pragma: no cover
                     message = (
                         f"Operation '{operation.method.upper()} {operation.path}': "
@@ -120,21 +132,21 @@ class DependencyGraph:
                     matches = difflib.get_close_matches(input.resource_field, resource.fields, n=1, cutoff=0.6)
                     if matches:
                         message += f". Closest field - `{matches[0]}`"
-                    elif resource.fields:
+                    if resource.fields:
                         message += f". Available fields - {', '.join(resource.fields)}"
                     else:
                         message += ". Resource has no fields"
                     raise AssertionError(message)
 
 
-def build_response_body_pointer(pointer: str, field: str, cardinality: Cardinality) -> str:
-    if not pointer.endswith("/"):
-        pointer += "/"
+def extend_pointer(base: str, field: str, cardinality: Cardinality) -> str:
+    if not base.endswith("/"):
+        base += "/"
     if cardinality == Cardinality.MANY:
         # For arrays, reference first element: /data → /data/0
-        pointer += "0/"
-    pointer += encode_pointer(field)
-    return pointer
+        base += "0/"
+    base += encode_pointer(field)
+    return base
 
 
 @dataclass
@@ -151,7 +163,7 @@ class LinkDefinition:
     parameters: dict[str, str]
     """Parameter mappings (e.g., {'path.id': '$response.body#/id'})"""
 
-    request_body: dict[str, str]
+    request_body: dict[str, str] | list
     """Request body (e.g., {'path.id': '$response.body#/id'})"""
 
     __slots__ = ("operation_ref", "parameters", "request_body")
@@ -240,10 +252,12 @@ class InputSlot:
 
     # Which resource is needed
     resource: ResourceDefinition
-    # Which field from that resource (e.g., "id")
-    resource_field: str
+    # Which field from that resource (e.g., "id").
+    # None if passing the whole resource
+    resource_field: str | None
     # Where it goes in the request (e.g., "userId")
-    parameter_name: str
+    # Integer means index in an array (only single items are supported)
+    parameter_name: str | int
     parameter_location: ParameterLocation
 
     __slots__ = ("resource", "resource_field", "parameter_name", "parameter_location")
@@ -284,8 +298,9 @@ class ResourceDefinition:
         return cls(name=name, fields=[], types={}, source=DefinitionSource.SCHEMA_WITHOUT_PROPERTIES)
 
     @classmethod
-    def inferred_from_parameter(cls, name: str, parameter_name: str) -> ResourceDefinition:
-        return cls(name=name, fields=[parameter_name], types={}, source=DefinitionSource.PARAMETER_INFERENCE)
+    def inferred_from_parameter(cls, name: str, parameter_name: str | None) -> ResourceDefinition:
+        fields = [parameter_name] if parameter_name is not None else []
+        return cls(name=name, fields=fields, types={}, source=DefinitionSource.PARAMETER_INFERENCE)
 
 
 class DefinitionSource(enum.IntEnum):