BoxLang 🚀 A New JVM Dynamic Language Learn More...


v3.1.1+10 Modules

Copyright Since 2005 ColdBox Platform by Luis Majano and Ortus Solutions, Corp |

Welcome to the ColdBox Swagger Module

This module automatically generates OpenAPI ( fka Swagger ) documenation from your configured application and module routes. This module utilizes the v3.0.2 OpenAPI Specification


Apache License, Version 2.0.


System Requirements

  • Lucee 5+
  • Adobe ColdFusion 2016+


To operate, the module requires that SES routing be enabled in your application. For more information read the official documentation.

Install cbSWagger ( via Commandbox )

box install cbSwagger

Note: Omit the box from your command, if you are already in the Commandbox interactive shell

Configure cbSwagger to auto-detect your API Routes

By default, cbSwagger looks for routes beginning with /api/* prefix. By adding a cbSwagger configuration key to your Coldbox configuration, you can add additional metadata to the OpenAPI JSON produced by the module entry point and configure this module for operation.

  • routes:array : An array of route prefixes to search for and add to the resulting documentation.
  • defaultFormat:string : The default output format of the documentation. Valid options are json and yml.

A full configuration example is provided below:

cbswagger = {
	// The route prefix to search.  Routes beginning with this prefix will be determined to be api routes
	"routes" : [ "api" ],
	// The default output format: json or yml
	// Routes to exclude by prefix.  Routes beginning with this prefix will be excluded
	"excludeRoutesPrefix" : [ "cbSwagger", "relax" ],
	// Any routes to exclude - may use exact matches or globbing patterns e.g `[ "api/v1/mysecret" ]` or `[ "**/secret", "**/undocumented" ]` (no initial `/`, trailing `/` optional for routes)
	"excludeRoutes"	: [],
    // Routes to exclude based on event
    "excludeEvents"       : [],
	"defaultFormat" : "json",
	// A convention route, relative to your app root, where request/response samples are stored ( e.g. resources/apidocs/responses/[module].[handler].[action].[HTTP Status Code].json )
	"samplesPath" : "resources/apidocs",
	// Information about your API
	"info"		:{
		// A title for your API
		"title" 			: "My Awesome API",
		// A description of your API
		"description" 		: "This API produces amazing results and data.",
		// A terms of service URL for your API
		"termsOfService"	: "",
		//The contact email address
		"contact" 		:{
			"name": "API Support",
			"url": "",
			"email": "[email protected]"
		//A url to the License of your API
		"license": {
			"name": "Apache 2.0",
			"url": ""
		//The version of your API

		"externalDocs" : {
			"description": "Find more info here",
			"url": ""

	// Tags
	"tags" : [
			"name": "pet",
			"description": "Pets operations"

	"servers" : [
			"url" 			: "",
			"description" 	: "The main production server"
			"url" 			: "",
			"description" 	: "The dev server"

	// An element to hold various schemas for the specification.
	"components" : {

		// Define your security schemes here
		"securitySchemes" : {
			"UserSecurity" : {
				// REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "oauth2", "openIdConnect".
				"type" 			: "http",
				// A short description for security scheme. CommonMark syntax MAY be used for rich text representation.
				"description" 	: "HTTP Basic auth",
				// REQUIRED. The name of the HTTP Authorization scheme to be used in the Authorization header as defined in RFC7235.
				"scheme" 		: "basic"
			"APIKey" : {
				"type" 			: "apiKey",
				"description" 	: "An API key for security",
				"name" 			: "x-api-key",
				"in" 			: "header"

	// A default declaration of Security Requirement Objects to be used across the API.
	// Only one of these requirements needs to be satisfied to authorize a request.
	// Individual operations may set their own requirements with `@security`
	"security" : [
		{ "APIKey" : [] },
		{ "UserSecurity" : [] }

Outputting Documentation (json|yml)

You can visit the API documentation by hitting the /cbSwagger route. This will trigger the default format (json) to be sent to the output.

Format Parameter

You can force the format by using the ?format={format} in the URI. The valid options are json and yml


Handler Introspection & Documentation attributes

cbSwagger will automatically introspect your API handlers provided by your routing configuration. You may provide additional function attributes (metadata), which will be picked up and included in your documentation.

The content body of these function metadata/attributes may be provided as:

  • JSON
  • plain text
  • $ref file pointer

Here are some additional pointers for you:

  • Metadata attributes using a response- prefix in the annotation will be parsed as responses. For example @response-200 { "description" : "User successfully updated", "schema" : "/resources/apidocs/schema.json##user" } would populate the 200 responses node for the given method ( in this case, PUT /api/v1/users/:id ). If the annotation text is not valid JSON or a file pointer, this will be provided as the response description.
  • Metadata attributes prefixed with param- will be included as parameters to the method/action. Example: @param-firstname { "type": "string", "required" : "false", "in" : "query" } If the annotation text is not valid JSON or a file pointer, this will be provided as the parameter description and the parameter requirement will be set to false.
  • Parameters provided via the route ( e.g. the id in /api/v1/users/:id ) will always be included in the array of parameters as required for the method. Annotations on those parameters may be used to provide additional documentation.
  • Security Requirement Objects defined in the cbSwagger config will be displayed on every API method, except methods that override the default with @security. You may use the name of a security scheme, a JSON array of Security Requirement Objects, or a file pointer. Security Requirement Objects must have the same name as a Security Scheme Object defined under components in cbSwagger settings.
  • You may also provide paths to JSON files which describe complex objects which may not be expressed within the attributes themselves. This is ideal to provide an endpoint for parameters and responses If the atttribute ends with .json, this will be included in the generated OpenAPI document as a $ref include.
  • Attributes which are not part of the swagger path specification should be prefixed with an x-, x-attributes are an official part of the OpenAPI Specification and may be used to provide additional information for your developers and consumers
  • hint attributes, provided as either comment @ annotations or as function body attributes will be treated as the description for the method
  • description due to variances in parsing comment annotations, description annotations must be provided as attributes of the function body. For example, you would use function update( event, rc, prc ) description="Updates a user"{} rather than @description Updates a user
  • tags : A list of tags to include in the operation metadata: @tags Authentication,Authors.

Basic Example:

 * Add a new user into the system
 * @tags Users,Authentication
function add( event, rc, prc )
	x-SomeAdditionalInfo="Here is some additional information on this path"

	...[ Your code here ]...


Example using file pointers:

* @hint Adds a new user
* @x-parameters ~users.add.parameters.json##user
* @responses ~users.add.responses.json
* @x-SomeAdditionalInfo Here is some additional information on this path
function add( event, rc, prc ){

	...[ Your code here ]...


Example using JSON ( + file pointers )

Note: Because CFML has its own parameters key within the function metadata, we would pull in a document of parameters using x-parameters, which will appear as parameters in the swagger method definition

 * @summary Adds a new user
 * @hint Adds a new user with a longer description.
 * @x-parameters ~users.add.parameters.json
 * @responses ~users.add.responses.json
 * @x-SomeAdditionalInfo Here is some additional information on this path
 * @security
 * @requestBody {
 * 	"description" : "User to add",
 * 	"required" : true,
 * 	"content" : {
 * 		"application/json" : {
 * 			"schema" : { "$ref" : "/includes/apidocs/NewUser.json" }
 * 		}
 * 	}
 * }
function add( event, rc, prc ){

 * @param-firstname { "schema" : { "type": "string" }, "required" : "false", "in" : "query" }
 * @param-lastname { "schema" : { "type": "string" }, "required" : "false", "in" : "query" }
 * @param-email { "schema" : { "type": "string" }, "required" : "false", "in" : "query" }
 * @security [ { "APIKey": [] } ]
 * @response-default { "description" : "User successfully updated", "content" : { "application/json" : { "schema" : { "$ref" : "/resources/apidocs/schema.json##user" } } } }
function update( event, rc, prc ) description="Updates a user"{

~ expand path

The shortcut notation to expand the path to the samplesPath setting is by using the ~ prefix. However, please note that this prefix only works on the annotations within a component NOT within a json document.

Using convention paths to generate documentation schema and samples

Conventions also exist, which will allow you to place JSON files within a conventions directory, defined by the samplesPath setting, which will automatically be included as part of your documentation. The default samples path is resources/apidocs. A JSON file placed, for example, at the location of resources/apidocs/responses/api.v1.Users.add.201.json, would automatically be picked as the 201 status code response for the add method of the Users handler, within the api.v1 directory.

In addition to the responses sub-directory, the directories of parameters and responseBody will also be inspected for content which matches the route/event being parsed. The latter two directories are parsed as-is, and are assumed to be in a valid Swagger specification format.

File naming conventions supported include:

  • [handler].[methodName].json - all sample types
  • [moduleName].[handler].[methodName].json - all sample types
  • [handler].[methodName](.[status code]).json - responses with or without status codes
  • [moduleName].[handler].[methodName](.[status code]).json - responses with or without status codes

Operation Ids

You can influence the operation Ids by adding a displayName to your handler CFC.

component displayName="API.v1.Users"{


Copyright Since 2016 Ortus Solutions, Corp


Because of His grace, this project exists. If you don't like this, then don't read it, its not for you.

"Therefore being justified by faith, we have peace with God through our Lord Jesus Christ: By whom also we have access by faith into this grace wherein we stand, and rejoice in hope of the glory of God. And not only so, but we glory in tribulations also: knowing that tribulation worketh patience; And patience, experience; and experience, hope: And hope maketh not ashamed; because the love of God is shed abroad in our hearts by the Holy Ghost which is given unto us. ." Romans 5:5


"I am the way, and the truth, and the life; no one comes to the Father, but by me (JESUS)" Jn 14:1-12


All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.


3.1.1 - 2024-06-05


  • Fix box.json version of swagger-sdk

3.0.0 - 2024-05-30


  • Interaction to WireBox via base test case and not application scope
  • Removed support for Adobe Coldfusion 2016
  • Removes default key from response object if empty and other status code keys are present Issue #28


  • Virtual application testing
  • Updated github actions
  • Updated module template provisions
  • Added support for samples path shortcut annotation (~) in annotation JSON $ref pointers
  • Added support for using globbing patterns in excludeRoutes array. Issue #37
  • Added cbswagger endpoint caching ( defaults to true ) and cacheEnabled setting.
  • Added URL convention for clearing/bypassing endpoint cache ( swaggerCache=false )

[2.7.0] => 2021-OCT-1


  • Added the ability to excludes routes by prefix

[2.5.1] => 2021-MAY-12


  • Regression on @tags being json syntax

[2.5.0] => 2021-MAY-10


  • Added the ability to add @tags to annotations so they can show up on the operations metadata as array of tags

[2.4.0] => 2021-MAY-04


  • Removed externalDocs from the info struct as it is not supported on the OpenApi Spec v3.


  • operationID renamed to x-coldbox-operation since they are ColdBox centric. It was also causing issues using operationID as it needed to be unique across the entire swagger document.

[2.3.0] => 2020-SEP-08


  • Add CORS support for cbswagger endpoint #25

[2.2.1] => 2020-MAY-12


  • On lucee the displayName defaults to Component, skipping this default to select the correct operationId for the resource
  • The moduleName hint for the appendFunctionInfo was mispelled

[2.2.0] => 2020-MAY-12


  • When defining external files in annotations, you can now prefix them with ~ and this will expand to the module setting of samplesPath. This way you can write your annotations in a more cleaner manner.
  • Auto-publishing of changelog's to github
  • New changelog looks according to

[2.1.1] => 2020-MAY-06

  • Updates to support ColdBox 6

[2.1.0] => 2020-APR-16


  • Allow @security annotation to override the security mechanisms defined in config. The value can be a JSON array of security directives, a file pointer, or for convenience the name of a security schema. See readme for examples.
  • Support for discovering responses and examples by conventions in the resources/apidocs folder convention. See readme for examples.
  • Ability to exclude routes from the generated spec via the excludeRoutes configuration key.


  • Add default samplesPath config item to resources/apidocs in the ModuleConfig
  • Add convention samples parsing and refactor segment parsing to separate methods


  • Fixes for new router syntax not parsing actions correctly or not taking into account actions attached to verbs

[2.0.0] => 2019-SEP-02

  • feature: Upgraded to swagger-sdk 2.0.0 to support OpenAPI 3.0.x. A great guide on migrating is here:

  • Migrated cbSwagger settings to the moduleSettings struct instead of top-level in the config/ColdBox.cfc. Make sure you move your settings.

  • feature : You can now pass a format to the /cbSwagger endpoint to either get the OpenAPI doc as json or yml. Eg: /cbswagger?format=yml

  • feature : You have two distinct routes for the json and yml formats: /cbSwagger/json and /cbSwagger/yml

  • You can choose your default output format via the module settings: defaultFormat setting. Valid options are json and yml

  • features : Support for ColdBox 5 event routing and response routing.

  • improvement : You can now tag your handlers with a displayName that will be used for operation ID building

  • improvement : Improved the way operation Ids are reported so they can be unique when reusing handler actions.

  • improvement : Refactored createLinkedHashMap() -> structNew( "ordered" )

  • improvement: Removed lucee 4.5, acf11 support.


  • Fix for detecting ColdBox 5


  • Update build process for new module standards
  • ColdBox 5 Compatiblity for inherited entry points
  • Non RESTFul action params where not being translated on routes.
  • Fixed int32 to integer on examples and tests so they can validate in the schema


  • Added Editor standards
  • Fix to modules invocation path on RouteParser when no cfmapping defined.
  • Updates to readme
  • Set the contact object and license object according to spec 2 defaults
  • Default the API schemes to http/s
  • Dropped cf10 from automated tests
  • Added API Docs to S3 via Travis


  • Fixes a bug where an error was thrown when an api route does not contain a handler
  • Implements parsing of Coldbox route parameter types


  • Adds new function metadata handling for parameters and responses
  • Auto maps hints provided in function metadata to as method descriptions


  • Add $ref sanitization and inherited metadata introspection
  • Add the ability to handle arrays returned from $ref keys. Prepends moudule routing to operation id
  • ACF syntax corrections and add better throw for attempts to parse component with syntax errors


  • Normalization to new module templates
  • HTTP Verbs should be lower case #1


  • Exception when handler or module does not exist in a route.


  • Overall syntax Ortus standards
  • Some var scoping issues
  • Added persistence and injections to services
  • Added more documentation to handler, services and readme
  • Added swagger-sdk as a module dependency


  • Add module introspection
  • Forgebox integration updates


  • Initial Module Release

$ box install cbSwagger

No collaborators yet.
  • {{ getFullDate("2016-10-01T08:56:12Z") }}
  • {{ getFullDate("2024-06-05T17:52:58Z") }}
  • 16,286
  • 197,405