Runtime & gateway

x-amazon-apigateway-api-key-source

`x-amazon-apigateway-api-key-source` appears on security schemes and at the root of the document. Its value is a string. Used by 2 providers across 3 OpenAPI documents. It sits in the `x-amazon-` namespace, so its meaning is defined by amazon tooling rather than by OpenAPI. Observed values include `HEADER`, `AUTHORIZER`. Consistent with runtime & gateway — this is inferred from where the key appears and what it carries, not from any published definition.

Runtime & gateway x-amazon- namespace derived description
How this description was produced. It is assembled from what was measured in the corpus — where this key appears in a document, what shape its value takes, the values observed, and how many providers use it. It is not taken from a published definition, because for most extensions none exists. Read it as evidence, not as a specification. If you own this extension and want it described properly, tell us.
3 occurrences
3 documents
2 providers
vendor-named

Where it appears

Location in the documentOccurrences
root 1
securityScheme 2

What its value looks like

Value shapeOccurrences
string3

Observed values

Sampled from the specifications, most frequent first.

HEADERAUTHORIZER

Providers publishing it

All 2.

the-climate-corporationvisier

Why this is not in OpenAPI

Extensions exist because a provider needed something the specification would not carry. Most of what they hold is not the API contract at all — it is operational metadata about the contract: documentation, lifecycle, policy, provenance, and now agents. That metadata is usually better placed alongside the contract, in an Overlay or an APIs.json index, than crammed inside it. See everything else doing the runtime & gateway job.