This document

Unauthenticated, so that a caller can fetch this document before it has a key configured. Generated from the running server's own routes, so it cannot drift from the API it describes.

The same document is served at GET /openapi.json and GET /.well-known/openapi. The extension chooses the default serialization — YAML here, JSON there — and an explicit Accept of application/json or application/yaml overrides it either way.