# Parameters: Path, Query, Header and Cookie — OpenAPI / Swagger

Source: https://www.skillbyai.com/en/openapi/p-params

> Define parameters with locations, schemas, required flags and serialisation styles.

## Inputs outside the body

**Parameters** describe inputs other than the request body. Each has a **`name`**, a location **`in`** (`path`, `query`, `header` or `cookie`), a **`schema`**, and optionally `description`, `example` and `deprecated`. **Path parameters** must have `required: true` and must appear in the path template. **Query parameters** carry filters, sorting and pagination (`?status=PAID&limit=20`). **Header parameters** carry metadata such as `Idempotency-Key` or `X-Request-Id`; do not describe `Accept`, `Content-Type` or `Authorization` as parameters, since content negotiation and security schemes cover those. **Cookie parameters** are for cookie values. **Serialisation** of arrays and objects is controlled by **`style`** and **`explode`**: for query arrays the default `form` style with `explode: true` produces `?tag=a&tag=b`, while `explode: false` produces `?tag=a,b`; `deepObject` style serialises `?filter[status]=PAID`. Constrain values with schema keywords (`enum`, `minimum`, `maximum`, `pattern`, `default`) so documentation and validators know the rules, and define reusable parameters in `components/parameters`.

## Reusable parameters with constraints

Pagination, filtering and an idempotency header.

```yaml
components:
  parameters:
    OrderId:
      name: orderId
      in: path
      required: true
      description: Order identifier
      schema: { type: string, pattern: '^ord_[A-Za-z0-9]{12}$' }
    Limit:
      name: limit
      in: query
      schema: { type: integer, minimum: 1, maximum: 100, default: 20 }
    Cursor:
      name: cursor
      in: query
      description: Opaque cursor from the previous page's nextCursor
      schema: { type: string }
    Status:
      name: status
      in: query
      style: form
      explode: true                    # ?status=PAID&status=SHIPPED
      schema:
        type: array
        items: { type: string, enum: [PLACED, PAID, SHIPPED, CANCELLED] }
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      description: Unique key per logical request; retries reuse it
      schema: { type: string, format: uuid }
```

## Fields on a courier form

The path is the delivery address, query parameters are delivery preferences ("leave at reception"), headers are the stickers on the parcel ("fragile", tracking number) and the body is what is inside the box.

**Quiz:** Which statement about path parameters in OpenAPI is true?

- [ ] They are optional by default
- [x] They must be marked required: true and appear in the path template
- [ ] They are placed in the request body
- [ ] They cannot have a schema

*Answer:* They must be marked required: true and appear in the path template. Path parameters are always required and must match a template variable in the path.