fastapi/fastapi
The user-facing feature set is the decorator API (`@app.get/put/post/delete/options/head/patch/trace`, `@app.websocket`, `@app.middleware`, `@app.exception_handler`), the parameter-declaration vocabulary (`Path`, `Query`, `Header`, `Cookie`, `Body`, `Form`, `File`, `Depends`, `Security`), the auto-generated OpenAPI 3.1 document plus Swagger UI and ReDoc pages, and seven built-in security schemes. This version adds three substantial features beyond classic FastAPI: Server-Sent Events via `response_class=EventSourceResponse`, JSON-Lines streaming from generator endpoints, and `app.frontend()` for serving built SPA assets as low-priority routes. Dependencies gained an explicit `scope` of `"function"` or `"request"`. Two response classes — `ORJSONResponse` and `UJSONResponse` — are now deprecated in favour of a Pydantic `dump_json` fast path.
- `FastAPI.setup()` registers up to four non-schema routes at construction: `openapi_url` (default `/openapi.json`), `docs_url` (`/docs`, Swagger UI), `swagger_ui_oauth2_redirect_url`, and `redoc_url` (`/redoc`); each is skipped when its URL is set to `None`.
- All eight HTTP verb decorators plus `api_route`, `add_api_route`, `websocket`, `add_api_websocket_route`, `websocket_route`, `on_event`, `middleware`, `exception_handler` and `include_router` are defined on `FastAPI` and mirrored on `APIRouter`.
- Server-Sent Events: setting `response_class=EventSourceResponse` on a generator path operation makes the router encode each yielded item into SSE wire format via `format_sse_event`, set `Cache-Control: no-cache` and `X-Accel-Buffering: no`, and inject a `: ping` keepalive comment every `_PING_INTERVAL` (15s) of idleness.
- `ServerSentEvent` is a Pydantic model with `data`, `raw_data`, `event`, `id`, `retry`, `comment`; validators reject multi-line `event`/`id` values and null bytes in `id`, and a model validator forbids setting `data` and `raw_data` together.
- JSON-Lines streaming: when `is_json_stream` is set, generator endpoints are wrapped into a `StreamingResponse` with media type `application/jsonl`, each item serialized by `_serialize_data` and terminated with `\n`.
- `app.frontend(path, directory=..., fallback="auto", check_dir="auto")` serves a built SPA; API routes match first and the frontend is consulted only through `_match_low_priority`, with `fallback="auto"` preferring `404.html` and falling back to `index.html` only for navigation requests that accept `text/html`.
- Seven security schemes ship in `fastapi/security/`: `APIKeyQuery`, `APIKeyHeader`, `APIKeyCookie`, `HTTPBasic`, `HTTPBearer`, `HTTPDigest`, `OAuth2` (with `OAuth2PasswordBearer` and `OAuth2AuthorizationCodeBearer`) and `OpenIdConnect`, plus the `OAuth2PasswordRequestForm` dependency and `SecurityScopes`.
- Dependency scoping is a first-class feature: `params.Depends` is a frozen dataclass carrying `dependency`, `use_cache` and `scope: Literal["function", "request"] | None`, and `DependencyScopeError` is raised at `get_dependant` time if a request-scoped generator dependency depends on a function-scoped one.
- `app.webhooks` is a dedicated `APIRouter` whose routes are documented under the OpenAPI `webhooks` key rather than `paths`.
- `strict_content_type` (default `True`) is threaded from app → router → route → handler; when False, a body with no Content-Type header is still parsed as JSON.
- `ORJSONResponse` and `UJSONResponse` are marked `@deprecated` with `FastAPIDeprecationWarning`, directing users to declare a return type so Pydantic serializes on the Rust side instead.
- `app.dependency_overrides` is a plain dict on the app used as the `dependency_overrides_provider`; `solve_dependencies` re-derives a fresh `Dependant` for any overridden callable so the substitute's own signature is honoured.
- Repo-level developer features beyond the library: `scripts/docs.py` is a Typer CLI for building/serving the 13-locale docs site and generating `README.md` from `docs/en/docs/index.md`, and `scripts/translate.py` drives a `pydantic_ai.Agent("openai-chat:gpt-5.5")` to machine-translate docs pages.