python-openstackclient — Interactions

Interactions — python-openstackclient — branch stable/2026.2

Branch stable/2026.2 @ 8bb083b83829 — repository https://opendev.org/openstack/python-openstackclient — analysed on 2026-11-01

Database, RabbitMQ and cache: none. All exchanges are outbound HTTP through keystoneauth1, plus local files and stdin. The complete list of operations, per service, is [_rewrite/api-surface_stable-2026.2.md](_rewrite/api-surface_stable-2026.2.md).

1. The three client stacks

All share one keystoneauth session, and therefore one token (osc-lib:osc_lib/clientmanager.py:195). The user agent is python-openstackclient (openstackclient/common/clientmanager.py:40).

2. Keystone

The stub shows what the CLI needs from that token: a catalog with public, internal and admin interfaces and a region (openstackclient/shell.py:84, and the stub in the probe). The default interface is public, set with --os-interface (osc-lib:osc_lib/shell.py:274).

Each run authenticates once. The token is not reused between invocations unless a token plugin or a cache is configured [inferred]. A loop of 100 commands therefore costs 100 POST /v3/auth/tokens.

Sample frame

POST /identity/v3/auth/tokens HTTP/1.1
Content-Type: application/json
User-Agent: openstacksdk/… keystoneauth1/5.17.0 python-requests/…

{"auth": {"identity": {"methods": ["password"], "password": {"user": {"name": "admin", "domain": {"name": "Default"}, "password": "***"}}},
          "scope": {"project": {"name": "admin", "domain": {"name": "Default"}}}}}

[Body shape inferred from the keystoneauth plugin; the route is observed.]

3. Service discovery

The SDK reads each service's version document before its first call [observed], and the catalog decides the endpoint.

4. Microversions

Requests carry OpenStack-API-Version: <service> <version> [observed].

Values gated in the code: compute 2.2 to 2.104 (55 values), volume 3.1 to 3.66 (29 values). The list per command is in [_rewrite/client-contract_stable-2026.2.json](_rewrite/client-contract_stable-2026.2.json).

Sample frame [observed]

GET /compute/v2.1/servers/detail?deleted=False HTTP/1.1
OpenStack-API-Version: compute 2.100
X-Auth-Token: stub-token

5. Outbound REST summary

Discovered from the Keystone catalog for every service. Authentication is X-Auth-Token.

6. Object store detail

The account shown is the last part of the endpoint path, not an answer from the service (openstackclient/api/object_store_v1.py:532). A Swift replacement must therefore keep AUTH_<id> at the end of the catalog URL.

7. Other local interactions

Source: reverse-spec-python-openstackclient/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.