stripped-down version of the Cashlink API to showcase an issue in Insomnia

swagger.yaml

openapi: 3.0.3
info:
  title: Cashlink API
  version: 2.3.0
  description: External Distribution API
  contact:
    email: support@cashlink.de
paths:
  /v2/investors/:
    post:
      operationId: v2_investors_create
      description: |-
        Create an investor object from external data. This endpoint can be safely
        called multiple times with the same X-Idempotency-Key.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalInvestorCreationRequest'
        required: true
      security:
      - oauth2:
        - investors:write
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExternalInvestor'
          description: ''
components:
  schemas:
    ExternalInvestor:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
    ExternalInvestorCreationRequest:
      type: object
      properties:
        is_beneficiary:
          type: boolean
          writeOnly: true
          description: Whether the investor is the only beneficiary of this transaction.
            Must be set to true.
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: http://localhost/api/external/oauth/token
          scopes:
            investors:read: Investor read operations
            investors:write: Investor operations
            investments:write: Investment operations
            investments:read: Investment operations
            documents:write: Documents operations
servers:
- url: http://127.0.0.1:8000
  description: Dev environment