"The filename, directory name, or volume label syntax is incorrect.", "The system cannot find the file specified.",
            "Cannot create a file when that file already exists.", "The handle is invalid.", "The specified path is invalid.",
            "The system cannot find the path specified.", "The specified path is invalid.",

So, what we will do next is add the code to document how that *external API* should look like to receive the callback from *your API*.

That documentation will show up in the Swagger UI at `/docs` in your API, and it will let external developers know how to build the *external API*.

This example doesn't implement the callback itself (that could be just a line of code), only the documentation part.

/// tip

#### `HeroCreate` - the *data model* to create a hero { #herocreate-the-data-model-to-create-a-hero }

Now we create a `HeroCreate` model, this is the one that will **validate** the data from the clients.

It has the same fields as `HeroBase`, and it also has `secret_name`.

* `title`: the title of your API.
* `oauth2_redirect_url`: you can use `app.swagger_ui_oauth2_redirect_url` here to use the default.
* `swagger_js_url`: the URL where the HTML for your Swagger UI docs can get the **JavaScript** file. This is the custom CDN URL.

That demonstrates how the Proxy (Traefik) uses the path prefix and how the server (Uvicorn) uses the `root_path` from the option `--root-path`.

### Check the docs UI { #check-the-docs-ui }

But here's the fun part. ✨

            "The client does not have the necessary access rights to perform the requested function.", "Access is denied.",
            "The TID specified was invalid.", "The handle is invalid.", "The network name cannot be found.",
            "Not enough storage is available to process this command.", "The media is write protected.", "The device is not ready.",

            "The client does not have the necessary access rights to perform the requested function.", "Access is denied.",
            "The TID specified was invalid.", "The handle is invalid.", "The network name cannot be found.",
            "Not enough storage is available to process this command.", "The media is write protected.", "The device is not ready.",

    /**
     * Performs MAC signing of the SMB. This is done as follows.
     * The signature field of the SMB is overwritten with the sequence number;
     * The MD5 digest of the MAC signing key + the entire SMB is taken;
     * The first 8 bytes of this are placed in the signature field.
     *
     * @param data
     *            The data.
     * @param offset
     *            The starting offset at which the SMB header begins.

When you try to open the URL for the first time (or click the "Execute" button in the docs) the browser will ask you for your username and password:

<img src="/img/tutorial/security/image12.png">

## Check the username { #check-the-username }

Here's a more complete example.

Use a dependency to check if the username and password are correct.

{* ../../docs_src/security/tutorial005_an_py310.py hl[106,108:116] *}

## Verify the `username` and data shape { #verify-the-username-and-data-shape }

We verify that we get a `username`, and extract the scopes.