```

/// tip

The `callback_url` query parameter uses a Pydantic <a href="https://docs.pydantic.dev/latest/api/networks/" class="external-link" target="_blank">Url</a> type.

///

The only new thing is the `callbacks=invoices_callback_router.routes` as an argument to the *path operation decorator*. We'll see what that is next.

## Documenting the callback

                                                                └─────────┘
```

In a given setup, there are `n` MinIO instances talking to `m` KES servers but only `1` central KMS. The most simple setup consists of `1` MinIO server or cluster talking to `1` KMS via `1` KES server.

environment.title = Production

# Does it enable the Framework internal debug? (true only when emergency)
framework.debug = false

# one day: 86400000, three days: 259200000, five days: 432000000, one week: 604800000, one year: 31556926000
# special script :: absolute mode: $(2014/07/10), relative mode: addDay(3).addMonth(4)
# The milliseconds for (relative or absolute) adjust time (set only when test) @LongType *dynamic in development
time.adjust.time.millis = 0

You will see the automatic API docs for the main app, including only its own _path operations_:

<img src="/img/tutorial/sub-applications/image01.png">

And then, open the docs for the sub-application, at <a href="http://127.0.0.1:8000/subapi/docs" class="external-link" target="_blank">http://127.0.0.1:8000/subapi/docs</a>.

    for (Type bound : bounds) {
      Type componentType = getComponentType(bound);
      if (componentType != null) {
        // Only the first bound can be a class or array.
        // Bounds after the first can only be interfaces.
        if (componentType instanceof Class) {
          Class<?> componentClass = (Class<?>) componentType;
          if (componentClass.isPrimitive()) {

        .onlyIfCached()
        .noTransform()
        .immutable()
        .build()
    assertThat(cacheControl.toString()).isEqualTo(
      "no-cache, no-store, max-age=1, max-stale=2, min-fresh=3, only-if-cached, " +
        "no-transform, immutable",
    )
    assertThat(cacheControl.noCache).isTrue()
    assertThat(cacheControl.noStore).isTrue()
    assertThat(cacheControl.maxAgeSeconds).isEqualTo(1)

     * <p>
     * Note: only one, this method or {@link #getRecommendedVersion()} method must return non-{@code null} value.
     */
    @Nullable
    VersionRange getVersionRange();

    /**
     * Returns the recommended version of this constraint, or {@code null} if none.
     * <p>
     * Note: only one, this method or {@link #getVersionRange()} method must return non-{@code null} value.

# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See

    CipherSuite.TLS_AES_256_GCM_SHA384,
    CipherSuite.TLS_CHACHA20_POLY1305_SHA256,
    CipherSuite.TLS_AES_128_CCM_SHA256,
    CipherSuite.TLS_AES_128_CCM_8_SHA256,
  )

/**
 * A TLS 1.3 only Connection Spec. This will be eventually be exposed
 * as part of MODERN_TLS or folded into the default OkHttp client once published and
 * available in JDK11 or Conscrypt.
 */
private val TLS_13 =

### TLS with SNI Extension

**Only one process** in the server can be listening on a specific **port** in a specific **IP address**. There could be other processes listening on other ports in the same IP address, but only one for each combination of IP address and port.

TLS (HTTPS) uses the specific port `443` by default. So that's the port we would need.