This client could be a browser with a frontend, a code from someone else, an IoT device, etc.

You could need to tell the client that:

* The client doesn't have enough privileges for that operation.
* The client doesn't have access to that resource.
* The item the client was trying to access doesn't exist.
* etc.

`OAuth2PasswordBearer` makes **FastAPI** know that it is a security scheme. So it is added that way to OpenAPI.

But `OAuth2PasswordRequestForm` is just a class dependency that you could have written yourself, or you could have declared `Form` parameters directly.

But as it's a common use case, it is provided by **FastAPI** directly, just to make it easier.

///

### Use the form data { #use-the-form-data }

   *
   * - https://github.com/jspecify/jdk/commit/71d826792b8c7ef95d492c50a274deab938f2552
   */
  /*
   * TODO(cpovirk): Is the unchecked cast avoidable? Would System.arraycopy be similarly fast (if
   * likewise not type-checked)? Could our single caller do something different?
   */
  @SuppressWarnings({"nullness", "unchecked"})

            <configuration>
              <excludes>
                <!-- Yes, we want to exclude ForceGuavaCompilation 4 times: -->
                <!-- (And we might as well exclude DummyJavadocClass 3 times (though it would be harmless to include).) -->
                <!-- 1. Don't compile it (since that requires a *non-test* dep on gwt-user. -->
                <exclude>**/ForceGuavaCompilation*</exclude>

That way, the sub-application will know to use that path prefix for the docs UI.

And the sub-application could also have its own mounted sub-applications and everything would work correctly, because FastAPI handles all these `root_path`s automatically.

   *
   * - https://github.com/jspecify/jdk/commit/71d826792b8c7ef95d492c50a274deab938f2552
   */
  /*
   * TODO(cpovirk): Is the unchecked cast avoidable? Would System.arraycopy be similarly fast (if
   * likewise not type-checked)? Could our single caller do something different?
   */
  @SuppressWarnings({"nullness", "unchecked"})

          // it is kind of lame that we need to construct a decoder to access this value.
          // if this is a concern we could add special cases for some known charsets (like utf8)
          // or we could avoid inputstreamreader and use the decoder api directly
          // TODO(lukes): in a real implementation we would need to handle overflow conditions
          int maxChars = (int) (size.get().intValue() * cs.newDecoder().maxCharsPerByte());

And then you can set headers in that *temporal* response object.

{* ../../docs_src/response_headers/tutorial002.py hl[1, 7:8] *}

And then you can return any object you need, as you normally would (a `dict`, a database model, etc).

And if you declared a `response_model`, it will still be used to filter and convert the object you returned.

including tensorflow-io should be sandboxed if used to process untrusted data.

For example, if an attacker were to upload a malicious video file, they could
potentially exploit a vulnerability in the TensorFlow code that handles videos,
which could allow them to execute arbitrary code on the system running
TensorFlow.

It is important to keep TensorFlow up to date with the latest security patches

In Pydantic version 1, you would use an internal class `Config` and `schema_extra`, as described in <a href="https://docs.pydantic.dev/1.10/usage/schema/#schema-customization" class="external-link" target="_blank">Pydantic's docs: Schema customization</a>.

You can set `schema_extra` with a `dict` containing any additional data you would like to show up in the generated JSON Schema, including `examples`.

////

/// tip