openapi.json is the generated API contract.
openapi.json
It is not hand-written. The Axum router (utoipa-axum + #[utoipa::path]) is the source of truth.
utoipa-axum
#[utoipa::path]
just generate-api
That dumps the spec here and rewrites apps/web/src/api/generated.ts.
apps/web/src/api/generated.ts