OpenAPI / Swagger Security Analyzer
Check an OpenAPI or Swagger definition for unprotected operations, HTTP Basic, API keys in URLs, http servers, guessable ids and missing limits. Runs in your browser.
Runs in your browser Your input never leaves your device.
Paste an OpenAPI 3.x or Swagger 2.0 definition (YAML or JSON). It is read in your browser: nothing is uploaded and no server is called. External $ref files are not followed.
Findings
Operations
| Method | Path | Security | Line |
|---|
What is checked
The OWASP API Security ruleset for Spectral, ported rule by rule: write and read operations with no security scheme, HTTP Basic, API keys and credentials in the URL, outdated and JWT schemes, short-lived tokens, http:// servers, sequential integer ids, resources without limits (array maxItems, string maxLength, integer minimum and maximum), additionalProperties, missing 401, 429, 500 and validation error responses, rate limit headers, admin endpoints sharing a scheme with ordinary ones, URL parameters that invite SSRF, CORS headers and server inventory. Plus: operations that turn security off with an empty list, security requirements that name undefined schemes, unused schemes, deprecated OAuth flows, http:// OAuth and OpenID URLs, passwords in query parameters, TRACE, secrets in examples, and structure errors (unresolved references, undeclared path parameters, missing responses, duplicate operationId).
The core rules were compared with Spectral and its OWASP ruleset on hundreds of generated documents in YAML and JSON. Findings describe the definition, not the running API: a definition can be wrong, and an API can do things its definition does not say. Test the live API too.
Report a problem with this tool
About this tool
An OpenAPI definition says what an API accepts and how it is protected, so it is also the cheapest place to find API security mistakes before anything is deployed: a write operation with no security requirement, HTTP Basic or an API key in the URL, a server on http://, guessable sequential ids, arrays and strings with no size limit. This tool reads an OpenAPI 3.0, 3.1 or Swagger 2.0 definition, in YAML or JSON, in your browser and reports the problems with the line of each. The core rules are the OWASP API Security ruleset for Spectral, ported with the same logic and compared with Spectral on hundreds of generated documents (YAML and JSON, three versions; generated documents use no $ref, and local references are resolved for path items, parameters and responses), covering broken object level authorization hints, authentication schemes, unrestricted resource consumption, mass assignment through additionalProperties, security misconfiguration (http servers, missing error responses, rate limit headers, CORS) and inventory. It adds checks Spectral does not make: operations that turn security off with an empty list, security requirements naming schemes that do not exist, unused schemes, deprecated OAuth flows, http:// OAuth and OpenID URLs, passwords in query parameters, TRACE, secrets in examples, and structure errors such as unresolved references, undeclared path parameters, missing responses and duplicate operation ids. It only reads the definition: it does not call the API, follow external $ref files or know what the running service really does, so test the live API as well.
How to use it
- Paste the definition (YAML or JSON) or load the file.
- Start with the high findings: unprotected write operations, Basic auth, keys in URLs and http servers.
- Fix them in the definition and, more importantly, in the API behind it.
- Copy the Markdown summary into your issue tracker.
Common problems
- A lot of low and info findings
- Many of the OWASP rules are about limits and error responses and are noisy on a first run. Fix the high and medium findings first.
- A $ref to another file is not checked
- Local references (#/components/...) are followed for path items, parameters and responses. References to other files or URLs are not followed; paste a bundled definition (for example from redocly bundle or swagger-cli bundle) to include everything.
- The line numbers are off in a JSON file
- Line numbers are exact for pretty-printed JSON. A file on one line has only one line to point at; format it first.