Free tool · runs in your browser
OpenAPI Auditor
Powered by yaml · ISC, OpenAPI Specification
OpenAPI or Swagger specification
JSON or YAML, up to 2 MiB. External $ref values are listed but never downloaded.
Inventory
Security review
Authentication schemes
| Name | Type | In / scheme | Flows |
|---|
Operations
| Method | Path | Operation | Security |
|---|
External references not loaded
What is an OpenAPI specification?
OpenAPI is a language-independent description format for HTTP APIs. A document inventories servers, paths, operations, parameters, data schemas and security mechanisms. It describes an expected contract: it does not prove that the deployed service actually enforces those controls.
OpenAPI security field inheritance
Root security applies to every operation by default. An operation-level value replaces it completely; an empty [] makes that operation public in the contract. The server can still diverge, deliberately or by mistake.
Why external references stay offline
Automatically resolving a $ref would turn the tool into a network client, with document leakage, server-side SSRF and results that depend on mutable resources. Import a self-contained bundle when you need a complete review.
?Frequently asked questions
Are external $ref values resolved?
No. The tool contains no network loader. An HTTP, Git or file reference is only displayed, and the review states that its content is missing.
Is an operation without security necessarily vulnerable?
No. It normally inherits root security. An operation with security: [] explicitly cancels that inheritance. An API can also intentionally expose public routes.
Does this audit replace API testing?
No. OpenAPI describes a contract. The server may expose missing routes, enforce different authentication or return additional properties. Compare the contract with actual traffic afterwards.
+More tools
- HTTPHTTP Security Inspector
Review a raw request or response, its headers, cookies and ambiguities.
- OIDCOAuth / OIDC Inspector
Review OAuth/OIDC flows and generate PKCE, state and nonce locally.
- {·}JWT Inspector
Decode a JWT, verify its signature, spot weaknesses.
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.