Security
OpenAPI Security Analyzer
Inspect API specs for missing or risky security definitions.
Supports OpenAPI 3.x and Swagger 2.0 documents in JSON or YAML.
Advertisement
What is OpenAPI Security Analyzer?
OpenAPI Security Analyzer reviews security definitions in an OpenAPI or Swagger document and highlights operations that are protected, public or reference inconsistent security schemes.
What this tool checks
- Declared security schemes
- Global security requirements
- Operation-level security overrides
- Public operations
- Undefined referenced schemes
- Unused security schemes
- API keys placed in query strings
- HTTP Basic authentication declarations
How to use it
- Paste your API specification.
- Run the security analyzer.
- Review public and protected operations.
- Confirm that each documented security requirement matches the deployed API.
Important:
This tool analyzes the specification, not the live implementation. A specification can differ from the actual behavior of the deployed API.
Frequently asked questions
Does the analyzer call my API?
No. The OpenAPI document is analyzed locally in the browser.
Is a public operation automatically unsafe?
No. Public operations may be intentional and should be reviewed according to their data and function.