Last updated

security-defined

Verifies every operation or global security is defined.

OASCompatibility
2.0✅
3.0✅
3.1✅

API design principles

"Where are the public APIs?"

Public APIs are all around us, but they generally still require security credentials to measure usage and prevent abuse.

Not defining security credentials is an indication that someone forgot something. What was it? Aha! We're letting you know here.

This is a good rule. Every API should have security defined. Even if the API is truly public without any credential required, define the empty security section to let people know you didn't forget.

# This API has no security
security: []

Configuration

OptionTypeDescription
severitystringPossible values: off, warn, error. Default error (in recommended configuration).

An example configuration:

rules:
  security-defined: error

Examples

Given this configuration:

rules:
  security-defined: error

Example of incorrect security definition due to mismatching security and security schemes:

security:
  - OAuth: []
components:
  securitySchemes:
    JWT:
      type: http
      scheme: bearer
      bearerFormat: JWT

Example of correct security definition:

security:
  - JWT: []
components:
  securitySchemes:
    JWT:
      type: http
      scheme: bearer
      bearerFormat: JWT

Resources