{"templateId":"markdown","versions":[{"version":"v1","label":"1.x (archive)","link":"/docs/cli/v1/rules/async/security-defined","default":false,"active":false,"folderId":"6f4800fc"},{"version":"v2","label":"2.x (current)","link":"/docs/cli/rules/async/security-defined","default":true,"active":true,"folderId":"6f4800fc"}],"sharedDataIds":{"sidebar":"sidebar-docs-cli.sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"redocly_category":"Redocly CLI","type":"markdown"},"seo":{"title":"security-defined","description":"OpenAPI-generated documentation tool with 24k+ stars on Github - make APIs your company's superpower.","siteUrl":"https://redocly.com","image":"/assets/redocly-card.f670aae34a39545a5ea633a540cb3a4a333a1f23bb2ed3c4a1b17a5fbcf0ac85.db81178d.png","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"security-defined","__idx":0},"children":["security-defined"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Verifies that every security scheme referenced from an operation or server ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["security"]}," array is defined in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.securitySchemes"]},"."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"AsyncAPI"},"children":["AsyncAPI"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Compatibility"},"children":["Compatibility"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["2.6"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✅"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["3.0"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["✅"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-design-principles","__idx":1},"children":["API design principles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In AsyncAPI 2.x, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["security"]}," entries on operations and servers are bare security scheme names that must match a key under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.securitySchemes"]},"."," ","A typo or rename breaks the reference but the document remains structurally valid."," ","The key mismatch is only visible to clients at runtime."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In AsyncAPI 3.0, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["security"]}," entries are ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SecurityScheme"]}," objects, typically expressed as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$ref"]},"s into ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.securitySchemes"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["security-defined"]}," rule reports when a security ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$ref"]}," does not point into ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.securitySchemes"]}," or when it points at a name that is not defined there."," ","This rule catches these name mismatches at lint time."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configuration","__idx":2},"children":["Configuration"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Option"},"children":["Option"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Type"},"children":["Type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["severity"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Possible values: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["off"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["warn"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]},". Default ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]}," (in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["recommended"]}," configuration)."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An example configuration:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"rules:\n  security-defined: error\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"examples","__idx":3},"children":["Examples"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Given this configuration:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"rules:\n  security-defined: error\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example of an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["incorrect"]}," security definition due to a mismatch between the referenced name and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["components.securitySchemes"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"asyncapi: '2.6.0'\nchannels:\n  user/signedup:\n    subscribe:\n      security:\n        - OAuth: [] # no matching scheme in components.securitySchemes\n      message:\n        messageId: UserSignedUp\ncomponents:\n  securitySchemes:\n    JWT:\n      type: http\n      scheme: bearer\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example of a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["correct"]}," AsyncAPI 2.x security definition:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"asyncapi: '2.6.0'\nchannels:\n  user/signedup:\n    subscribe:\n      security:\n        - JWT: []\n      message:\n        messageId: UserSignedUp\ncomponents:\n  securitySchemes:\n    JWT:\n      type: http\n      scheme: bearer\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example of an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["incorrect"]}," AsyncAPI 3.0 security definition where the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["$ref"]}," points at an undefined scheme:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"asyncapi: '3.0.0'\noperations:\n  sendMessage:\n    action: send\n    channel:\n      $ref: '#/channels/userSignedUp'\n    security:\n      - $ref: '#/components/securitySchemes/OAuth'\ncomponents:\n  securitySchemes:\n    JWT:\n      type: http\n      scheme: bearer\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Example of a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["correct"]}," AsyncAPI 3.0 security definition:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"asyncapi: '3.0.0'\noperations:\n  sendMessage:\n    action: send\n    channel:\n      $ref: '#/channels/userSignedUp'\n    security:\n      - $ref: '#/components/securitySchemes/JWT'\ncomponents:\n  securitySchemes:\n    JWT:\n      type: http\n      scheme: bearer\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related-rules","__idx":4},"children":["Related rules"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/cli/rules/oas/security-defined"},"children":["security-defined"]}," — equivalent rule for OpenAPI."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"resources","__idx":5},"children":["Resources"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://github.com/Redocly/redocly-cli/blob/main/packages/core/src/rules/async2/security-defined.ts"},"children":["AsyncAPI 2.x rule source"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://github.com/Redocly/redocly-cli/blob/main/packages/core/src/rules/async3/security-defined.ts"},"children":["AsyncAPI 3.0 rule source"]}]}]}]},"headings":[{"value":"security-defined","id":"security-defined","depth":1},{"value":"API design principles","id":"api-design-principles","depth":2},{"value":"Configuration","id":"configuration","depth":2},{"value":"Examples","id":"examples","depth":2},{"value":"Related rules","id":"related-rules","depth":2},{"value":"Resources","id":"resources","depth":2}],"frontmatter":{"seo":{"title":"security-defined"}},"lastModified":"2026-08-03T15:40:25.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/cli/rules/async/security-defined","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}