Developer Tools / BROWSER-ONLY UTILITY
OpenAPI Document Reviewer
An API document describes an intended contract. Check its authentication declarations and operation structure before using it to generate clients or review an implementation.
Or paste the original source text
Choose your existing OpenAPI 3.0.x or 3.1.x JSON or YAML file, or paste its content directly. Swagger 2.0, OpenAPI 3.2 and YAML aliases are unsupported. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
Security requirements are inherited deliberately
Operations inherit the top-level security array unless they supply their own. An empty operation array removes that declaration. An empty object inside an alternative permits anonymous access. The sample health endpoint demonstrates explicit removal; a public health check may be intentional. A documentation warning does not establish that an actual endpoint accepts an unauthenticated request.
Review the contract you supplied
Checks include info title and version, duplicate operation IDs, non-empty responses, directly declared required path parameters, undefined security-scheme names and selected authentication shapes. Query-string API keys, Basic authentication and legacy OAuth flows receive contextual notes. Request bodies on GET, HEAD and DELETE prompt interoperability review rather than an automatic exploit claim.
References stay local and bounded
The reviewer inventories $ref entries and checks root-document JSON Pointer targets. It never retrieves another file or URL and never recursively expands references, so a circular pointer cannot trigger recursive dereferencing. JSON Schema anchors, changed base URIs, callbacks and webhooks are not fully evaluated. A resolved pointer is not complete schema validation.
Keep versions and runtime behaviour separate
This release explicitly supports selected checks for 3.0.x and 3.1.x. It does not silently interpret newer specification families. Server variables and relative deployment URLs need their own context. Gateways, generated server code, scopes, object ownership and actual authorization enforcement remain outside this document-only review. No API call is made.
References
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
- OAuth Configuration Reviewer
- API Access Matrix Planner
- Security Report Builder
- Practical guides and coding projects
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.