MySmartCoPilot
Ask Passes Your pass 7 days left 1 day left Last day

Your country

Tools that support it use your country for local currency, number formats, units and paper size. Your choice is saved only in this browser.

OpenAPI Security Posture Review

Check your OpenAPI or Swagger description against the OWASP API Security Top 10.

Free preview, no sign-upIncluded in your pass Pro ₹179 / $5.99 for 30 days On this device: nothing is sent
+3 +1 No uploadWorks offline once opened Security

Free preview: the posture score and every count (findings by severity and OWASP category), with the first findings and operations of the report (up to 10 each). Locked until you unlock it: download and copy.

Pro pass ₹179 for 30 days or ₹79 for 1 week, one‑time. Pro pass $5.99 for 30 days or $2.99 for 1 week, one‑time. How to unlock

Try before you buy.

  • Free preview: the posture score and every count (findings by severity and OWASP category), with the first findings and operations of the report (up to 10 each).
  • Locked until you unlock it: download and copy.
  • Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.

Ways to unlock shows how to get the full result.

See passes

Printing this result is locked in the free preview.

OpenAPI 3.0, 3.1, 3.2 or Swagger 2.0, YAML or JSON. Reviewed as you type, in your browser; nothing is uploaded and the API is never called.

Next steps Done. What next?

Start over

A Pro pass unlocks the full result. See passes

All security & privacy tools

About the OpenAPI Security Posture Review

Review your own API description before you publish it or hand it to a gateway. Paste an OpenAPI 3.0, 3.1 or 3.2 description or a Swagger 2.0 one, in YAML or JSON, or open the file, and every operation, security scheme, server and schema is checked against the OWASP API Security Top 10 (2023):

  • Authentication (API2): operations anyone can call (writes and object lookups first), security: [] and {} that switch authentication off, undefined schemes, HTTP Basic, API keys in the query string, the OAuth implicit and password flows that RFC 9700 retires, token URLs without TLS, credentials in URLs, and sign-in and reset operations without documented rate limits.
  • Authorization (API1, API3, API5): integer object ids, administrative paths without authentication or with the same access as ordinary ones, write operations that accept read scopes, passwords and secrets in responses, and request bodies that accept role, permission or balance fields.
  • Resource limits (API4, API6): no 429 responses or rate-limit headers, page sizes without a maximum, unbounded strings, arrays and uploads, and business flows such as checkout and sign-up without limits.
  • Server-side request forgery (API7): inputs that carry URLs the server may fetch.
  • Configuration and inventory (API8, API9, API10): http:// servers, staging and internal hosts, stack traces in error bodies, TRACE, CORS that trusts any origin with credentials, deprecated operations, several versions at once, and webhooks receivers cannot verify.

Each finding names the operation and line, says why it matters and gives the recommended fix with an example, linked to its OWASP category. A score, a table of the ten categories (with “test the server” where a description cannot settle a risk) and an operations matrix sum it up. Nothing is uploaded: the review runs in your browser.

Without a pass the result is a free preview: the score and every count, with the first findings and operations. The full assessment report, copying it and the PDF, Word, Markdown, CSV, JSON and SARIF downloads unlock with a Pro pass.

How to use it

  1. Paste your OpenAPI or Swagger description (YAML or JSON), press Open file, drop the file on the panel, or press Load example.
  2. Keep Sign-in, health and documentation paths are public on purpose ticked if your API has public login, token or health endpoints, so they are not reported as missing authentication.
  3. Press Review API. Read the score, the OWASP category table and the findings, most severe first; Show selects the line in the text box.
  4. Fix the description (or the API behind it) and the review updates as you type. With a pass, or once the result is unlocked, copy the report or download it as PDF, Word, Markdown, CSV, JSON or SARIF; the free preview shows the first findings and locks the copies and downloads.

Examples

Authentication switched off on a delete
Input
/orders/{orderId}:
  delete:
    security: []
    parameters:
      - name: orderId
        in: path
Result
High · API2:2023 Broken Authentication — DELETE /orders/{orderId} can be called without authentication: security: [] on the operation turns off the document’s requirement. It takes the object id orderId.
An API key in the query string
Input
securitySchemes:
  legacyKey:
    type: apiKey
    in: query
    name: api_key
Result
High · API2:2023 — The scheme legacyKey sends the key as the query parameter “api_key”.
Recommended fix: send the key in a header (in: header, for example X-API-Key).
A password field in a response
Input
User:
  properties:
    password:
      type: string
Result
High · API3:2023 Broken Object Property Level Authorization — The 200 response of GET /users/{userId} can include “password”, which is not writeOnly.

Common uses

  • Review an API description before it is published on a developer portal or imported into a gateway.
  • Check a partner’s or vendor’s API description before you integrate with it.
  • Give a design review a list of OWASP-mapped issues with the fix for each.
  • Track an API’s posture score from one version of the description to the next.

What a description can and cannot show

An API description says what the API promises: which operations need which credentials, what they accept and return, and which limits and errors are documented. It cannot prove what the server does. Object-level authorization (API1), property-level authorization (API3), function-level authorization (API5), abuse of business flows (API6) and unsafe use of third-party APIs (API10) also need tests against a running API with real accounts. The category table marks those with “test the server” when the description shows no issue.

How the score works

The score starts at 100 and loses 30 points for each critical finding (at most 60), 10 for each high (at most 40), 3 for each medium (at most 24) and 1 for each low (at most 10). Grades: A from 90, B from 75, C from 60, D from 40, F below. A critical finding limits the grade to C and a high finding to B.

Sources

Limitations

  • It reads the description, not the running API: a description can be right while the server is wrong, and the other way round.
  • References to other files or URLs ($ref to another document) are not fetched: bundle the description into one file first.
  • Name-based checks (sign-in paths, URL and password fields) work from common names; an unusual name may be missed.

Privacy

On this device: nothing is sent

The description is read and reviewed in your browser. Nothing you paste or open is uploaded, and the API it describes is never called.

Frequently asked questions

What do I get without a pass?

Without a pass, OpenAPI Security Posture Review shows the posture score and every count (findings by severity and OWASP category), with the first findings and operations of the report (up to 10 each). Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.

Which versions are supported?

OpenAPI 3.0, 3.1 and 3.2 and Swagger 2.0, in YAML or JSON. Webhooks (OpenAPI 3.1 and later) and callbacks are reviewed too.

Why is a public endpoint reported as having no authentication?

Sign-in, token, registration, health and documentation paths are treated as public on purpose while the option is ticked. Other operations without a security requirement are reported: a public catalogue read set with security: [] is reported as low, writes and operations that take object ids as high.

Does it call my API?

No. It only reads the description you give it, in your browser. Testing the running API (for example with two accounts, to check object ownership) is the next step the report points to.

Is this the same as validating my OpenAPI file?

No: validation checks that a description follows the specification. This review checks what the description says about security. To validate and edit the description itself, use the OpenAPI and Swagger Editor.

Is my description uploaded?

No. Everything runs in your browser; MySmartCoPilot never receives the file.

More security tools

All security & privacy tools →
DMARC Record Generator Build a correct DMARC record, and a safe path from monitoring to p=reject. Pro
Domain & Email Security Checker One scorecard for a domain’s defences: email, certificates, DNS and disclosure. Pro
TLS / SSL Server Config Generator TLS settings written for your exact server and OpenSSL versions, from proven profiles. Pro
Security Headers Generator Choose your security headers once and get them ready for your server, host or framework. Pro
CSP Evaluator Find the holes in a Content-Security-Policy, ranked by severity, with a fix for each. Pro
SRI Hash Generator Get the integrity value and tag for a script or stylesheet, and check the one you have. Pro