An OpenAPI specification is a standard format for describing an HTTP API: its operations, parameters, request and response data, and security requirements. It turns design decisions into an artifact that can guide implementation and validation. section 1.2.2 section 8.1
Use the specification to make API security decisions explicit:
- Define security schemes with token type, placement, authorization details, and access scopes. section 8.1
- Apply protection globally through the security field or override it for individual operations. section 8.1
- Test the implementation against the specification with contract testing and fuzz testers that generate valid and invalid payloads. section 1.2.2
Protecting selected operations
A ride-sharing API might allow anonymous ride planning and quotes while protecting other operations. A global JWT bearer requirement can protect the API, while an operation-level security field can leave a public endpoint such as /hello unprotected. section 8.1
