A security requirement tells Swagger which authorization scheme an API operation requires. A global requirement marks every endpoint as protected, so Swagger UI displays authorization indicators even for endpoints that do not require authorization. section 9.3.1 section 11.3.1
Configure bearer-token protection
Register a Bearer security definition with the Authorization header, HTTP bearer scheme, and JWT format, then attach an OpenAPI security requirement referencing Bearer. Swagger UI consequently provides an Authorize button for entering a token. section 9.3.1
For accurate documentation, replace the global requirement with an operation filter. The filter checks endpoint metadata for AuthorizeAttribute, leaves unrestricted operations unchanged, and assigns operation.Security only to restricted operations.
