OpenAPI 2 security and formatting warnings
You can use Postman to identify any potential security and formatting issues when defining your API.

Warnings for OpenAPI 2
For all APIs defined in OpenAPI 2.0, the following list describes possible warning messages and potential ways to resolve them.
- Broken object level authorization
- Broken user authentication
- Security field is not defined
- Security field does not contain any item
- Security field does not contain any scheme
- Security definition object not defined
- Security definition object does not contain any scheme
- Scheme used in security field is not defined in the security definition object
- Security field for the operation does not contain any item
- Security field for the operation does not contain any scheme
- Operation does not enforce any security scheme
- Excessive data exposure
- API accepts credentials from OAuth authentication in plain text
- API accepts API key in plain text
- API accepts basic authentication credentials in plain text
- Global schemes have HTTP scheme defined
- Operation accepts credentials from OAuth authentication in plain text
- Operation accepts API key in plain text
- Operation accepts basic authentication credentials in plain text
- Schemes of the operation have HTTP scheme defined
- Authorization URL uses HTTP protocol; credentials will be transferred as plain text
- Token URL uses HTTP protocol
- Produces field is not defined
- Produces field does not contain any item
- Produces field for the operation does not contain any item
- Operation does not contain produces field
- Injection
- Improper assets management
- API information
- The info object should have a description
- The info object should have a license
- The info object should have a license URL
- The info object should have a terms of service
- API must have contact information available
- API must have a contact name available
- API must have a contact URL or email available
- API must have a contact email available
- API must have a contact URL available
- Operations
- There should be no trailing slashes on paths
- All operations should have summaries
- Operation summaries shouldn’t end with a period
- All operations should have descriptions
- All parameters should have descriptions
- POST methods should have request bodies
- PUT methods should have request bodies
- PATCH methods should have request bodies
- All request bodies should have examples
- Operation should return a 2xx HTTP status code
- Operation should return a 5xx HTTP status code
- All responses should have examples
- A 204 response can’t have a body
- Models
Broken object level authorization
Scope for OAuth scheme used in security field is not defined in the securityDefinition declaration
Resolution
Scope for OAuth scheme used is not defined in the securityDefinition declaration
Resolution
Broken user authentication
Security field is not defined
Resolution
Security field does not contain any item
Resolution
Security field does not contain any scheme
Resolution
Security definition object not defined
Resolution
Security definition object does not contain any scheme
Resolution
Scheme used in security field is not defined in the security definition object
Resolution
Security field for the operation does not contain any item
Resolution
Security field for the operation does not contain any scheme
Resolution
Operation does not enforce any security scheme
Resolution
Excessive data exposure
API accepts credentials from OAuth authentication in plain text
Resolution
API accepts API key in plain text
Resolution
API accepts basic authentication credentials in plain text
Resolution
Global schemes have HTTP scheme defined
Resolution
Operation accepts credentials from OAuth authentication in plain text
Resolution
Operation accepts API key in plain text
Resolution
Operation accepts basic authentication credentials in plain text
Resolution
Schemes of the operation have HTTP scheme defined
Resolution
Authorization URL uses HTTP protocol; credentials will be transferred as plain text
Resolution
Token URL uses HTTP protocol
Resolution
Produces field is not defined
Resolution
Produces field does not contain any item
Resolution
Produces field for the operation does not contain any item
Resolution
Operation does not contain produces field
Resolution
Injection
Consumes field is not defined
Resolution
Consumes field does not contain any item
Resolution
Consumes field for the operation does not contain any item
Resolution
Operation does not contain consumes field
Resolution
Improper assets management
OAuth authentication uses the deprecated implicit flow
Resolution
OAuth authentication uses the deprecated password flow
Resolution
API information
This rule category deals with the OpenAPI info object, which has metadata about the API.
The info object should have a description
Resolution
The info object should have a license
Resolution
The info object should have a license URL
Resolution
The info object should have a terms of service
Resolution
API must have contact information available
Resolution
API must have a contact name available
Resolution
API must have a contact URL or email available
Resolution
API must have a contact email available
Resolution
API must have a contact URL available
Resolution
Operations
This rule category deals with operations on an API path.
There should be no trailing slashes on paths
Resolution
All operations should have summaries
Resolution
Operation summaries shouldn’t end with a period
Resolution
All operations should have descriptions
Resolution
All parameters should have descriptions
Resolution
POST methods should have request bodies
Resolution
PUT methods should have request bodies
Resolution
PATCH methods should have request bodies
Resolution
All request bodies should have examples
Resolution
Operation should return a 2xx HTTP status code
Resolution
Operation should return a 5xx HTTP status code
Resolution
All responses should have examples
Resolution
A 204 response can’t have a body
Resolution
Models
This rule category deals with how to model various data types.