You can use Postman to identify any potential security and formatting issues when defining your API.
Warnings for OpenAPI 2
For all APIs defined in OpenAPI 2.0, the following list describes possible warning messages and potential ways to resolve them.
Broken object level authorization
Scope for OAuth scheme used in security field is not defined in the securityDefinition declaration
Resolution
Scope for OAuth scheme used is not defined in the securityDefinition declaration
Resolution
Broken user authentication
Security field is not defined
Resolution
Security field does not contain any item
Resolution
Security field does not contain any scheme
Resolution
Security definition object not defined
Resolution
Security definition object does not contain any scheme
Resolution
Scheme used in security field is not defined in the security definition object
Resolution
Security field for the operation does not contain any item
Resolution
Security field for the operation does not contain any scheme
Resolution
Operation does not enforce any security scheme
Resolution
Excessive data exposure
API accepts credentials from OAuth authentication in plain text
Resolution
API accepts API key in plain text
Resolution
API accepts basic authentication credentials in plain text
Resolution
Global schemes have HTTP scheme defined
Resolution
Operation accepts credentials from OAuth authentication in plain text
Resolution
Operation accepts API key in plain text
Resolution
Operation accepts basic authentication credentials in plain text
Resolution
Schemes of the operation have HTTP scheme defined
Resolution
Authorization URL uses HTTP protocol; credentials will be transferred as plain text
Resolution
Token URL uses HTTP protocol
Resolution
Produces field is not defined
Resolution
Produces field does not contain any item
Resolution
Produces field for the operation does not contain any item
Resolution
Operation does not contain produces field
Resolution
Injection
Consumes field is not defined
Resolution
Consumes field does not contain any item
Resolution
Consumes field for the operation does not contain any item
Resolution
Operation does not contain consumes field
Resolution
Improper assets management
OAuth authentication uses the deprecated implicit flow
Resolution
OAuth authentication uses the deprecated password flow
Resolution
This rule category deals with the OpenAPI info object, which has metadata about the API.
The info object should have a description
Resolution
The info object should have a license
Resolution
The info object should have a license URL
Resolution
The info object should have a terms of service
Resolution
Resolution
Resolution
Resolution
Resolution
Resolution
Operations
This rule category deals with operations on an API path.
There should be no trailing slashes on paths
Resolution
All operations should have summaries
Resolution
Operation summaries shouldn’t end with a period
Resolution
All operations should have descriptions
Resolution
All parameters should have descriptions
Resolution
POST methods should have request bodies
Resolution
PUT methods should have request bodies
Resolution
PATCH methods should have request bodies
Resolution
All request bodies should have examples
Resolution
Operation should return a 2xx HTTP status code
Resolution
Operation should return a 5xx HTTP status code
Resolution
All responses should have examples
Resolution
A 204 response can’t have a body
Resolution
Models
This rule category deals with how to model various data types.
A schema property should reference a reusable schema
Resolution
All reusable schemas should have descriptions
Resolution
All schema properties should have descriptions
Resolution
Arrays must have minItems and maxItems defined
Resolution