OpenAPI Security Scheme Inspector

Inspect OpenAPI 3 security schemes and operation requirements

OpenAPI describes how clients authenticate using components.securitySchemes and optional security requirements on the root document or individual operations. This inspector parses YAML or JSON OpenAPI 3.x files in your browser and lists every defined scheme (API keys, HTTP bearer/basic, OAuth 2.0 flows, and OpenID Connect) together with the effective security on each HTTP method.

Who should use this tool?

API designers, gateway engineers, and SDK authors use it when reviewing a spec before publication or when comparing documented auth against what an API gateway enforces. It does not call your API or validate tokens; it only reads the static document you paste.

How to use it

1. Paste a complete OpenAPI 3 document (YAML or JSON).
2. Review the scheme table for type, header/query placement, and OAuth flow URLs.
3. Scan operation rows to see which routes inherit global security versus explicit overrides.
4. Empty security: [] on an operation marks a public endpoint even when global security is set.

For structural validation use OpenAPI Validator. For contract diffs use OpenAPI Breaking Change Diff.