DEV Community

Mr Robot
Mr Robot

Posted on

We linted 272 public OpenAPI specs. 49% leave endpoints with no declared auth.

#api #openapi #security #webdev

We ran 272 public OpenAPI specs from the APIs.guru directory through SpecGuard, our deterministic OpenAPI linter. No AI guessing: the same spec always gives the same findings.

Headline numbers

Finding Specs affected
At least one warning 223 (82%)
Operations with no 4xx error responses documented 190 (70%)
Endpoints with no security requirement and no global security 132 (49%)
Operations missing an operationId 88 (32%)
Server URL on plain HTTP 60 (22%)
API keys sent in the query string 55 (20%)
Perfect score (100/100) 9 (3%)

Average score: 58/100.

Why it matters now

AI agents and SDK generators read your spec literally. A missing operationId becomes a garbage function name. An undeclared auth scheme means an agent calls the endpoint, gets a 401 it was never told about, and gives up. A key in the query string ends up in proxy logs.

Fix list (cheap wins)

  1. Declare security globally and use [] on endpoints that are intentionally public.
  2. Add a unique camelCase operationId to every operation.
  3. Document 400/401/404/422 responses.
  4. Move API keys from query parameters to a header.
  5. Serve every servers URL over HTTPS.

Check your own spec

Data: APIs.guru openapi-directory, October 2026. Findings are lint rules, not a security pen test.

Top comments (0)