hosts-https-only
Require HTTPS server URLs.
no-apikey-in-query-parameters
Keep API keys out of URLs.
no-credentials-in-path-parameters
Keep credential-like values out of URL paths.
no-empty-security
Prevent operations from explicitly disabling inherited security.
security-defined
Require valid security for every operation.
security-scheme-missing
Catch references to undefined security schemes.
security-property-redefined
Avoid declaring credential parameters twice.
no-http-basic
Disallow HTTP Basic authentication.
no-insecure-http-auth-schemes
Disallow insecure HTTP authentication schemes.
security-scheme-no-outdated-auth
Reject outdated HTTP auth schemes.
security-scheme-oauth2
Prefer OAuth2 over non-OAuth security schemes.
oauth-authorization-url-https-only
Require HTTPS OAuth authorization endpoints.
oauth-token-url-https-only
Require HTTPS OAuth token endpoints.
openid-connect-url-https-only
Require HTTPS OpenID Connect discovery URLs.
define-401-response
Document 401 responses for protected operations.
jwt-rfc8725-declared
Document JWT best-practice requirements.
no-numeric-ids
Avoid predictable numeric identifier parameters.
protect-safe-operations
Require authentication for safe HTTP operations.
protect-unsafe-operations
Require authentication for state-changing operations.
require-oauth-scopes
Require scopes in OAuth security requirements.
string-parameter-pattern-required
Constrain string inputs with pattern or format.