define-401-response

Requires each authenticated path operation to define a 401 response with a response schema.

Attribute	Value
Category	Security
Maturity	Platinum
Lenient–Strict	Warning
Complete	Error

See it fail

security: [{ bearerAuth: [] }]
responses:
  '200': { description: OK }

Fix it

responses:
  '401':
    description: Authentication required
    content:
      application/json:
        schema: { $ref: '#/components/schemas/Error' }

Operations explicitly made public are not checked.

Nearby: protect-safe-operations, protect-unsafe-operations.