no-credentials-in-path-parameters

Flags path-level path parameters named secret, client_secret, token, refresh_token, id_token, password, apikey, or api-key, case-insensitively.

Attribute	Value
Category	Security
Maturity	Silver
Starter	Off
Lenient–Complete	Error

See it fail

- in: path
  name: api_key
  required: true
  schema: { type: string }

Fix it

Send credentials through an OpenAPI security scheme, normally an authorization header.

Nearby: no-apikey-in-query-parameters, security-defined.