security-scheme-oauth2

Flags security schemes that are neither type: oauth2 nor HTTP bearer authentication.

Attribute	Value
Category	Security
Maturity	Gold
Starter	Off
Lenient–Complete	Error

See it fail

apiKey:
  type: apiKey
  in: header
  name: X-API-Key

Fix it

Define an OAuth2 scheme, or an HTTP bearer scheme when that is the intended policy.

Nearby: require-oauth-scopes, no-http-basic.