OpenAPI Spec Gap Analyser
Paste an OpenAPI 3.x or Swagger 2.0 spec and get the security gaps it shows, ranked by severity and mapped to the OWASP API Security Top 10 (2023): endpoints with no authentication, missing or over-broad scopes, object IDs worth testing for BOLA, sensitive fields in responses, open request schemas, unbounded inputs, cleartext or internal servers, old versions and callback URLs. Each finding names the method, path and JSON pointer, says why it matters and how to fix it.
Runs entirely in your browser: the spec is never uploaded. JSON input only for now. Two sample specs are one click away.
Your spec never leaves this browser.
It is parsed and analysed in this tab. Nothing is uploaded, stored or sent to PlayCISO or anyone else, and no URL in the spec is ever called.
JSON only in this version (no YAML parser is bundled). For a YAML spec, convert it first, for example with npx @redocly/cli bundle openapi.yaml --ext json. Local $refs are followed; remote ones are not fetched.
TL;DRWhat this analyser does
5 points
- Paste or upload an OpenAPI 3.0/3.1 or Swagger 2.0 spec in JSON and get a severity-ranked list of security gaps, each mapped to the OWASP API Security Top 10 (2023).
- Every finding gives the location (method, path and JSON pointer), why it matters and how to fix it, plus a summary by OWASP item and a 0-100 score.
- It checks missing authentication, missing or over-broad OAuth scopes, object IDs on unauthenticated paths, sensitive fields in responses, open request schemas, unbounded inputs and lists, cleartext and internal servers, deprecated and parallel versions, callback URLs, and missing 401/403/429 and error schemas.
- It runs entirely in your browser. The spec is not uploaded anywhere, and no URL inside it is called.
- The analysis is free. CSV and Markdown export are part of Pro.
What a spec can and cannot tell you
An OpenAPI document is a promise about the API: which operations exist, who may call them, what goes in and what comes out. Gaps in that promise are cheap to find and cheap to fix before code ships. A write operation with no security requirement, a response model that carries a password field or a list endpoint with no page size are visible in the document itself, and gateways, generated clients and contract tests all inherit them.
What a spec cannot show is whether the code keeps the promise. Broken object level authorization (API1) lives in a missing ownership check inside a handler; a spec with perfect security blocks can still let user A read user B's invoice. That is why ID-bearing operations are marked review and come with a test to run, and why the analyser lists every authenticated operation with an object ID as a test list. Pair it with the API Data Exposure Review Lab to practise reviewing what handlers return, and use the API & Service Auth Lab for choosing the right machine authentication.
Run it in CI as a habit, not once: add the spec to the build, fail on new critical and high findings, and treat the 401, 403 and 429 responses as tests you must write. For the wider programme view, the API security posture score covers the controls a spec does not describe.
Frequently asked questions
What does the OpenAPI Spec Gap Analyser check?
It reads your OpenAPI 3.x or Swagger 2.0 document and flags: operations with no security requirement (worst on write methods); OAuth operations with no scope, wildcard scopes or an admin scope used for ordinary calls; object-ID path parameters on unauthenticated operations; response models with fields that look like passwords, government IDs, tokens, secrets, dates of birth or card data; write operations with no request schema or additionalProperties: true; arrays without maxItems, strings without maxLength and list endpoints without pagination; http:// servers and localhost, private-IP or internal hosts; deprecated operations and multiple versions; caller-supplied callback and URL fields; Basic auth, API keys in the query string and the implicit or password OAuth flows; and missing 401, 403, 429 and error schemas.
How are findings mapped to the OWASP API Security Top 10 2023?
Each finding carries one item. Missing authentication and weak schemes map to API2 Broken Authentication; object IDs without auth to API1 BOLA; sensitive response fields and mass-assignment risks to API3 Broken Object Property Level Authorization; missing limits and pagination to API4 Unrestricted Resource Consumption; scope problems and missing 403s to API5 Broken Function Level Authorization; callback and URL inputs to API7 SSRF; cleartext servers, undefined schemes and undefined error bodies to API8 Security Misconfiguration; and internal servers, deprecated operations and parallel versions to API9 Improper Inventory Management. API6 and API10 depend on business logic and code that a spec does not describe.
Is my spec uploaded or stored?
No. The spec is parsed and analysed in your browser tab. It is not sent to PlayCISO or anyone else, it is not stored, and the tool never calls any server or URL written in the spec. Usage analytics, where you have allowed them, record only that an analysis ran and how many findings it produced.
Does it support YAML?
Not in this version: it reads JSON only, because no YAML parser is bundled with the page. Convert a YAML spec first, for example with the Redocly CLI (npx @redocly/cli bundle openapi.yaml --ext json) or the Swagger Editor's convert option, then paste or upload the JSON.
What does "review" mean on a finding?
Some risks cannot be proven from a document. An object ID on an unauthenticated path is a broken object level authorization risk to test, not proof of one; a URL field is only SSRF if the server fetches it; a role field in a request is only mass assignment if ordinary callers can set it. Those findings are labelled review and count half towards the score.
How is the score calculated?
Start at 100 and subtract 20 per critical, 10 per high, 5 per medium and 2 per low finding; info findings subtract nothing and review findings subtract half. The grade is A from 90, B from 75, C from 60, D from 40, and F below that. Repeated patterns are grouped into one finding with all their locations, so one missing global security block does not count once per operation.
Is it free?
The analysis, the OWASP summary and the score are free and need no account. Exporting the findings to CSV or Markdown is part of Pro ($5/month or $40/year).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.