OpenAPI Security Scheme Checker

Store Positioning

Store title: OpenAPI Security Scheme Checker

Short description: Audit OpenAPI security scheme definitions and operation-level security coverage for missing, inconsistent, or confusing auth documentation.

SEO title: OpenAPI Security Scheme Checker — API, schema, and developer QA

SEO description: Audit OpenAPI security scheme definitions and operation-level security coverage for missing, inconsistent, or confusing auth documentation. Use it to catch contract drift, schema mistakes, unsafe endpoint assumptions, and developer-tool quality issues before release.

Categories: DEVELOPER_TOOLS

Keywords: openapi, security, scheme, checker, security headers, api testing, api/developer qa

Pay-Per-Event Pricing

This actor uses pay-per-event pricing. Event prices include Apify platform usage; users are not expected to pay a separate platform-usage pass-through charge for the configured pricing model.

• Tier: A1 — API/developer QA
• Primary event: schema-validated at $0.00650 base
• Default max charge: $10.00
• Store discounts: FREE/BRONZE base, SILVER discounted, GOLD deepest approved discount

Event set:

• actor-start: base $0.00500, GOLD $0.00400. Openapi Security Scheme Checker: charged when actor start is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• schema-validated: base $0.00650, GOLD $0.00520. Openapi Security Scheme Checker: charged when schema validated is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• contract-rule-checked: base $0.00390, GOLD $0.00312. Openapi Security Scheme Checker: charged when contract rule checked is completed. The price includes Apify platform usage; no separate usage pass-through is intended.
• report-generated: base $0.05000, GOLD $0.04000. Openapi Security Scheme Checker: charged when report generated is completed. The price includes Apify platform usage; no separate usage pass-through is intended.

The actor accepts actor-start before work, accepts the primary event before each dataset row, and accepts report-generated before writing report files. If maxChargeUsd or the live PPE limit blocks a charge, the corresponding row or report is not written.

Public Task Concepts

• Audit OpenAPI Security Scheme controls on a capped public sample
• Find high-priority OpenAPI Security Scheme issues before release
• Validate OpenAPI Security Scheme evidence from supplied pages
• Prioritize OpenAPI Security Scheme fixes with severity and proof
• Export OpenAPI Security Scheme QA rows for client review Audit OpenAPI security scheme definitions and operation-level auth coverage.

What It Does

Inventories securitySchemes and flags public operations, undefined scheme references, missing scheme descriptions, expected-scheme gaps, and confusing scheme definitions.

Inputs

This actor exposes these input fields in .actor/input_schema.json:

• openapiSpecUrl
• openapiSpecJson
• strictMode
• allowPublicOperations
• expectedSchemes
• maxOperations
• includeMarkdownReport
• maxChargeUsd

The exact default audits the public Swagger Petstore OpenAPI security definitions and five bounded operations; the source was verified at 2026-07-12T05:30:00Z.

Outputs

Dataset rows contain:

• operationId
• method
• path
• securityRequired
• securitySchemesUsed
• schemeDefined
• schemeType
• issueType
• severity
• evidence
• recommendation

Sample outputs in examples/output.sample.json and output.sample.json were generated from examples/input.tiny.json through actor logic.

Reports

After the report-generated charge is accepted, the actor writes its Markdown, JSON, or CSV reports to the key-value store. A rejected report charge leaves those files unwritten.

Public Task Concepts

• Validate OpenAPI Security Scheme Checker before release
• Run a bounded OpenAPI Security Scheme Checker QA check
• Generate developer QA evidence for OpenAPI Security Scheme Checker

Safe use

Use small capped runs first. Network paths are bounded; review output quality and costs before increasing limits.