Paste, drop, or link one OpenAPI document. See what breaks and where to fix it.
Document verdict
Counts and findings checked against OpenAPI Specification.
No structural or focused-check findings. This description is ready for a human review.
IndieOpenAPI validates the description, not the running API.
The indie shelf
This tool stays focused on one job. Other tools by turushan are ready for the next small task.
Straight answers about IndieOpenAPI: what the result means, what to do with it, and why there is no catch.
No asterisks hiding down hereAn OpenAPI document is a JSON or YAML file that describes an HTTP API: its paths, the operations on each path, their parameters, request bodies, responses, the schemas those carry, and how a caller authenticates. Tools read it to generate documentation, client libraries, and mock servers. The format began as Swagger 2.0 and is now the OpenAPI Specification, at versions 3.0, 3.1, and 3.2. IndieOpenAPI checks all four.
IndieOpenAPI runs six checks. Structure compares the document with the OpenAPI schema for its version. References resolves every $ref, inside the document and in external files. Operations checks that each operationId is unique, that every {parameter} in a path template is declared, and that each operation has a summary or description. Responses looks for at least one response and a 2xx or default entry. Examples compares each example value with its schema. Security checks that every requirement names a declared scheme and that every operation states its authentication intent.
An error is something the specification forbids or something a tool cannot resolve: a schema violation, a broken $ref, a duplicate operationId, a path parameter that does not exist, an example that breaks its schema, or a security requirement with no scheme behind it. One error fails the document. A warning is a gap a valid document can still have: an operation with no description, no operationId, no success response, or no declared authentication. Warnings leave the verdict at valid with warnings.
An internal reference such as #/components/schemas/User is a JSON Pointer, so every segment must exist with that exact spelling and case. A slash inside a key is written ~1 and a tilde ~0. The finding gives the document path of the failing $ref, so open that spot and compare it with the component list.
A reference to another file is only followed when you enter the root document's public URL, up to eight external documents per check. Pasted and dropped files stay in your browser, so their external references are reported as not loaded. Bundle the files into one document to check them offline.
An operation with no security entry of its own and none at the document root leaves its authentication undefined, and readers and generators guess. Declare your schemes under components.securitySchemes (securityDefinitions in 2.0), then apply them with a root security list that every operation inherits, or per operation. When an endpoint is public on purpose, say so with security: [] on that operation; the check reads that as explicit and stops warning.
No. The check validates the description and never calls the API, so it cannot tell whether a server answers, whether the real responses match the documented schemas, or whether the authentication behaves as described. Example values are compared with their schemas in OpenAPI 3.0 documents only; examples in 2.0, 3.1, and 3.2 documents are reported as not checked, which never counts as a pass. A document may be at most 512 KB.
Yes. No account, no card, no premium plan, no upgrade nag, no hidden paywall. IndieOpenAPI is free, all of it.
There is no public lookup history. A network check sends the public input needed for that check to its named source. Local file tools process file contents in your browser. Analytics is currently off, so no visit or job data is sent to a tracker. Anything the tool saves for you stays in your browser.
