OpenAPI Security Audit — OWASP API Top 10 2023 Contract Checks

{
  "type": "json",
  "example": {
    "label": "paid-demo:insecure-admin-contract",
    "stats": {
      "low": 1,
      "high": 5,
      "medium": 2,
      "critical": 0,
      "findings": 8,
      "operations": 2,
      "security_schemes": 1,
      "write_operations": 1,
      "remote_references": 0,
      "protected_operations": 0,
      "anonymous_or_public_operations": 2
    },
    "profile": "internet",
    "summary": "BLOCK: 8 finding(s) across 2 operation(s); 5 high, 2 medium, 1 low.",
    "verdict": "BLOCK",
    "coverage": {
      "rules": [
        "authentication and authorization declarations",
        "security-scheme transport and flow choices",
        "resource bounds for pagination and request bodies",
        "sensitive response and privileged input fields",
        "deployment transport and API inventory hygiene",
        "external reference trust boundaries"
      ],
      "standard": "OWASP API Security Top 10 2023",
      "local_refs": true,
      "limitations": "A contract cannot prove runtime authorization, rate limiting, input enforcement, or exploitability; verify findings against implementation and gateway policy.",
      "active_scanning": false,
      "exploit_attempts": false,
      "contract_level_only": true,
      "remote_refs_fetched": false
    },
    "findings": [
      {
        "code": "api_key_in_query",
        "summary": "An API key is transmitted in the URL query string.",
        "evidence": "Security scheme 'queryKey' uses in=query.",
        "location": "$.components.securitySchemes/queryKey",
        "severity": "high",
        "remediation": "Move credentials to an Authorization or purpose-specific request header.",
        "risk_weight": 18,
        "owasp_api_2023": "API2:2023 Broken Authentication"
      },
      {
        "code": "sensitive_response_without_required_auth",
        "summary": "An unauthenticated success response documents sensitive-looking fields.",
        "evidence": "refresh_token",
        "location": "$.paths//accounts/get/responses",
        "severity": "high",
        "remediation": "Require object/property authorization and remove secrets from response schemas.",
        "risk_weight": 20,
        "owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
      },
      {
        "code": "write_operation_without_required_auth",
        "summary": "A state-changing operation does not require documented authentication.",
        "evidence": "Effective security mode is anonymous.",
        "location": "$.paths//admin/users/{id}/delete",
        "severity": "high",
        "remediation": "Require an appropriate security scheme and enforce function-level authorization.",
        "risk_weight": 22,
        "owasp_api_2023": "API5:2023 Broken Function Level Authorization"
      },
      {
        "code": "privileged_fields_client_writable",
        "summary": "Potentially privileged properties are client-writable.",
        "evidence": "role",
        "location": "$.paths//admin/users/{id}/delete/requestBody",
        "severity": "high",
        "remediation": "Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
        "risk_weight": 17,
        "owasp_api_2023": "API3:2023 Broken Object Property Level Authorization"
      },
      {
        "code": "insecure_server_transport",
        "summary": "A documented API server uses cleartext HTTP.",
        "evidence": "http://api.example.test",
        "location": "$.servers/0/url",
        "severity": "high",
        "remediation": "Use HTTPS with modern TLS for every non-local deployment.",
        "risk_weight": 16,
        "owasp_api_2023": "API8:2023 Security Misconfiguration"
      },
      {
        "code": "read_operation_without_documented_auth",
        "summary": "A read operation has no mandatory documented authentication.",
        "evidence": "Effective security mode is undocumented.",
        "location": "$.paths//accounts/get",
        "severity": "medium",
        "remediation": "Declare required authentication or list this operation explicitly as intentionally public.",
        "risk_weight": 10,
        "owasp_api_2023": "API2:2023 Broken Authentication"
      },
      {
        "code": "unbounded_pagination_parameter",
        "summary": "A pagination or result-count parameter has no maximum.",
        "evidence": "'limit' is numeric without maximum.",
        "location": "$.paths//accounts/get/parameters/query:limit",
        "severity": "medium",
        "remediation": "Set a conservative schema maximum and enforce the same server-side cap.",
        "risk_weight": 7,
        "owasp_api_2023": "API4:2023 Unrestricted Resource Consumption"
      },
      {
        "code": "security_schemes_unused",
        "summary": "Declared security schemes are not referenced by any operation.",
        "evidence": "queryKey",
        "location": "$.components.securitySchemes",
        "severity": "low",
        "remediation": "Remove stale schemes or attach them to the intended global/operation requirements.",
        "risk_weight": 3,
        "owasp_api_2023": "API9:2023 Improper Inventory Management"
      }
    ],
    "operations": [
      {
        "path": "/accounts",
        "method": "GET",
        "operation_id": "listAccounts",
        "security_mode": "undocumented",
        "write_operation": false
      },
      {
        "path": "/admin/users/{id}",
        "method": "DELETE",
        "operation_id": "deleteUser",
        "security_mode": "anonymous",
        "write_operation": true
      }
    ],
    "risk_score": 100,
    "analysis_id": "apisec-cbfa909ee1a1a22f",
    "analyzer_version": "apisec-openapi-owasp-2023/1.0",
    "remediation_plan": [
      "Move credentials to an Authorization or purpose-specific request header.",
      "Require object/property authorization and remove secrets from response schemas.",
      "Require an appropriate security scheme and enforce function-level authorization.",
      "Use allow-listed input DTOs and derive ownership, roles, prices, and status server-side.",
      "Use HTTPS with modern TLS for every non-local deployment.",
      "Declare required authentication or list this operation explicitly as intentionally public.",
      "Set a conservative schema maximum and enforce the same server-side cap.",
      "Remove stale schemes or attach them to the intended global/operation requirements."
    ]
  }
}