Does an OpenAPI security declaration prove runtime authorization?
API security depends on authentication, authorization, ownership and business rules, not just headers. A supplied schema helps build an inventory; human review is essential for high-impact authorization conclusions.
What the engine observes
- Client-supplied OpenAPI and Postman inventory
- Declared authentication and exposed API references
- Role, tenant and resource-ownership review matrix
The free check does not call private APIs or test cross-tenant access. Supplied external schema references are not fetched automatically.
What happens after a check?
Read the observations and their evidence first. Save the private report if useful. To go deeper, verify domain control and agree a precise scope, testing window and resource limits. High-impact candidates remain candidates until appropriate validation is complete.
Read verification policy ↗Related checks
Website security checker ↗Security headers checker ↗SSL & TLS checker ↗Content Security Policy checker ↗Cookie security checker ↗CORS signals checker ↗