Agent Tool Specification Auditor

Agent Tool Specification Auditor performs a deterministic review of an OpenAPI™ 3.0 or 3.1 API description. It is designed for teams deciding whether an API description is clear, bounded, and safe enough to expose as agent tools. The Actor does not use an LLM and never invokes any operation described by the document.

OpenAPI is a trademark of The Linux Foundation. This independent project is not affiliated with or endorsed by the OpenAPI Initiative or The Linux Foundation.

Input

Supply exactly one source: an inline JSON document, inline yaml, or a public HTTPS sourceUrl. Remote documents are limited to 5 MiB and are retrieved only from public HTTPS port 443 with DNS pinning and redirect revalidation.

{
  "document": {
    "openapi": "3.1.0",
    "info": {"title": "Example API", "version": "1.0.0"},
    "paths": {
      "/health": {
        "get": {
          "operationId": "getHealth",
          "responses": {"204": {"description": "Healthy"}}
        }
      }
    }
  }
}

Analysis and output

The analyzer inventories read, write, and destructive operations; reviews operation IDs, descriptions, request and response schemas, examples, authentication declarations, and common unbounded schema shapes; and calculates an overall readiness result. Internal JSON references are resolved. External references are reported as findings and never fetched.

The default dataset receives one stable API-IFY result envelope. Findings contain rule IDs, severities, messages, and JSON Pointer evidence paths. Traversal depth, object count, reference expansion, and output findings are bounded. Cyclic object graphs, duplicate YAML keys, malformed component shapes, and documents exceeding those limits return explicit uncharged failures rather than exhausting the process. The RUN_SUMMARY key-value-store record reports status, bytes, HTTP activity, duration, and billing.

A successful audit produces a result projection like this:

{
  "status": "success",
  "result": {
    "openapiVersion": "3.1.0",
    "overallReadiness": "ready",
    "riskCounts": {"read": 1, "write": 1, "destructive": 0},
    "findingCounts": {"high": 0, "medium": 0, "low": 2}
  }
}

See examples/sample-input.json and examples/sample-output.json for complete schema-valid contracts. No source is prefilled because users must intentionally choose exactly one input form.

Pricing

A successfully delivered deterministic audit charges one openapi-audit event. Invalid inputs, unsafe targets, unreachable documents, unsupported formats, and analyzer failures are uncharged. The Actor checks the remaining event budget before fetching or analyzing the document. The current event price is displayed by Apify.

Privacy and security

Inline documents are processed in memory. Remote retrieval never follows a redirect without rechecking the destination. Described operations are never called, and external $ref targets are never fetched. Published output is sanitized for authorization values, API keys, tokens, passwords, secrets, private keys, and sensitive URL query parameters. API-IFY operates no separate database for this Actor.

Operations and support

Use Apify schedules to audit a specification after releases, and consume results through the dataset API or integrations. When requesting support through Apify Issues, provide the run ID and result itemId without attaching confidential specifications or credentials.