Public API Exposure Auditor

Audit an OpenAPI 3.0 or 3.1 description for administrative, operator, internal, billing, debug, and other sensitive surfaces that may have been included in a public API description unintentionally.

This deterministic OpenAPI security audit helps API developers and platform, security, and DevSecOps teams review a public API attack surface before release. It is also useful in CI/CD validation and agent-ready API security reviews.

Safety model

The Actor analyzes the OpenAPI description itself. It does not select, call, or execute the API operations described by the specification, send exploit payloads, attempt authentication bypass, or mutate target state.

Safe live verification is optional and off by default. When verifySafe is enabled, the Actor separately makes bounded GET, HEAD, or OPTIONS requests to a fixed allowlist of operational paths on the supplied baseUrl. It does not derive those requests from the operations in the OpenAPI document.

What it checks

The current API exposure audit applies deterministic rules for:

• sensitive path names associated with admin, operator, internal, billing, or debug functions;
• sensitive routes with explicit anonymous access or no documented security;
• unauthenticated state-changing operations;
• operations explicitly marked for a non-public audience with x-audience, x-internal, or x-visibility;
• potentially identifying path parameters such as email, phone, SSN, or token;
• billing, subscription, setup-link, API-key, and impersonation routes;
• publicly documented health, metrics, diagnostics, and other operational endpoints, including response schemas that expose verbose internal metadata;
• debug or operator mutations; and
• response schemas containing secret- or credential-like property names.

Each finding reports a stable rule ID, severity, confidence, category, affected HTTP method and path, evidence, and remediation guidance. Naming signals are not reported as proof of exploitability.

The analyzer normalizes operation IDs, tags, and server URLs while parsing, but the current rule set does not infer exposure from those values alone. It is an OpenAPI analyzer and API security scanner, not a penetration test.

Input

Provide exactly one OpenAPI source:

• document: an inline OpenAPI 3.0/3.1 JSON object;
• yaml: an inline UTF-8 OpenAPI YAML string; or
• sourceUrl: a public HTTPS URL serving OpenAPI JSON or YAML.

Optional controls are verifySafe (default false), its required public HTTPS baseUrl, and failOn, which accepts info, low, medium, high, or critical.

Example input:

{
  "document": {
    "openapi": "3.1.0",
    "info": {"title": "Example API", "version": "1.0.0"},
    "paths": {
      "/admin/users": {
        "get": {
          "operationId": "listAdminUsers",
          "security": [],
          "responses": {"200": {"description": "OK"}}
        }
      }
    }
  }
}

Output

The default dataset receives one result envelope. Its result.report contains the OpenAPI version, operation count, findings, severity counts, limitations, target details, and optional safe-verification results. The envelope also contains status, evidence references, warnings, errors, provenance, and timing. A compact run summary is stored as the RUN_SUMMARY key-value-store record.

Representative abbreviated output:

{
  "actor": "api-exposure-auditor",
  "status": "success",
  "target": {"type": "openapi", "identifier": "inline"},
  "result": {
    "report": {
      "openapiVersion": "3.1.0",
      "operationCount": 1,
      "severityCounts": {"info": 0, "low": 0, "medium": 1, "high": 1, "critical": 0},
      "findings": [
        {
          "id": "EXP-AUTH-001",
          "severity": "high",
          "confidence": "high",
          "category": "authentication",
          "method": "GET",
          "path": "/admin/users",
          "title": "Sensitive route explicitly disables authentication",
          "evidence": ["operation.security == [] at GET /admin/users"],
          "remediation": "Require authentication on this route or remove it from the public spec."
        }
      ]
    }
  },
  "warnings": [],
  "errors": []
}

Built by Sentinel Signal Systems.

Developer utilities: https://sentinelsignal.io/tools