# Is your interactive API documentation open to anyone?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This Deep scan check flags interactive API documentation reachable without signing in. It is reconnaissance value for attackers, not a flaw on its own.

This check flags interactive API documentation, such as a Swagger or Redoc page, that anyone can open without signing in. It lists what your API can do for whoever finds it.

## What does this check look at?

It looks at whether interactive API documentation is reachable without signing in. Tools meant for developers, like a public list of every API action or a query explorer, left on in the live site, are one of the things Lockpick's guide warns about. No operation is invoked from the page.

Only a Deep scan runs it, after you prove you own the site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | A documentation interface answered without sign-in. | Keep it public on purpose, or move it behind sign-in. |

Public documentation is a map for attackers, not proof that any operation is unprotected. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

No OWASP, CWE or ASVS reference fits this check closely enough to state, so the report and this page leave it unmapped.

## Fix it with your AI

Most frameworks mount these pages with one setting you can turn off in production.

:::fix-prompt any
My production site serves interactive API documentation (Swagger UI, Redoc or similar) to anyone. Find where my app mounts it, and either turn it off when NODE_ENV is production or protect it with the same sign-in my admin area uses. Do not rely on an unlisted address to hide it. Show me the change.
:::

## How to check

Say Atlas, our example app at `atlas.example`, left its Swagger page on in production. A Deep scan notes it as information, with no effect on the grade.

Deep scans come with the Deep plan, and [pricing](/pricing) shows what it includes. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Should public API docs always be removed?

No. If your API is a product others build on, public docs are the point. Remove them when they describe internal routes.

### Does hiding the docs make my API safe?

No. Attackers can still find routes in your site code. Every route needs its own sign-in and permission checks.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Your admin page is online](https://www.lockpick.app/docs/learn/your-admin-page-is-online), Lockpick docs, read on 2026-10-07