# Is your API description public, and does it match your API?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

This Deep scan check reads public API descriptions such as OpenAPI documents, and which operations they say need sign-in. A description proves nothing about enforcement.

This check reads a public machine-readable API description, such as an OpenAPI document, and notes which operations it says need sign-in. Publishing one can be deliberate, and it is also a map of your API.

## What does this check look at?

It looks at whether a machine-readable API description, such as an OpenAPI document, is public, and which operations it says need sign-in. Deep then uses the description to test some read operations one at a time, and reports any that answer without sign-in separately. Tools meant for developers, like a public list of every API action or a query explorer, left on in the live site, are one of the things Lockpick's guide warns about.

Only a Deep scan runs it, after you prove you own the site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Info finding | A parsed description is public. | Decide whether it should be, and test permissions on the real API. |

What a description says about permissions does not prove what the running API enforces. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |
| CWE | `CWE-200` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Keep it public on purpose or move it behind sign-in, and either way test the API itself.

:::fix-prompt any
My API description document (OpenAPI or Swagger) is publicly reachable. Tell me whether anything in my app needs it to be public. If not, serve it only to signed-in staff or remove it from the production build. Either way, list every operation it describes and check in my code that each one enforces authentication and checks the caller owns the data, then add a test per route that a request with no session is refused.
:::

## How to check

Say Atlas, our example app at `atlas.example`, serves its OpenAPI document to anyone. A Deep scan parses it, notes three operations with no declared sign-in and tests the safe ones once each.

Deep scans come with the Deep plan, and [pricing](/pricing) shows what it includes. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains what each scan reads, and the [full list of checks](/checks) shows the rest.

## Questions people ask

### Is a public API description a vulnerability?

No. Many public APIs publish one on purpose. It becomes a problem when it describes routes that should be private and those routes do not check who is calling.

### Does Deep call every operation in the description?

No. It only sends a read-only request to a limited number of operations that need no input, within the scan budget.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [Your admin page is online](https://www.lockpick.app/docs/learn/your-admin-page-is-online), Lockpick docs, read on 2026-10-07