Skip to main content

required-api-key-security-scheme-parameter-location

Overview​

This rule belongs to the openapi-v3-standards-validation ruleset and states that:

If the security scheme type is API Key (i.e. type is set to apiKey), the Security Scheme Object must specify a location for the API Key parameter using the in property. Valid values for location include query, header and cookie.

PropertyValue
EnabledYes
Maximum SeverityError
MessageRequired in property in API key Security Scheme Object is missing.
CodeOPENAPI3STANDARDS_V413
TypeValidation
Rule SystemSemantic
Broad CategorySecurity Schemes
Products ImpactedAPI Transformer, Code Generation, Developer Experience Portal
Tagsopenapi3 openapi standards semantic validation location api key type security scheme security

Suggested Fixes​

  • Add missing in property in the Security Scheme Object.
  • Make sure that the in property is not null or empty.
  • Ensure that the in property has one of the following values: query, header and cookie
  • Choose a different security scheme type if API key location is not applicable in your API authentication's case.

For More Information​