Skip to main content

required-oauth2-flow-token-url

Overview​

This rule belongs to the openapi-v3-standards-validation ruleset and states that:

If the flow type is set as password, clientCredentials or authorizationCode in the OAuth Flows Object, then the OAuth Flow Object must specify the token URL to be used for this flow, using the tokenUrl property.

PropertyValue
EnabledYes
Maximum SeverityError
MessageRequired tokenUrl property in OAuth Flow Object is missing.
CodeOPENAPI3STANDARDS_V441
TypeValidation
Rule SystemSemantic
Broad CategoryOAuth 2.0 Flows
Products ImpactedAPI Transformer, Code Generation, Developer Experience Portal
Tagsopenapi3 openapi standards semantic validation url access token token oauth2 flows type security scheme security

Suggested Fixes​

  • Add missing tokenUrl property in the OAuth Flow Object.
  • Make sure that the tokenUrl is not null or empty.
  • Choose a different flow type in the OAuth Flows Object if the current URL is not applicable for your API authentication.

For More Information​