Skip to main content



This rule belongs to the openapi-v3-standards-validation ruleset and states that:

If the security scheme type is OpenId Connect (i.e. type is set to openIdConnect), the Security Scheme Object must specify the OpenId Connect URL to discover OAuth2 configuration values, using the openIdConnectUrl property.

Maximum SeverityError
MessageRequired openIdConnectUrl property in OpenId Connect Security Scheme Object is missing.
Rule SystemSemantic
Broad CategorySecurity Schemes
Products ImpactedAPI Transformer, Code Generation, Developer Experience Portal
Tagsopenapi3 openapi standards semantic validation url openid connect openid type security scheme security

Suggested Fixes

  • Add missing openIdConnectUrl property in the Security Scheme Object.
  • Make sure that the openIdConnectUrl property is not null or empty
  • Choose a different security scheme type if OpenId Connect URL is not applicable in your API authentication's case.

For More Information