OpenAPI Inspector & Validator

About this tool

Review an API contract as both a standards-validated document and an actionable endpoint inventory without resolving remote references.

OpenAPI Inspector & Validator takes a Swagger 2.0, OpenAPI 3.0, or OpenAPI 3.1 document in YAML or JSON and runs it through Swagger Parser inside a Web Worker in your browser. If the document is structurally sound, you get a searchable table of every operation with its method, path, operation ID, declared response codes, security mode, and flags for deprecation and request bodies, alongside counts of paths, operations, and security schemes. A second pass applies five release checks the specification itself does not enforce: missing or duplicate operation IDs, path parameters used in a URL but never declared, operations without a success response, and operations with no security requirement. The whole result can be copied or downloaded as a JSON report.

• Parses bounded YAML or JSON with alias, merge, depth, node, operation, warning, and execution limits before Swagger Parser validation.
• Resolves local references for inventory but rejects every external $ref before validation without making a network request.
• Reports endpoints, responses, operation IDs, path parameter declarations, applied security, deprecation, request bodies, deterministic review warnings, and timestamped JSON evidence.

How to use OpenAPI Inspector

Paste your contract into the OpenAPI document editor, or click Open YAML or JSON to load a .yaml, .yml, or .json file up to 5,000,000 bytes. A sample Publishing API is preloaded, so you can press Validate and inspect right away to see what a result looks like, and Restore sample brings it back later. Validation runs in a disposable worker with a 10-second cap, and a Stop button appears while it works. When it finishes, type into Search operations to filter the endpoint inventory by method, path, operation ID, summary, or tag, and use the Warning type dropdown to focus on one check such as missing-operation-id. Any edit marks the result stale, so validate again before you click Download JSON report.

When this tool is useful

• An API developer wants to confirm a hand-edited YAML contract still parses before pushing it to a documentation build or CI pipeline.
• A platform team reviewing a partner's Swagger 2.0 file needs a quick inventory of every endpoint and which ones lack authentication.
• Before running a code generator, you want to catch duplicate operation IDs that would produce colliding method names in the client.
• A technical writer needs to see which operations are deprecated or missing a summary while planning reference documentation.
• During a security review, someone needs a list of operations with no security requirement without reading thousands of lines by hand.

Practical tips

• Bundle multi-file specs first: every external $ref, including relative file paths and HTTP URLs, is rejected before validation rather than fetched, so split contracts fail immediately.
• Review warnings are advisory. A document can be structurally valid and still list dozens of no-security-requirement warnings that are intentional for public endpoints.
• The inventory table shows at most 500 operations at a time, so use the search box to narrow large contracts instead of scrolling.
• If validation hits the 10-second limit, the usual causes are deep schema nesting or heavy YAML alias reuse; trim examples or components and try again.
• Watch the character counter under the editor. Very large generated contracts can exceed 5,000,000 characters and will be refused before the worker starts.

Examples you can test

Load an example, compare the result with the expected output, then replace it with your own input.

OpenAPI 3.0 YAML with GET /users/{userId} that lists no parameters array

Structurally valid badge, one operation in the inventory, and a missing-path-parameter warning pointing at the /users/{userId} GET operation

The built-in Publishing API sample: OpenAPI 3.1.0, a global bearerAuth requirement, and one listArticles GET operation

1 path, 1 operation, 1 security scheme, a security column reading global, and zero review warnings

Validation checklist

• Confirm the version badge matches the openapi or swagger field you expected.
• Compare the operations count with the number of endpoints your team believes exist.
• Resolve every duplicate-operation-id warning before generating client or server code.
• Decide deliberately which no-security-requirement warnings are acceptable public endpoints.
• Re-run validation after any edit so the downloaded report reflects the current text.