Articles
Author
vacuum
Quick Start
💥 Try It Now
About vacuum
Installing
Why?
Concepts
FAQ
AsyncAPI
Arazzo
Ignoring Violations
JSON Schema
Changelog
Configuring
Generate API Docs
VSCode Plugin
GitHub Action
CLI Commands
Lint
vacuum Report
Dashboard
Generate Docs
HTML Report
Spectral Report
References
Upgrade vacuum
Version
Bundle Spec
Generate RuleSet
Language Server
Apply Overlay
Schema
Open Collection
Change Detection
Exit Codes
Developer API
API Quick Start
Spec Index
RuleResultSet
Loading RuleSet
Custom Go
Custom JS
Non-OpenAPI Files
Functions
Core Functions
OpenAPI Functions
OWASP Functions
JSON Schema Funcs
AsyncAPI Funcs
Arazzo Funcs
Rules
Examples
OWASP
Channels
Operations/Paths
Messages
Schemas
Spec Information
Servers
Validation
Descriptions
Tags
Security
Arazzo
RuleSets
What are they?
Sharing RuleSets
No Rules/Off
OpenAPI Default
Custom RuleSets
OWASP Rules
JSON Schema Rules
AsyncAPI Default
AsyncAPI All Rules
Arazzo Default
Arazzo All Rules
  • GitHub GitHub Repo stars
  • Discord Discord Server
    • ✨ New! Try the OpenAPI Doctor ✨ The OpenAPI Doctor

    OWASP API Rules

    Apply Open Worldwide Application Security Project (OWASP) API rules to your OpenAPI specification using vacuum.

    The original rules were written by Ricardo Graça.

    Use hard mode or the OWASP ruleset to check authentication, transport, request limits, and error responses.

    owasp-auth-urls-https owasp-oauth-no-implicit owasp-oauth-no-password owasp-security-hosts-https-oas3 owasp-security-hosts-https-oas2 owasp-constrained-additionalProperties owasp-no-additionalProperties owasp-integer-format owasp-integer-limit-legacy owasp-integer-limit owasp-string-restricted owasp-string-limit owasp-array-limit owasp-define-error-responses-429 owasp-rate-limit-retry-after owasp-rate-limit owasp-define-error-responses-500 owasp-define-error-responses-401 owasp-define-error-validation owasp-protection-global-safe owasp-protection-global-unsafe-strict owasp-protection-global-unsafe owasp-jwt-best-practices owasp-auth-insecure-schemes owasp-no-credentials-in-url owasp-no-api-keys-in-url owasp-no-http-basic owasp-no-numeric-ids