OWASP API Rules

Apply Open Worldwide Application Security Project (OWASP) API rules to your OpenAPI specification using vacuum.

Use hard mode or the OWASP ruleset to check authentication, transport, request limits, and error responses.

Current rules

Vacuum includes 26 active OWASP rules for OpenAPI 3.0, 3.1, and 3.2. All are included in vacuum:owasp and hard mode. They check the API description; they do not test the running API.

• Authentication: API keys and credentials in URLs, numeric IDs, HTTP Basic and legacy HTTP schemes, JWT documentation, OAuth password and implicit flows, and authentication endpoint HTTPS.
• Operation security: declared security for GET/HEAD and write operations, with a strict check for anonymous write alternatives.
• Transport: HTTPS for explicit server URL schemes, including overrides and variables.
• Schemas: request object and map restrictions, request array and string size limits, string value restrictions, and integer bounds and formats.
• Responses: validation errors, 401/429/500 errors with schemas, rate-limit headers, and Retry-After headers.

The list below also retains two historical pages: owasp-integer-limit-legacy and owasp-security-hosts-https-oas2. Both rules were removed in v0.7.0.