owasp-no-numeric-ids
OWASP API1:2019 - Use random IDs that cannot be guessed. UUIDs are preferred
The rule reports integer parameters whose names end in id, without regard to case. It checks parameter schemas, not arbitrary object properties. A string identifier passes; format: uuid is recommended but is not required by this check.
Bad example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/fish/{id}/:
get:
description: "get"
parameters:
- name: id
in: path
required: true
schema:
type: integer
responses:
'200':
description: OK
Good Example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/fish/{id}/:
get:
description: "get"
parameters:
- name: id
in: path
required: true
schema:
type: string
format: uuid
responses:
'200':
description: OK
How do I fix this violation?
For any parameter which ends in id, use type string with uuid format instead of type integer.