owasp-security-hosts-https-oas3

All server interactions MUST use the https protocol, so the only OpenAPI scheme being used should be https.

Bad example

openapi: "3.1.0"
info:
  version: "1.0"
paths:
  /chickenNuggets:
servers:
  - url: http://api.quobix.com/

Good Example

openapi: "3.1.0"
info:
  version: "1.0"
paths:
  /chickenNuggets:
servers:
  - url: https://api.quobix.com/

How do I fix this violation?

Make sure all servers use the https protocol.

In this day and age, there should never be a reason why you are not using https for all your server interactions, unless this is an internal API that is not exposed to the internet. If that’s the case, then just disable this rule.