{ "openapi": "3.0.1", "info": { "title": "OpenAPI Security Auditor", "description": "Audit OpenAPI/Swagger documents and public API endpoints for authentication gaps, sensitive-data exposure, missing rate limits, TLS and security-header issues. Scored JSON, Markdown and SARIF output for CI/CD.", "version": "0.1", "x-build-id": "94UW7WSvjyxl53mOw" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/michiganpublictech~openapi-security-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-michiganpublictech-openapi-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/michiganpublictech~openapi-security-auditor/runs": { "post": { "operationId": "runs-sync-michiganpublictech-openapi-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/michiganpublictech~openapi-security-auditor/run-sync": { "post": { "operationId": "run-sync-michiganpublictech-openapi-security-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "specUrls": { "title": "OpenAPI / Swagger document URLs", "type": "array", "description": "Public URLs of OpenAPI 3.0/3.1 or Swagger 2.0 documents (JSON or YAML). Each document is one audited API (one 'api-audited' event).", "items": { "type": "string" } }, "specText": { "title": "Pasted OpenAPI / Swagger document", "type": "string", "description": "Paste a complete OpenAPI 3.0/3.1 or Swagger 2.0 document (JSON or YAML) here, e.g. from your repository. Useful for private APIs whose documentation is not publicly reachable. External $refs are not fetched — bundle the document first." }, "apiBaseUrls": { "title": "API base URLs (discovery)", "type": "array", "description": "Base URLs of public APIs, e.g. https://api.example.com. If the URL itself is not an API description, the Actor probes a fixed list of 8 well-known documentation paths (/openapi.json, /openapi.yaml, /swagger.json, /v3/api-docs, /v2/api-docs, /api-docs, /swagger/v1/swagger.json, /.well-known/openapi.json).", "items": { "type": "string" } }, "runtimeChecks": { "title": "Run passive runtime checks", "type": "boolean", "description": "Also inspect the live API host: TLS certificate and protocol versions, security headers, CORS behaviour and whether content is served over plain HTTP. Uses one TLS handshake (plus TLS 1.0/1.1 acceptance probes), one GET and one CORS preflight OPTIONS request per API — no fuzzing, no credentials, no exploitation. The host checked is the API base URL, or the first server declared in the document. Charged as 'runtime-checks' per API, only when the checks actually ran. Requires 'I am authorized to test these hosts'.", "default": false }, "confirmAuthorization": { "title": "I am authorized to test these hosts", "type": "boolean", "description": "Confirm that you own, or have explicit permission to test, every API host contacted by runtime checks (the API base URLs you list and the servers declared in the documents you supply). Runtime checks never run without this confirmation.", "default": false }, "minSeverity": { "title": "Minimum severity to report", "enum": [ "info", "low", "medium", "high", "critical" ], "type": "string", "description": "Only include findings at or above this severity in the output. The score is always computed from all findings, so filtering does not change it.", "default": "info" }, "failOnSeverity": { "title": "Fail the run at severity", "enum": [ "none", "critical", "high", "medium", "low" ], "type": "string", "description": "CI gate: mark the run as FAILED when any reported finding is at or above this severity. Results are still saved. 'none' disables the gate.", "default": "none" }, "disabledRules": { "title": "Disabled rules", "type": "array", "description": "Rule IDs to skip, e.g. OAS-QUAL-001. See the rule catalog (RULES.md). Requires a plan with the 'custom_rules' feature (Pro and above); otherwise ignored with a note.", "items": { "type": "string" } }, "licenseKey": { "title": "License key", "type": "string", "description": "Optional. Enterprise, prepaid or self-hosted license key (AFY1.…). Apify Store users do not need one." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }