OWASP API9 2023 Inventory Access (Edit)

Servers should use the x-internal vendor extension set to true or false to explicitly declare the intended audience for the API, which will be picked up by most documentation tools.

OWASPSecurityServersInventoryOpenAPI

Rule Definition

owasp-api9-2023-inventory-access-error.yaml
{"owasp-api9-2023-inventory-access-error":{"description":"Servers should use the x-internal vendor extension set to true or false to explicitly declare the intended audience for the API, which will be picked up by most documentation tools.","message":"Declare intended audience of every server by defining x-internal as true or false.","given":"$.servers.*","severity":"error","then":{"field":"x-internal","function":"defined"}}}

Back to All of the Rules