← CodeClarityLab Home
Browse by Category
+ added · updated 7d
← Back to glossary

OpenAPI / Swagger Specification

architecture Intermediate

Also Known As

OpenAPI Specification Swagger OAS API spec

TL;DR

A machine-readable YAML/JSON description of a REST API — enabling auto-generated documentation, client SDKs, mock servers, and contract testing.

Explanation

OpenAPI (formerly Swagger) is the standard for describing REST APIs in YAML or JSON: endpoints, parameters, request/response schemas, authentication methods, and error codes. An OpenAPI spec enables: Swagger UI interactive documentation, auto-generated client SDKs, contract testing (Dredd, Schemathesis), and mock servers for frontend development against a not-yet-built backend. PHP tools include zircote/swagger-php (annotation-based generation from docblocks), API Platform (spec-first approach), and league/openapi-psr7-validator for runtime request validation. Design-first (write the spec before the code) consistently produces better-structured APIs than code-first generation.

Common Misconception

OpenAPI is just API documentation. An OpenAPI spec also drives code generation for clients and servers, automated contract testing, mock servers, and validation middleware — treating it as living documentation that drives tooling is far more valuable than static docs alone.

Why It Matters

OpenAPI (Swagger) is the standard for describing REST APIs — a machine-readable spec enables auto-generated docs, client SDKs, and contract testing, making the API a verifiable artifact not just documentation.

Common Mistakes

  • Writing OpenAPI docs manually after the fact — they drift from the implementation immediately.
  • Not using $ref for shared schemas — duplicate schema definitions diverge over time.
  • Missing error response schemas — consumers cannot handle errors programmatically without them.
  • Not validating requests against the OpenAPI spec at runtime — the spec and code can contradict each other.

Code Examples

✗ Vulnerable
# OpenAPI with no error schemas — consumers can't handle errors:
paths:
  /users/{id}:
    get:
      responses:
        '200':
          content:
            application/json:
              schema: {$ref: '#/components/schemas/User'}
        # Missing 404, 422, 500 schemas — errors undocumented
✓ Fixed
# OpenAPI 3.0 spec (openapi.yaml)
openapi: 3.0.3
info:
  title: Order API
  version: '2.0'
paths:
  /orders:
    post:
      summary: Place an order
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required: [user_id, items]
              properties:
                user_id: { type: integer }
                items:
                  type: array
                  items:
                    type: object
                    required: [product_id, quantity]
                    properties:
                      product_id: { type: integer }
                      quantity:   { type: integer, minimum: 1 }
      responses:
        '201': { description: Order created }
        '422': { description: Validation error }

# Generate PHP client:
$ openapi-generator generate -i openapi.yaml -g php -o client/

Added 15 Mar 2026
Edited 22 Mar 2026
Views 27
Rate this term
No ratings yet
🤖 AI Guestbook educational data only
| |
Last 30 days
0 pings F 0 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 0 pings F 0 pings S 1 ping S 0 pings M 0 pings T 0 pings W 2 pings T 1 ping F 4 pings S 0 pings S 0 pings M 0 pings T 0 pings W 0 pings T 1 ping F 1 ping S 1 ping S 0 pings M 0 pings T 0 pings W 1 ping T 0 pings F 0 pings S
No pings yet today
No pings yesterday
Amazonbot 8 Google 4 Perplexity 3 ChatGPT 3 Unknown AI 2 Ahrefs 2 SEMrush 2
crawler 22 crawler_json 2
DEV INTEL Tools & Severity
🟡 Medium ⚙ Fix effort: Medium
⚡ Quick Fix
Define your API with OpenAPI 3.x — generate interactive docs with Swagger UI, validate requests/responses with middleware, and generate client SDKs automatically
📦 Applies To
any web api laravel symfony
🔗 Prerequisites
🔍 Detection Hints
No openapi.yaml or openapi.json in project; API documentation in README or Postman only; no request validation against schema
Auto-detectable: ✓ Yes spectral swagger-php redoc swagger-ui
⚠ Related Problems
🤖 AI Agent
Confidence: Medium False Positives: Low ✗ Manual fix Fix: Medium Context: File

✓ schema.org compliant