OpenAPI Contract Guard

Inspect, lint, summarize, diff, and apply explicit policy to bounded OpenAPI 3.0 and 3.1 JSON or YAML without resolving a network reference.

Get an API key on RapidAPI OpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST: POST /v1/openapi/policy-check
MCP tool: check_openapi_contract_policy
Inputs: One OpenAPI 3.0 or 3.1 JSON object or JSON/YAML string up to 512 KiB; diff accepts two descriptions with a 768 KiB combined cap; policy accepts explicit version, operation-count, method, HTTPS, security, host, and reference constraints.
Returns: CLEAR, REVIEW_REQUIRED, or BLOCKED with canonical hash, contract counts, named findings, operation evidence, bounded changes, ruleset version, and next action.
Latency: Synchronous
Usage unit: OpenAPI contract operation

The suite also exposes /v1/openapi/inspect, /v1/openapi/lint, /v1/openapi/summarize, and /v1/openapi/diff plus /mcp/openapi. It never fetches a URL, resolves a remote reference, invokes the described API, generates or executes code, or stores the payload. CLEAR is not a complete compatibility, security, authorization, deployability, or provider-import guarantee.

AGENT-READABLE EXCEPTIONS

OPENAPI_PARSE_ERROROPENAPI_YAML_ALIAS_REJECTEDOPENAPI_VERSION_UNSUPPORTEDOPENAPI_PATH_PARAMETER_UNDECLAREDOPENAPI_OPERATION_ID_DUPLICATEOPENAPI_REMOTE_REFERENCE_BLOCKEDOPENAPI_REQUIRED_PARAMETER_ADDEDOPENAPI_OPERATION_REMOVEDOPENAPI_OUTPUT_TOO_LARGE

HTTP request

POST /v1/openapi/policy-check
Authorization: Bearer apc_...
Content-Type: application/json

{
  "document": {
    "openapi": "3.1.0",
    "info": {
      "title": "Orders API",
      "version": "1.0.0"
    },
    "servers": [
      {
        "url": "https://api.example.com"
      }
    ],
    "paths": {
      "/orders/{order_id}": {
        "get": {
          "operationId": "getOrder",
          "security": [
            {
              "bearerAuth": []
            }
          ],
          "parameters": [
            {
              "name": "order_id",
              "in": "path",
              "required": true,
              "schema": {
                "type": "string"
              }
            }
          ],
          "responses": {
            "200": {
              "description": "Order"
            }
          }
        }
      }
    },
    "components": {
      "securitySchemes": {
        "bearerAuth": {
          "type": "http",
          "scheme": "bearer"
        }
      }
    }
  },
  "require_operation_ids": true,
  "require_success_responses": true,
  "require_https_servers": true,
  "require_security": true,
  "block_remote_references": true
}

cURL (bash)

curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/openapi/policy-check' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "document": {
    "openapi": "3.1.0",
    "info": {
      "title": "Orders API",
      "version": "1.0.0"
    },
    "servers": [
      {
        "url": "https://api.example.com"
      }
    ],
    "paths": {
      "/orders/{order_id}": {
        "get": {
          "operationId": "getOrder",
          "security": [
            {
              "bearerAuth": []
            }
          ],
          "parameters": [
            {
              "name": "order_id",
              "in": "path",
              "required": true,
              "schema": {
                "type": "string"
              }
            }
          ],
          "responses": {
            "200": {
              "description": "Order"
            }
          }
        }
      }
    },
    "components": {
      "securitySchemes": {
        "bearerAuth": {
          "type": "http",
          "scheme": "bearer"
        }
      }
    }
  },
  "require_operation_ids": true,
  "require_success_responses": true,
  "require_https_servers": true,
  "require_security": true,
  "block_remote_references": true
}'

Representative response

{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "permitted": true,
  "openapi_version": "3.1.0",
  "operation_count": 1,
  "path_count": 1,
  "canonical_sha256": "c2f9...",
  "findings": [],
  "ruleset_version": "2026-08-11",
  "static_analysis_only": true,
  "remote_references_resolved": false,
  "api_invoked": false,
  "code_generated_or_executed": false,
  "payload_stored": false,
  "next_action": "Continue with target-gateway validation, integration tests, authorization review, and runtime enforcement."
}

No URL or reference fetchThe API examines only the supplied contract; remote references are reported but never resolved.

Bounded compatibility rulesDiff results cover documented operation, parameter, request-body, response, security, and top-level schema changes—not complete compatibility proof.

Target-gateway validation requiredA CLEAR result still requires provider import, integration, authorization, and runtime enforcement tests.

Use OpenAPI Contract Guard through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPI Compare marketplace controls →