The validation must answer three separate questions: is the document interpretable, is the contract sufficiently secure and documented, and does the implementation actually meet this contract?
The four levels
| Level | Purpose | Moment |
|---|---|---|
| Syntax | Read YAML or JSON | Editor and commit |
| Structure | Meet specification | Pull request |
| Policy | Internal security and documentation | Quality gate |
| Actual contract | Compare API and document | Integration tests |
Choose blocking rules
Block as a priority the impossible references, invalid structures, operations without usable response and security inconsistencies. Too short descriptions or missing examples can start as warnings, then become blockers after adoption by the team.
Check compatibility
A valid specification can still break a client: field deletion, type change or new mandatory value. Compare the proposed version to the published version and document the break policy.
Integrate into IC
- Analyze the file at each merger request.
- Archive the report and make the alerts visible in the journal.
- Fail only on the severity defined by the policy.
- Then run the contract tests against the environment concerned.
Report OpenAPI and SARIF
APICheck controls the standard, security and documentation, without calling the declared servers.
Validate a specificationSee specification OpenAPI Official and page validator OpenAPI online.
Published on 19 July 2026.