APIs.io Engineering Platform API Security API

openapi: 3.0.0
info:
  version: "1.0.0"
  x-release: v4
  title: APIs.io Engineering Platform Amazon API Gateway 2014 11 13 API Security API
  description: <fullname>Amazon API Gateway</fullname> <p>Amazon API Gateway helps developers deliver robust, secure, and scalable mobile and web application back ends. API Gateway allows developers to securely connect mobile and web applications to APIs that run on AWS Lambda, Amazon EC2, or other publicly addressable web services that are hosted outside of AWS.</p>
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_twitter.com_awscloud_profile_image.png
    backgroundColor: '#FFFFFF'
  termsOfService: https://aws.amazon.com/service-terms/
  contact:
    name: Mike Ralphson
    email: mike.ralphson@gmail.com
    url: https://github.com/mermade/aws2openapi
    x-twitter: PermittedSoc
  license:
    name: Apache 2.0 License
    url: http://www.apache.org/licenses/
  x-providerName: amazonaws.com
  x-serviceName: apigateway
  x-origin:
  - contentType: application/json
    url: https://raw.githubusercontent.com/aws/aws-sdk-js/master/apis/apigateway-2015-07-09.normal.json
    converter:
      url: https://github.com/mermade/aws2openapi
    x-apisguru-driver: external
  x-apiClientRegistration:
    url: https://portal.aws.amazon.com/gp/aws/developer/registration/index.html?nc2=h_ct
  x-apisguru-categories:
  - cloud
  x-preferred: true
servers:
- url: http://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: https://apigateway.{region}.amazonaws.com
  variables:
    region:
      description: The AWS region
      enum:
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2
      - us-gov-west-1
      - us-gov-east-1
      - ca-central-1
      - eu-north-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - eu-central-1
      - eu-south-1
      - af-south-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-southeast-1
      - ap-southeast-2
      - ap-east-1
      - ap-south-1
      - sa-east-1
      - me-south-1
      default: us-east-1
  description: The Amazon API Gateway multi-region endpoint
- url: http://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
- url: https://apigateway.{region}.amazonaws.com.cn
  variables:
    region:
      description: The AWS region
      enum:
      - cn-north-1
      - cn-northwest-1
      default: cn-north-1
  description: The Amazon API Gateway endpoint for China (Beijing) and China (Ningxia)
security:
- hmac: []
tags:
- name: API Security
  description: The **API Security** endpoints enable you to manage the [security of your API](https://learning.postman.com/docs/api-governance/api-definition/api-definition-warnings/). API security includes ensuring you follow security and format warnings and schema validation.
paths:
  /security/api-validation:
    post:
      summary: APIs.io Engineering Platform API definition security validation
      description: 'Performs an analysis on the given definition and returns any issues based on your [predefined rulesets](https://learning.postman.com/docs/api-governance/configurable-rules/configurable-rules-overview/). This endpoint can help you understand the violations'' impact and offers solutions to help you resolve any errors. You can include this endpoint to your CI/CD process to automate schema validation.


        For more information, see [Track governance and security rule violations in the API definition](https://learning.postman.com/docs/api-governance/api-definition/api-definition-warnings/).


        **Note:**


        - The maximum allowed size of the definition is 10 MB.

        - You must [import and enable](https://learning.postman.com/docs/api-governance/configurable-rules/configuring-api-security-rules/) Postman''s [OWASP security rules](https://postman.postman.co/api-governance/libraries/postman_owasp/view) for this endpoint to return any security rule violations.

        '
      operationId: schemaSecurityValidation
      tags:
      - API Security
      requestBody:
        $ref: '#/components/requestBodies/schemaSecurityValidation'
      responses:
        '200':
          $ref: '#/components/responses/schemaSecurityValidation'
        '400':
          $ref: '#/components/responses/schemaSecurityValidation400Error'
        '401':
          $ref: '#/components/responses/common401Error'
        '403':
          $ref: '#/components/responses/featureUnavailable403Error'
        '500':
          $ref: '#/components/responses/common500ErrorServerError'
components:
  schemas:
    schemaSecurityValidation400Error:
      title: Invalid Schema
      type: object
      properties:
        error:
          type: object
          properties:
            name:
              type: object
              properties:
                name:
                  type: string
                  description: The error name.
                  example: Invalid schema
                message:
                  type: string
                  description: The error message.
                  example: Provided schema type is not supported.
    featureUnavailable403Error:
      title: Feature Unavailable
      type: object
      properties:
        type:
          type: string
          format: uri-reference
          description: The [URI reference](https://www.rfc-editor.org/rfc/rfc3986) that identifies the type of problem.
          example: https://api.postman.com/problems/forbidden
        title:
          type: string
          description: A short summary of the problem.
          example: Forbidden
        detail:
          type: string
          description: Information about the error.
          example: This feature isn't available in your region.
        status:
          type: integer
          format: http-status-code
          description: The error's HTTP status code.
          example: 403
    schemaSecurityValidationRequest:
      title: Schema Validation Request Body
      type: object
      properties:
        schema:
          type: object
          required:
          - language
          - schema
          - type
          properties:
            language:
              type: string
              description: The definition format.
              enum:
              - json
              - yaml
              example: json
            schema:
              type: string
              description: The stringified API definition.
              example: '{"openapi":"3.0.0","info":{"version":"1","title":"temp","license":{"name":"MIT"}},"servers":[{"url":"https://petstore.swagger.io/v1"}],"paths":{"/user":{"get":{"summary":"Details about a user","operationId":"listUser","tags":["user"],"parameters":[{"name":"id","in":"query","description":"ID of the user","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"Details about a user","headers":{"x-next":{"description":"A link to the next page of responses","schema":{"type":"string"}}},"content":{"application/json":{"schema":{$ref:"#/components/schemas/User"}}}},"default":{"description":"unexpected error","content":{"application/json":{"schema":{$ref:"#/components/schemas/Error"}}}}}}}},"components":{"schemas":{"User":{"type":"object","required":["id","name"],"properties":{"id":{"type":"integer","format":"int64"},"name":{"type":"string"},"tag":{"type":"string"}}},"Error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer","format":"int32"},"message":{"type":"string"}}}},"securitySchemes":{"BasicAuth":{"type":"http","scheme":"basic"}}},"security":[{"BasicAuth":[]}]}'
            type:
              type: string
              description: The definition type.
              enum:
              - openapi3
              - openapi2
              example: openapi3
  responses:
    schemaSecurityValidation:
      description: Successful Response
      content:
        application/json:
          schema:
            type: object
            properties:
              warnings:
                type: array
                description: 'Information about each issue discovered in the analysis. Each object includes the violation''s severity and category, the location of the issue, data paths, and other information. This returns an empty object if there are no issues present in the schema.


                  If there are issues, this returns the `possibleFixUrl` response in each warning object. This provides a link to documentation you can use to resolve the warning.

                  '
                items:
                  type: object
                  additionalProperties: true
          examples:
            No Warnings Found:
              $ref: '#/components/examples/schemaSecurityValidationNoWarnings'
            Successful Response with Governance Warnings:
              $ref: '#/components/examples/schemaSecurityValidationGovernanceWarnings'
            Successful Response with Security Warnings:
              $ref: '#/components/examples/schemaSecurityValidationSecurityWarnings'
    common500ErrorServerError:
      description: Internal Server Error
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: object
                properties:
                  name:
                    type: string
                    description: The error name.
                    example: serverError
                  message:
                    type: string
                    description: The error message.
                    example: An error has occurred on the server.
          example:
            error:
              name: serverError
              message: An error has occurred on the server.
    featureUnavailable403Error:
      description: Feature Unavailable
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/featureUnavailable403Error'
          example:
            value:
              type: https://api.postman.com/problems/forbidden
              title: Forbidden
              detail: This feature isn't available in your region.
              status: 403
    common401Error:
      description: Unauthorized
      content:
        application/problem+json:
          schema:
            type: object
            properties:
              type:
                type: string
                format: uri-reference
                description: The [URI reference](https://www.rfc-editor.org/rfc/rfc3986) that identifies the type of problem.
                example: https://api.postman.com/problems/unauthorized
              title:
                type: string
                description: A short summary of the problem.
                example: Unauthorized
              detail:
                type: string
                description: Information about the error.
                example: Unauthorized
              status:
                type: integer
                format: http-status-code
                description: The error's HTTP status code.
                example: 401
          example:
            type: https://api.postman.com/problems/unauthorized
            title: Unauthorized
            detail: Unauthorized
            status: 401
    schemaSecurityValidation400Error:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/schemaSecurityValidation400Error'
          examples:
            Invalid Schema:
              $ref: '#/components/examples/schemaSecurityValidation400Error'
  examples:
    schemaSecurityValidationGovernanceWarnings:
      value:
        warnings:
        - slug: OPENAPI_SPECTRAL_6_RULE_1027
          severity: WARN
          message: A schema property should have a $ref property referencing a reusable schema
          location:
            start:
              line: 55
              column: 26
            end:
              line: 58
              column: 17
          dataPath:
          - components
          - parameters
          - userId
          - schema
          possibleFixUrl: https://go.pstmn.io/openapi3-security-warnings#a-schema-property-should-reference-a-reusable-schema
          category:
            name: governance
            slug: governance
          vulnerability:
            name: A schema property should have a $ref property.
            slug: OPENAPI_SPECTRAL_6_schema_reference_reusable
          type: governance
          checksum: 2fc9df0e8ccbcdb610ab1694651bb68731fc5add4ebb44da0e5f15faf634b035
    schemaSecurityValidation400Error:
      value:
        error:
          name:
            name: Invalid Schema
            reason: Provided schema type is not supported.
    schemaSecurityValidationNoWarnings:
      value:
        warnings: []
    schemaSecurityValidationRequest:
      value:
        schema:
          type: openapi3
          language: json
          schema: '{"openapi":"3.0.0","info":{"version":"1","title":"temp","license":{"name":"MIT"}},"servers":[{"url":"https://petstore.swagger.io/v1"}],"paths":{"/user":{"get":{"summary":"Details about a user","operationId":"listUser","tags":["user"],"parameters":[{"name":"id","in":"query","description":"ID of the user","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"Details about a user","headers":{"x-next":{"description":"A link to the next page of responses","schema":{"type":"string"}}},"content":{"application/json":{"schema":{$ref:"#/components/schemas/User"}}}},"default":{"description":"unexpected error","content":{"application/json":{"schema":{$ref:"#/components/schemas/Error"}}}}}}}},"components":{"schemas":{"User":{"type":"object","required":["id","name"],"properties":{"id":{"type":"integer","format":"int64"},"name":{"type":"string"},"tag":{"type":"string"}}},"Error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer","format":"int32"},"message":{"type":"string"}}}},"securitySchemes":{"BasicAuth":{"type":"http","scheme":"basic"}}},"security":[{"BasicAuth":[]}]}'
    schemaSecurityValidationSecurityWarnings:
      value:
        warnings:
        - slug: POSTMAN_OWASP_GOVERNANCE_RULE_0005
          severity: WARN
          message: Security field is not defined
          location:
            start:
              line: 1
              column: 0
            end:
              line: 75
              column: 21
          dataPath: []
          possibleFixUrl: https://go.pstmn.io/openapi3-security-warnings#security-field-is-not-defined
          category:
            name: governance
            slug: governance
          vulnerability:
            name: Security field is not defined
            slug: POSTMAN_OWASP_GOVERNANCE_VULNERABILITY_0005
          type: governance
          checksum: ff10236473b8bc137ecdb94c282de9375503772beffffd02eb7aa957e1a3e873
        - slug: POSTMAN_OWASP_GOVERNANCE_RULE_0017
          severity: WARN
          message: Operation does not enforce any security scheme.
          location:
            start:
              line: 16
              column: 8
            end:
              line: 36
              column: 50
          dataPath:
          - paths
          - /spacecrafts/{spacecraftId}
          - get
          possibleFixUrl: https://go.pstmn.io/openapi3-security-warnings#operation-does-not-enforce-any-security-scheme
          category:
            name: governance
            slug: governance
          vulnerability:
            name: Operation does not enforce any security scheme.
            slug: POSTMAN_OWASP_GOVERNANCE_VULNERABILITY_0017
          type: governance
          checksum: 7760d7354c85b925141d708e14ecaef6512ef20a5b89ba8c722d1fc16c1e5b02
  requestBodies:
    schemaSecurityValidation:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/schemaSecurityValidationRequest'
          examples:
            Request Body:
              $ref: '#/components/examples/schemaSecurityValidationRequest'
  securitySchemes:
    hmac:
      type: apiKey
      name: Authorization
      in: header
      description: Amazon Signature authorization v4
      x-amazon-apigateway-authtype: awsSigv4
externalDocs:
  description: Amazon Web Services documentation
  url: https://docs.aws.amazon.com/apigateway/
x-hasEquivalentPaths: true