Validate OpenAPI 3.1, 3.0, and Swagger 2.0 specifications online. Find YAML/JSON syntax errors, broken references, security vulnerabilities, and explore API endpoints.
Operation GET /pets does not specify security and there is no global security requirement.
Operation GET /pets/{petId} does not specify security and there is no global security requirement.
An OpenAPI (formerly Swagger) validator analyzes REST API contract specifications written in YAML or JSON against official OpenAPI Initiative standards. It performs syntax verification, structural schema parsing, broken reference ($ref) discovery, path parameter consistency checks, security scheme validation, and design linting to guarantee your API documentation and SDK generation tools function without errors.
type: ["string", "null"]), webhooks, and reusable component definitions.components.schemas, requestBody, server arrays, and granular parameter targets (path, query, header, cookie).swagger: "2.0", host, basePath, definitions, and securityDefinitions.This validator categorizes issues into clear severity levels:
info.title, info.version, or responses), invalid HTTP methods, duplicate operationId values, or mismatched path parameter variables.components.schemas or definitions./users/{userId}, an operation parameter with name: userId, in: path, and required: true must be explicitly defined.requestBody object with a content map, not as parameter objects with in: body.$ref: '#/components/schemas/User' match the exact capitalization and nesting path of the schema definition.operationId in the entire specification must be globally unique to ensure client SDK generators can create distinct method names.All parsing, AST traversal, YAML decoding, and validation runs entirely inside your web browser using web-standard JavaScript. Your API schemas, authentication keys, and proprietary endpoints are never transmitted or stored on any remote server.
Why developers and engineers prefer this tool for everyday development workflows.
Works seamlessly on all modern desktop, tablet, and mobile browsers including Chrome, Firefox, Safari, Edge on Windows, macOS, Linux, Android, and iOS.
Processes your data in real-time directly inside your browser. No queue wait times, no network round-trips, and zero latency.
Your code, tokens, passwords, and files are never transmitted to any external server or saved in logs. Everything runs locally in memory.
Supports one-click sample loading, file drag-and-drop, and pasting directly from your clipboard (Ctrl + V) for effortless workflows.
Built strictly according to official specifications (RFCs, W3C, ISO, and standard cryptographic algorithms) ensuring accurate output every time.
No registration, no accounts, no subscriptions, and no hidden daily quotas. Use this tool as many times as you need without restrictions.
Continuously maintained and improved based on developer feedback.
Optimized processing algorithms with Web Workers and native browser APIs (SubtleCrypto, Canvas 2D) for instantaneous zero-latency execution.
Added instant clipboard pasting (Ctrl + V) and drag-and-drop file support to accelerate developer productivity without manual downloads.
Redesigned responsive touch controls, flexible copy buttons, and camera preview framing for mobile and tablet browsers.
Follow these quick steps to get instant, accurate results in seconds.
Provide your API definition in YAML or JSON format into the editor workspace.
openapi: 3.1.0
info:
title: Petstore Modern API
version: 1.0.0
paths:
/pets:
get:
summary: List petsToggle strict mode, API design linting rules, and security audits.
Status: PASSED | Version: OAS 3.1 | Endpoints: 3 | Errors: 0
[ ✓ Spec Valid ] [ 3 Endpoints ] [ 0 Errors ]Inspect diagnostic issues with clickable line navigation and explore RESTful endpoints.
[ Line 19 ] Missing Path Parameter Definition: "{itemId}"
Fix: Define parameter with name: "itemId", in: "path", required: trueCommon input data types and real-world representations supported by this tool.
Modern standard with full JSON Schema 2020-12 alignment, polymorphic types, and Bearer JWT security.
openapi: 3.1.0
info:
title: Modern Microservice
version: 1.0.0
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearerStandard JSON format with requestBody payloads, 201/400 response codes, and API key authentication.
{
"openapi": "3.0.3",
"info": {
"title": "Store API",
"version": "1.0.0"
}
}Legacy Swagger specification featuring basePath, definitions, and securityDefinitions.
swagger: "2.0"
info:
title: Legacy API
version: "1.0"
basePath: /v1
definitions:
User:
type: objectAnalyze SQL queries for MySQL, PostgreSQL, and SQLite. Detect non-sargable functions, missing indexes, filesort risks, and inspect execution plans.
Scan websites for GDPR, German DSGVO / TDDDG, and French RGPD / CNIL compliance. Inspect cookies, tracking scripts, CMP banners, and policy disclosures.
Scan websites for WCAG 2.2, 2.1, and RGAA accessibility compliance. Detect missing alt text, form labels, low contrast, ARIA issues, and broken landmarks.