# IndieOpenAPI > Validate one OpenAPI document for structural errors, broken references, incomplete operations, and authentication gaps. Paste, drop, or link one OpenAPI document. See what breaks and where to fix it. The canonical page is https://indieopenapi.com/. ## Use the tool Open [IndieOpenAPI](https://indieopenapi.com/) to complete the job. The questions below describe the supported input, result, and limits. Every answer names its source next to it. Source: [OpenAPI Specification](https://spec.openapis.org/oas/). ## Questions and limits ### What is an OpenAPI document? An OpenAPI document is a JSON or YAML file that describes an HTTP API: its paths, the operations on each path, their parameters, request bodies, responses, the schemas those carry, and how a caller authenticates. Tools read it to generate documentation, client libraries, and mock servers. The format began as Swagger 2.0 and is now the [OpenAPI Specification](https://spec.openapis.org/oas/), at versions 3.0, 3.1, and 3.2. IndieOpenAPI checks all four. ### What does an OpenAPI validator check? IndieOpenAPI runs six checks. Structure compares the document with the OpenAPI schema for its version. References resolves every `$ref`, inside the document and in external files. Operations checks that each `operationId` is unique, that every `{parameter}` in a path template is declared, and that each operation has a summary or description. Responses looks for at least one response and a `2xx` or `default` entry. Examples compares each example value with its schema. Security checks that every requirement names a declared scheme and that every operation states its authentication intent. ### What is the difference between an error and a warning in the result? An error is something the specification forbids or something a tool cannot resolve: a schema violation, a broken `$ref`, a duplicate `operationId`, a path parameter that does not exist, an example that breaks its schema, or a security requirement with no scheme behind it. One error fails the document. A warning is a gap a valid document can still have: an operation with no description, no `operationId`, no success response, or no declared authentication. Warnings leave the verdict at valid with warnings. ### How do I fix a broken $ref? An internal reference such as `#/components/schemas/User` is a JSON Pointer, so every segment must exist with that exact spelling and case. A slash inside a key is written `~1` and a tilde `~0`. The finding gives the document path of the failing `$ref`, so open that spot and compare it with the component list. A reference to another file is only followed when you enter the root document's public URL, up to eight external documents per check. Pasted and dropped files stay in your browser, so their external references are reported as not loaded. Bundle the files into one document to check them offline. ### Why does the check say an operation has no authentication? An operation with no `security` entry of its own and none at the document root leaves its authentication undefined, and readers and generators guess. Declare your schemes under `components.securitySchemes` (`securityDefinitions` in 2.0), then apply them with a root `security` list that every operation inherits, or per operation. When an endpoint is public on purpose, say so with `security: []` on that operation; the check reads that as explicit and stops warning. ### Does a valid OpenAPI document mean my API works? No. The check validates the description and never calls the API, so it cannot tell whether a server answers, whether the real responses match the documented schemas, or whether the authentication behaves as described. Example values are compared with their schemas in OpenAPI 3.0 documents only; examples in 2.0, 3.1, and 3.2 documents are reported as not checked, which never counts as a pass. A document may be at most 512 KB. ## Promises - The core is free: no account, no card, no premium plan, no upgrade nag, no hidden paywall. - Private lookup activity is never published. - Analytics is currently off. Private lookup activity is never published or sent to a tracker. No lookup history becomes public inventory. ## More - [Notes](https://indieopenapi.com/blog.md): posts by the maker, newest first - [More tools](https://indieopenapi.com/tools.md): the other tools by turushan - [security.txt](https://indieopenapi.com/.well-known/security.txt): how to report a vulnerability Made by turushan, https://twitter.com/turushan.