Scan at scaleSites with an invalid OpenAPI contract
Sites with an invalid OpenAPI contract
A site-wide report: one row per host, over the openapi rows the crawl emitted.
What this report returns
An OpenAPI contract describes a site's API in a form agents can turn directly into tool calls.
These sites serve a contract that trips that tooling: not a 3.x version, operations missing the operationId agents use to name tools, duplicate operationIds, or request/response bodies with no typed schema.
The Conformance Issue Detected column says whether the contract actually breaks the specification, and on most of these rows it is false: only a reused operationId violates OpenAPI 3.2 ( requires uniqueness), while a missing operationId or an untyped body is conformant but leaves agents guessing, so it is a Lumar readiness recommendation.
A version outside 3.x makes no conformance claim either way, because this single flag cannot tell a conformant OAS 2.0 document apart from a malformed or nonexistent version.
How to fix it. Publish OpenAPI 3.x with a unique operationId on every operation and a real JSON Schema on every body; the flagged columns show which rule each contract breaks. (An unresolved $ref is informational: that part of the contract wasn't assessed.)
The columns it shows
Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.
- Host
host - OpenAPI Valid
openApiValid - OpenAPI Conformance Issue Detected
openApiConformanceIssueDetected - OpenAPI Findings
openApiFindings - OpenAPI Declared Version
openApiDeclaredVersion - OpenAPI Operation Count
openApiOperationCount - OpenAPI Duplicate operationId Samples
openApiDuplicateOperationIdSamples - OpenAPI Invalid Document
openApiInvalidDocument - OpenAPI Invalid Version
openApiInvalidVersion - OpenAPI Missing operationId
openApiMissingOperationId - OpenAPI Duplicate operationId
openApiDuplicateOperationId - OpenAPI Unresolved Reference
openApiUnresolvedReference - OpenAPI Untyped Schema
openApiUntypedSchema
About OpenAPI description
A machine-readable contract for the site's API.
Read how OpenAPI description is checked, including the specification it is validated against and a worked correct and broken example.
Running it
This report ships in the Lumar agent-readiness container and appears on any project it is linked to, on every crawl. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.