Contract as Truth
An OpenAPI spec is a promise. Contract as truth checks whether your running API keeps it: attach a target's declared spec and API Security diffs declared vs runtime, so the spec becomes a control, not a document that drifts.
Attach a spec
On the Spec & Contract tab, attach the target's declared OpenAPI / Swagger spec (the target stores it). The engine normalises the declared operations and compares them against what it actually observes.
Drift categories
Each endpoint falls into one of four buckets:
| Category | Meaning | Why it matters |
|---|---|---|
| Documented | Declared and observed - matches the contract | The healthy case |
| Shadow | Observed at runtime but not in the spec | Undocumented surface, often unreviewed |
| Declared-untested | In the spec but never observed | Dead, unreleased, or a coverage gap |
| Auth-drift | Auth at runtime differs from the declared scheme | A promise the running API is not keeping |
Shadow and auth-drift endpoints are the ones to act on first: they are exactly where real exposure hides.
Spec-audit cold start
No spec attached yet? The spec-audit cold-start path lets you upload or point at a spec and get an immediate security review of it - missing auth, weak schemes, over-broad scopes, verbose errors - and a mapping to the OWASP API Security Top 10. It is the on-ramp to full contract-as-truth once a target is wired up.
Spec-vs-runtime drift panel
The Spec & Contract tab surfaces drift as a first-class panel, not a footnote: the four categories above with counts and the endpoints in each, so you can close the gap between the contract and the running service.
Related
- Code to Runtime - the provenance labels drift builds on.
- Discovery & runtime correlation - find the shadow endpoints in the first place.