Paste or open an OpenAPI 3.0, 3.1 or Swagger 2.0 document to check it against the specification's structure: required fields, value types, unknown properties, $ref targets, path parameters, operationIds and security references. Every problem links to its line, and you can download a fully dereferenced copy.
Last updated:
Load:
Validation result
Loading…
Click a problem to jump to its line. Dereferenced downloads inline every internal $ref (recursive references are kept as $ref). Your spec is validated in your browser and never uploaded.
Advertisement
Advertisement
How to use the OpenAPI Validator
Paste your spec into the editor, open a .yaml or .json file, or load a sample.
Read the summary: a green check means no errors; otherwise the count of errors, warnings and notices is shown.
Click a problem to jump to the line in the editor, fix it, and watch the list update as you type.
Filter by errors, warnings or notices to focus on what blocks code generation first.
Export a text report, or download a dereferenced JSON/YAML copy with every internal $ref inlined.
Most common OpenAPI validation errors and how to fix them
Message
Typical cause
Fix
missing the required property "description" (response)
Responses written as 200: {content: …}
Add description: to every response; it may be a short phrase.
does not declare the path parameter
Path /users/{id} without a matching parameter
Add name: id, in: path, required: true with a schema, at path or operation level.
Path parameter must have required: true
required omitted (it defaults to false)
Path parameters are always required: set required: true.
Broken reference
Typo or wrong section in $ref
Use the suggested name; 3.x uses #/components/schemas/X, 2.0 uses #/definitions/X.
must be a string, found number
Unquoted version: 1.0 or openapi: 3.0
Quote the value: "1.0", or use a full version like 3.0.3.
Unknown property / Unknown schema keyword
Typos (maxLenght), 3.1 keywords in 3.0, or custom fields
Fix the spelling or prefix custom fields with x-.
Duplicate operationId
Copy-pasted operations
Give each operation a unique camelCase ID; code generators turn it into a method name.
Security scheme is not defined
Name in security differs from securitySchemes
Use exactly the key defined under components.securitySchemes.
OpenAPI 3.0 vs 3.1 vs Swagger 2.0: rules that differ
Topic
Swagger 2.0
OpenAPI 3.0
OpenAPI 3.1
Version field
swagger: "2.0"
openapi: 3.0.x
openapi: 3.1.x
Reusable schemas
definitions
components/schemas
components/schemas
Request body
in: body / formData parameters
requestBody
requestBody
Null values
not supported (x-nullable)
nullable: true
type: [string, "null"]
paths
required
required
optional if components or webhooks exist
Siblings next to $ref
ignored
ignored
allowed in schemas; summary/description elsewhere
Examples in schemas
example
example
examples (array) preferred
exclusiveMinimum
boolean
boolean
number
Want to browse the documentation once the spec is valid? Open it in the OpenAPI Viewer, or edit it with a live preview in the OpenAPI Editor.
Frequently asked questions
What is the difference between errors, warnings and notices?
Errors break the specification: tools such as code generators, Swagger UI or API gateways may reject the file or behave unpredictably. Warnings are valid but almost certainly mistakes, like a required property that is not defined. Notices are clean-up hints, such as unused components or tags missing from the top-level list.
Which OpenAPI versions are supported?
OpenAPI 3.0.x, OpenAPI 3.1.x and Swagger 2.0 (OpenAPI 2.0). The version field decides which rules apply: for example nullable and boolean exclusiveMinimum are 3.0 features, while type: [string, 'null'], const and boolean schemas are 3.1 only.
Why is "version: 1.0" reported as an error?
In YAML an unquoted 1.0 is a number, but info.version must be a string. Write version: "1.0" or 1.0.0. The same applies to openapi: 3.0, which must be the quoted full version such as 3.0.3, and to response codes like 200, which should be quoted keys.
Does it resolve external $ref files?
No. References inside the document (#/components/…) are resolved and checked. References to other files or URLs are listed as notices because the browser cannot read your other files; bundle them first or paste a single-file spec.
What does 'Download dereferenced' do?
It replaces every internal $ref with a copy of the object it points to, producing a self-contained document that some tools require. References that point back into themselves (recursive schemas) cannot be inlined and are kept as $ref.
Is this the same as validating against the official JSON Schema?
It checks the same structural rules as the official OpenAPI JSON Schemas (required fields, types, allowed properties and patterns) and adds semantic checks the schemas cannot express, such as path parameters matching the template, unique operationIds and resolvable $refs. Error messages point to the exact line instead of a schema path.
Is my API specification uploaded anywhere?
No. Parsing and validation run entirely in your browser. Only the open-source js-yaml parser is loaded from a CDN to read YAML; your spec never leaves your device.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.