Using the OpenAPI Specification

In Chapter 1, What Is API Security?, I described the various benefits of the design-first approach to API development: code generation, mock servers, data validation, documentation, and, of course, security (think of it as security-as-code for APIs).

We will now take a deeper look at the security constructs that can be leveraged within the OpenAPI definition of an API. There are two main categories: data definitions and security specifications.

API-first versus design-first versus code-first

In this chapter, we will make heavy use of these three terms and, given that they have a fairly specific and implicit meaning in the world of API design, I would like to disambiguate them for readers who may not have this context:

API-first: This is a business objective in which the product is built around APIs (which are invariably published) in the first instance and, from there, the user interface and so on is developed. This contrasts with the more...