Your API source

Or pick files: they are read locally, nothing uploads until you run.

This paste is

Review emphasis

Context — what the API serves, its base URL, auth model, anything handled by a gateway

The review

Compare with an earlier review Baseline

Executive summary

Assumptions & open questions

Endpoint inventory

Method	Path	operationId	Role

The OpenAPI 3.1 specification

Spec self-check — free, runs in your browser

Next steps — the commands that consume this file Download openapi.yaml above first; each command assumes it sits in the working directory.

Findings

Each finding names the location, the problem, the impact and a concrete fix — with a corrected spec fragment where it helps.

Prescan coverage

Quick wins

Focus areas

Area	Why	Related findings

Summary

Result

How it works

Nothing to hand? Load the — verb-style paths, mixed parameter styles, a duplicate route, no version prefix and no auth anywhere — or the , where the correct verdict is ship-ready and the useful output is the 3.1 upgrade and what to add next.

Paste your API source — the prescan is free

No upload, no AI: the prescan reads every file in your browser and lists what it mechanically found. The endpoint inventory extracted from Express, Fastify, Koa, FastAPI, Flask, Rails, Spring and Go route declarations — or from an existing spec's paths — then the flags: verbs baked into paths, mixed parameter styles and casing, duplicate routes, missing version prefixes, mixed trailing slashes, and for pasted specs, old spec versions, missing operationIds, undocumented 4xx errors, missing security schemes, servers and descriptions. Each group explains why it matters. This part costs nothing and happens while you type.

The AI writes the spec — this is the metered part

A senior API engineer's pass: a complete OpenAPI 3.1 document — info, servers, every operation with an operationId, request and response schemas under components referenced by $ref, documented errors and security schemes — plus a ship-readiness posture with the single most important change named, the operation inventory, and prioritized findings across completeness, correctness, consistency, security, docs-quality, versioning and hygiene, each with the problem, the concrete impact, the fix and a corrected spec fragment. Every prescan flag is confirmed or explicitly set aside, and the spec documents only endpoints that are actually in your paste. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.

Export, fix, re-run

Before you download anything the spec is self-checked in your browser — every $ref resolved inside the document, operationIds present and unique, documented errors, response schemas, leftover 3.0-only keywords, and the inventory reconciled against paths. Then download openapi.yaml or openapi.json and run the copy-ready lint, client-generation and docs commands listed under the spec. Quick wins for the one-line changes, focus areas tied to specific findings for the real work, the findings as a paste-ready PR checklist or CSV, and Markdown or JSON export of the whole review. Review history is saved to your SkillSafe account, so it follows you to another device — pick any past review as a baseline and the compare panel names what you resolved, what is new and what is still open.

Derived from the @wshobson/openapi-spec-generation skill.