Inspect an OpenAPI document

Read an OpenAPI 3.0, 3.1 or Swagger 2.0 document and report its structure: title, servers, paths and methods, schemas, tags and a bounded reference audit that n…

OpenAPIinspectText

Questions people ask

Which specification versions are supported?: Swagger 2.0 and OpenAPI 3.0 and 3.1 are supported, read only. Anything else is refused by name: the message repeats the version the document declares, so a 2.1 claim or a missing version field is immediately visible instead of producing a half inspection.
What happens to external references?: They are counted and named, and that is all. A $ref pointing at another file or an http:// URL is never fetched, never contacted; the audit stays strictly local to the bytes you gave. Unresolved local references are counted too, with the first few named by where they sit in the document.
What does the reference audit check locally?: Every #/ reference is walked against the document root like a JSON pointer, so a local reference that points at a missing path is counted as unresolved and named. The walk itself is depth-capped and cycle-safe, so an aliased or pathological document cannot make the audit run away.
Does an unresolved reference mean my document is broken?: It means this tool could not walk that pointer inside the document, and the report names it precisely. It does not mean the document is invalid overall; external tooling may resolve what this local audit cannot. There is no conformance claim here, deliberately.
What do I get as output?: Two artifacts: a readable report.txt with the structure laid out in sections, and report.json with the same numbers in machine-readable form for pipelines and checklists.
What happens to my files?: The upload is removed as soon as processing finishes; the reports stay downloadable for about 10 minutes, then they are deleted automatically.

About this tool

An inspector that keeps its promise narrow and says it out loud: the reports count and name the structure the tool walked, including a reference audit that separates document-local references from external ones, and the never-fetched boundary is stated in the report, the result note and the copy rather than implied. Technical details: JSON documents are read with the JSON parser when the bytes look like JSON, YAML documents with a safe loader; the version check accepts Swagger 2.0 and OpenAPI 3.0 and 3.1 prefixes and refuses anything else by name. The $ref audit is a cycle-safe walk with a 64 level depth cap and a node cap, so aliased or pathological documents cannot extend it; local references are resolved against the document root with JSON pointer rules, and every walk is bounded. Path and method counts cover the eight standard HTTP methods, and operationId duplicates are counted with the first few named. Honest limits: no conformance validation, no schema validation, no rendering of endpoints, and no fetching, ever. A document nesting deeper than 128 levels is refused rather than walked. Counts say how much was walked; where a walk bailed out early, the report keeps the boundary visible instead of guessing.

File limits

Exactly 1 file per job
Each at most 2 MiB
Result at most 10 MiB

Supported formats

Text JSON

Capabilities

OpenAPIinspect

Privacy & processing

Your file is processed in an isolated job on Tooley's own infrastructure. No third-party services are involved and nothing is stored beyond the result window.

Uploads are removed as soon as processing finishes. Results stay available for about 10 minutes, then they are deleted automatically.