Which versions does it support?

OpenAPI 3.0 and 3.1, and Swagger 2.0. The version is detected from the openapi or swagger key.

Does it resolve external $ref?

Internal references (#/components/...) are resolved and checked. References to other files or URLs are not downloaded, so they are not validated.

Yes, both YAML and JSON specs work, and the Convert tab turns one into the other.

No. Internal APIs stay internal: the analysis runs in your browser.

Can I see the API as a diagram?

Yes. The Diagram tab draws the endpoints grouped by path and the models they use.

Free · no sign-up · in your browser

OpenAPI validator

Paste your OpenAPI or Swagger spec and check it before generating clients or publishing the docs: structure, references and consistency between paths and parameters.

OpenAPI

YAML

Loading editor…

Paste a file on the left to validate it.

CREA.MBA

Ship your next product faster with AI-ready Next.js

The boilerplate designed for AI to understand your project. Use code YAMLTOOLS for 5% off!

Start Building

What YAMLTools checks in your OpenAPI file

The document against the official OpenAPI 3.x schema (and Swagger 2.0).
$ref pointing to components that do not exist, for example a misspelled schema name.
Path parameters like {id} that are not declared in parameters, or declared and unused.
Duplicated operationId values, which break code generators.
Operations without a success response, tags that are not declared and schemas nobody uses.

Risks it flags

Operations without any security requirement when the API declares one.
API keys sent in the query string.
Servers declared over plain http://.
Inputs without limits (strings and arrays without maxLength or maxItems).
Objects that accept any extra property, and the deprecated OAuth2 implicit flow.

Common OpenAPI errors

The ones that break a deploy most often, and how YAMLTools reports them.

Broken $ref

$ref: "#/components/schemas/Prodcut"

Generators and documentation fail on that endpoint. YAMLTools marks the reference that does not resolve.

Undeclared path parameter

/products/{id}:
  get:
    # no parameters: id

Every {placeholder} in the path needs a parameter with in: path and required: true.

Duplicated operationId

operationId: getProduct   # used twice

Two methods with the same name in the generated SDK. The report lists both operations.

Your file stays on your computer

Validation, risk analysis, diagram and conversions run in your browser. Nothing is uploaded unless you decide to save it with an account.