Deterministic OpenAPI OAuth scope drift auditing.
ScopeMap turns an OpenAPI document into a reviewable route-to-scope matrix and detects authorization drift before deployment. It identifies sensitive operations without security requirements, operations that require undeclared OAuth scopes, and scopes that are declared but never used.
OpenAPI describes security schemes and operation-level requirements, but a valid document can still contain authorization drift: a newly added administrative route can become public, a scope can be referenced without being defined, or a permission can remain declared after every operation stops using it. Broad API security products provide valuable coverage and scoring. ScopeMap is intentionally narrower: a local, deterministic, dependency-light policy gate focused on scope semantics and route ownership.
python -m pip install .
scopemap --format markdown openapi.yaml
scopemap --format json --sensitive-prefix /admin openapi.yaml
scopemap --format sarif openapi.yaml > scope-results.sarifA clean audit exits 0; findings exit 1; malformed or oversized documents exit 2.
| Code | Severity | Meaning |
|---|---|---|
| SM001 | high | Sensitive operation has no security requirement |
| SM002 | high | Operation references an undeclared OAuth scope |
| SM003 | low | Declared OAuth scope is unused by any operation |
The analyzer uses safe YAML loading, a 10 MiB input bound, stable ordering, and SHA-256 fingerprints. It never calls a network service, resolves a token, executes an API, or claims that a missing specification proves a runtime authorization vulnerability.
OpenAPI YAML/JSON -> bounded safe loader -> normalized operations
-> OAuth scope inventory
-> deterministic findings
-> Markdown / JSON / SARIF-style output
pytest -q
ruff check .
python -m build --wheel --sdistThe MVP supports OpenAPI 3 security schemes with authorizationCode and clientCredentials flows. Future adapters may add OAS 2, policy files, operation tags, role matrices, and framework-specific route extraction.
Apache-2.0. See LICENSE.