API Security in CI/CD
Gate the security-relevant API change, not just the syntax.
CI already knows when an OpenAPI file changed. A stronger gate asks whether that change added capability, relaxed documented authorization, introduced new sensitive data, or reduced the quality of the security evidence.
Baseline → candidate
Compare the approved contract with the proposed one.
A static scan of one file is useful, but change control becomes more actionable when the pipeline can show what is new. Treat the main-branch contract as the baseline and the pull-request contract as the candidate.
openapi-main.yamlopenapi-pr.yamlUseful gate signals
Focus the review on material expansion or regression.
New capability
A newly documented operation gives an application or agent another action it may be able to request.
Authorization relaxation
A sensitive operation moves toward optional authentication, broader permissions, or weaker declared controls.
New sensitive surface
A request or response begins exposing data or inputs that deserve additional runtime controls.
Fail closed
Incomplete comparison should not become an automatic PASS.
Unresolved references, invalid structures, unsupported surfaces, or other diagnostics can make part of the comparison non-evaluable. Preserve that uncertainty and route the change to review instead of silently treating missing evidence as safe.
This is why structured result semantics matter: PASS, FAIL, REVIEW, NOT_EVALUATED, and coverage communicate different facts.
Agent integrations
Capability drift is an agent-security change.
If an AI agent consumes operations from the API contract, a pull request that adds POST /refunds or relaxes authorization can expand the agent’s potential blast radius even when application code still compiles and the OpenAPI remains valid.