Description
In OpenAPI 3.0, a missing or empty top-level servers array defaults to a server with URL /. This is valid, but the root of the host serving the document must be the intended API address.
Potential impact
If that default differs from the deployed API, documentation tools or generated clients may request the wrong location. Omitting servers does not mean that a deployed server is absent or public.
Remediation
Check whether the default URL / is intended. If another server is needed, specify its actual URL in the servers array and also review path-level or operation-level overrides.
Examples
The examples compare the default server address with an explicit one. Both configurations are permitted by OpenAPI.
Before
{
"openapi": "3.0.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"operationId": "listVersionsv2",
"summary": "List API versions",
"responses": {
"200": {
"description": "200 response",
"content": {
"application/json": {
"examples": {
"foo": {
"value": {
"versions": [
{
"status": "CURRENT",
"updated": "2011-01-21T11:33:21Z",
"id": "v2.0",
"links": [
{
"href": "http://127.0.0.1:8774/v2/",
"rel": "self"
}
]
}
]
}
}
}
}
}
}
}
}
}
}
}
After
{
"openapi": "3.0.0",
"info": {
"title": "Simple API Overview",
"version": "1.0.0"
},
"paths": {
"/": {
"get": {
"operationId": "listVersionsv2",
"summary": "List API versions",
"responses": {
"200": {
"description": "200 response",
"content": {
"application/json": {
"examples": {
"foo": {
"value": {
"versions": [
{
"status": "CURRENT",
"updated": "2011-01-21T11:33:21Z",
"id": "v2.0",
"links": [
{
"href": "http://127.0.0.1:8774/v2/",
"rel": "self"
}
]
}
]
}
}
}
}
}
}
}
}
}
},
"servers": [
{
"url": "https://my.api.server.com/",
"description": "My API Server"
}
]
}
The first document uses the default URL /. The second specifies https://my.api.server.com/, so confirm that the API is actually served at that address.