Description
The OpenAPI paths object describes API paths and operations. An empty paths: {} provides no path information, but OpenAPI 3.0 and 2.0 permit it for access-control reasons. Omitting the required paths field or using null is different from an empty object.
Potential impact
If paths needed by the audience are missing, API discovery and document-based integration or testing become difficult. An empty document does not mean the deployed API is disabled or inaccessible.
Remediation
Review the audience and visibility requirements, then define the actual paths, operations and responses they need in paths. Retain an intentionally empty object where appropriate. Manage server authentication and permissions independently of documentation visibility.
Examples
These OpenAPI 3.0 excerpts compare documented path visibility. The info object is omitted. The empty object in the first excerpt can be intentional document filtering.
Before
{
"openapi": "3.0.0",
"paths": {}
}
After
{
"openapi": "3.0.0",
"paths": {
"/": {
"get": {
"responses": {
"200": {
"description": "OK"
}
}
}
}
}
}
The second excerpt publishes GET / and its response. Add it only if the API supports it and it belongs in the document for this audience.