How do you test that API docs endpoints are off before deploying?

Start the app with its production configuration in CI, request the default documentation paths, and fail the build if any returns a 200 response. A ten line script catches the configuration drift that reopens Swagger UI, ReDoc or the OpenAPI JSON after a refactor.

Why a test and not a config review

Docs switches live in different places per framework: a constructor argument in FastAPI, properties in Spring, setup options in NestJS. A new profile, a copied settings file or a renamed environment variable can flip them back on. A test against the running app checks the outcome rather than the intent, which is what an outside scanner sees.

Paths to check

If you changed paths, for example with openapi_url or jsonDocumentUrl, list your custom ones too.

A simple script

#!/usr/bin/env bash
set -u
BASE="${1:-http://localhost:8080}"
fail=0
for p in /docs /redoc /openapi.json /v3/api-docs /v3/api-docs.yaml /swagger-ui.html /api /api-json /api-yaml; do
  code=$(curl -s -o /dev/null -w "%{http_code}" "$BASE$p")
  if [ "$code" = "200" ]; then
    echo "EXPOSED: $p returned $code"
    fail=1
  fi
done
exit $fail

Treat 301 and 302 with care. A redirect to a login page is fine. A redirect to the docs page is not, so follow redirects if your stack uses them and compare the final body.

Steps

1. Add a CI job that builds the image or starts the app with the production profile and dummy secrets.
2. Wait for the health check to pass before testing.
3. Run the script against it.
4. Fail the job on any exposed path and print the path.
5. For intentionally public docs, replace the check with an assertion that matches your decision, for example that the docs require a login.
6. Keep the list of paths in one file so a teammate adding a framework updates it in one place.

What this does not prove

It checks default and known paths only. It does not find docs mounted at an unusual path, and it says nothing about whether your routes enforce authorization. Pair it with an authenticated scan of staging and with route level tests. The per framework comparison lists the default surfaces, and what an API scanner needs before the first run covers feeding a scanner a spec when the docs are off.

OWASP recommends automated checks that continuously assess configuration effectiveness across environments, which is the same idea in small form.

Try it yourself

Click through it at your own pace, or open it full screen. Look at how a failing check blocks a merge.

Safeguard's policies and gates can block merges on findings from your dependency scans, and a free scan is available.

Quick check

Sources

• FastAPI: metadata and docs URLs
• springdoc-openapi
• NestJS: OpenAPI introduction
• OWASP API8:2023 Security Misconfiguration

Last reviewed: 19 October 2026.