NestJS Swagger: which option hides the UI and which hides the JSON?

In NestJS, setting ui to false in SwaggerModule.setup hides the Swagger UI page but leaves the JSON and YAML definitions reachable. Setting raw to false removes the definitions. To hide everything, use raw false, which the NestJS docs say disables both the UI and the definitions.

The trap

Many teams switch off the interface and assume the job is done. The NestJS documentation states that ui and raw are independent options. If you set only ui to false, a scanner or an attacker can still read the full description from the raw path.

With a mount path of api, the defaults are:

You can move the JSON location with jsonDocumentUrl.

Options compared

SwaggerModule.setup('api', app, document, {
  ui: false,
  raw: false,
});

The older swaggerUiEnabled option is deprecated in favor of ui, so check your code for it on upgrade.

Steps

1. Find every SwaggerModule.setup call. Large apps sometimes register more than one.
2. Gate the options with an environment check so production passes raw false.
3. Deploy and request /api, /api-json and /api-yaml from outside.
4. Expect failures on all three.
5. Add a test to your pipeline that asserts those paths do not return 200.
6. If you need the spec for tooling, generate it at build time and store the file, instead of serving it from the running app.

How to confirm which option you used

Open the browser, request the mount path and then request the JSON path separately. The two answers tell you which of the independent options you set. A page that loads on the first and a file that downloads on the second means both are on. A blank on the first and a file on the second means only ui is off, which is the common half fix.

Related details worth knowing

The package that powers this, @nestjs/swagger, is a dependency like any other. It should appear in your software inventory and be kept current. Also, the NestJS note on content security policy means turning the UI on over plain HTTP outside local development may need CSP changes, another reason to leave it off in production.

For the bigger decision of whether public docs make sense for you, read should Swagger UI be exposed in production.

Try it yourself

Click through it at your own pace, or open it full screen. See how a scan treats each documented route.

Safeguard's SBOM and dependency scanning covers npm packages such as @nestjs/swagger, and a free scan is available.

Quick check

Sources

• NestJS: OpenAPI introduction

Last reviewed: 19 October 2026.