The OpenAPI servers field lists the hosts a client should call. If it is missing or empty, the specification says the default is a single server with a url of a slash, meaning relative to wherever the file was loaded. Generated files often carry localhost or a production URL, so check it before every scan.
What the specification says
The OpenAPI Specification describes the servers field as the target hosts for the API, and states that when it is not provided, or is an empty array, the default is one server whose url is a slash. A tool that reads the file and has no other instruction may therefore send requests relative to the location of the file, or to the wrong place entirely.
How generated files get this wrong
| Source of the file | Typical servers value | Risk |
|---|---|---|
| Generated on a developer machine | A localhost address | Scanner cannot reach it, or hits a local service |
| Generated from the running production app | The production URL | A scan aimed at production by default |
| Hand written template | Placeholder host | Requests go nowhere or to a stale host |
| Behind a proxy with a path prefix | Missing prefix | Every route returns 404 |
The last row happens with frameworks behind a gateway. FastAPI's own documentation notes that tokenUrl is a relative URL so apps keep working behind a proxy, which is a hint that path prefixes matter when generating absolute URLs elsewhere.
Why this matters for safety
A scan with write requests pointed at production is the expensive mistake. Production data can change, accounts can lock and rate limits can trip. Scanning only the host you meant is a basic prerequisite, alongside permission, test accounts and a rate plan. See what an API scanner needs before its first run and scan a staging site safely.
Steps to set it right
- Open the exported description and read the servers entries.
- Replace them with the staging base URL for scanning, including any path prefix.
- Keep one entry per environment with a description, for example staging and production, so a person can tell them apart.
- Make your scanner configuration override the host explicitly, so the file cannot silently redirect it.
- Run a single harmless GET against each environment from the scanner to confirm the target.
- Record environment, audience and version for each host in your inventory, which is what OWASP recommends.
What to do when docs are disabled
If production docs are off, the export from CI is your input. Generate it with a staging base URL, or post process the file in the pipeline so servers matches the target. The spec-first or code-first comparison shows where that step fits.
Try it yourself
Click through it at your own pace, or open it full screen. Check where the target host is chosen before the scan starts.
Safeguard's SBOM and dependency scanning needs no live target, and a free scan is available.
Quick check
What happens if servers is empty?
The specification says the default is a single server with a url of a slash.
Should I scan whatever host is in the file?
No. Override the target in your scanner configuration so you control which environment is tested.
Sources
Last reviewed: 19 October 2026.
