For an API that is not meant to be public documentation, yes: turn them off or put them behind authentication. FastAPI serves Swagger UI at /docs, ReDoc at /redoc and the schema at /openapi.json by default, and you can disable each with docs_url=None, redoc_url=None and openapi_url=None.
What is exposed by default
FastAPI's metadata docs describe two documentation interfaces: Swagger UI served at /docs and ReDoc served at /redoc. The OpenAPI schema is served at /openapi.json. All three are on unless you change them.
The schema lists every path, method, parameter and model. For a public API that is the point. For an internal or partner API it is a free inventory for anyone who finds the host: endpoint names, expected fields and which routes look administrative.
How to turn them off
from fastapi import FastAPI
app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
FastAPI's docs note that setting openapi_url to None disables the schema completely and also disables the documentation interfaces that use it. So that one setting is enough if you want everything gone. Setting docs_url and redoc_url alone leaves the raw schema available.
You can also move them rather than remove them, for example docs_url at a less guessable path, but that is obscurity, not protection.
Make it environment aware
A common approach is to keep docs in development and staging and disable them in production:
import os
from fastapi import FastAPI
prod = os.environ.get("APP_ENV") == "production"
app = FastAPI(
docs_url=None if prod else "/docs",
redoc_url=None if prod else "/redoc",
openapi_url=None if prod else "/openapi.json",
)
If your clients generate SDKs from the schema, publish the schema file through your build pipeline instead of serving it live.
What disabling docs does not do
Hiding documentation does not secure an endpoint. Every route still exists and still answers. Attackers can find paths through guessing, client code or traffic. So treat this as one layer:
| Control | Purpose |
|---|---|
| Disable or gate docs | Reduce free reconnaissance |
| Authentication on every route | Stop unauthorized calls |
| Authorization checks per object | Stop one user reading another's data |
| Response models | Stop internal fields leaking |
| Rate limits and input limits | Reduce abuse |
If you want docs in production but only for staff, put the docs routes behind your gateway or an authentication dependency rather than leaving them open.
How to check
- Request /docs, /redoc and /openapi.json on each production hostname.
- Check every environment that is reachable from the internet, including preview and staging.
- Compare the schema against what you intend to expose. Unexpected routes are a finding by themselves.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an API scan enumerates endpoints and flags what should not be reachable.
Quick check
Does openapi_url=None remove Swagger UI too?
Yes. FastAPI's docs say it disables the schema completely and the documentation interfaces that depend on it.
Is hiding /docs enough to protect an API?
No. It only removes a convenience for finding routes. Authentication and authorization on the routes themselves are what protect data.
Safeguard's API security scanning and asset discovery can help find API surfaces you did not know were exposed. Try a free scan.
Sources
Last reviewed: 19 October 2026.
