A generated API client is source code that a tool writes from an API description such as an OpenAPI file. Once it is in your repository, it is your code to ship and maintain, even though a tool wrote it. Responsibility is shared among the API owner, the tool maintainers and you.
Definitions
OpenAPI document. A machine readable description of an HTTP API: its paths, operations, parameters, schemas and security schemes. The generator reads versions 2.0 and 3.x and normalises them into the same internal model, according to the docs.
Generator. The program that reads the document and writes code. OpenAPI Generator is an open source example.
Template. A text file with placeholders. The generator fills it with data from the spec. Built in templates use Mustache.
Client or SDK. The generated code your application calls to reach the API. SDK is the usual word when you publish it for others.
Server stub. Generated skeleton code for the server side of an API.
The parts and who owns them
| Part | Written by | Security responsibility |
|---|---|---|
| The API description | API team | Accuracy, correct servers and security schemes |
| The generator and built in templates | Open source maintainers | Fixing flaws in the tool and templates |
| Library choices in generated build files | The generator, via templates | You inherit them and must scan and update them |
| Your overrides and config | Your team | Review, versioning, removal when stale |
| The final client in your repository | You | Everything: scanning, patching, release |
The last row is the one people forget. A tool wrote the code, but you ship it, and a customer will not distinguish between hand written and generated lines when something goes wrong.
What can go wrong
- A spec error becomes a client error. If the spec lists the wrong server address or drops a security scheme, the client follows it.
- Dependencies chosen by templates age. See dependency risk in generated clients.
- Tool changes alter output. Pin the version, as in how to pin the version in CI.
- Overrides and ignore file entries go stale.
What good ownership looks like
- Name an owner for each generated client, usually the team that depends on it most.
- Keep the spec, config and generator version in version control.
- Regenerate on a schedule and review diffs.
- Scan the generated project's dependencies like the rest of your code.
- Decide how vulnerabilities in the client are reported and fixed. If you publish an SDK, include a security contact.
Where Safeguard fits
Safeguard builds an inventory of the libraries in your repositories through SBOM and dependency scanning, which includes the libraries a generated client declares. Asset discovery helps find clients nobody has listed. The free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how each finding gets an owner and a status.
Quick check
Is generated code covered by my security scans?
Only if it is in the scanned repository or scanned after generation. Check that your scans include it.
Who fixes a flaw in a built in template?
The open source maintainers fix the tool. You still have to upgrade and regenerate to receive the fix.
Sources
Last reviewed: 19 October 2026.
