Where does Spring Boot serve OpenAPI docs, and how do you turn them off?

With springdoc, a Spring Boot app serves its OpenAPI description at /v3/api-docs and Swagger UI at /swagger-ui.html. Set springdoc.api-docs.enabled to false to remove the description, or springdoc.swagger-ui.enabled to false to remove only the interface. Scanners look for these paths first.

Definitions

springdoc is a library that generates an OpenAPI description from your Spring controllers at runtime. It is a third party package, not part of Spring Boot itself, so you only have these paths if the dependency is on the classpath.

The OpenAPI description is the JSON or YAML file. Swagger UI is the page that renders it. They are separate switches, and turning off one does not turn off the other.

Default paths and properties

The springdoc project shows toggling the interface from an environment variable, which is a sensible pattern: keep it on in development, off in production profiles.

# application-prod.properties
springdoc.api-docs.enabled=false
springdoc.swagger-ui.enabled=false

The springdoc home page does not say to disable these in production. That decision is yours, and the guidance in should Swagger UI be exposed in production can help you make it.

Steps to verify

1. Run the prod profile locally or in staging.
2. Request /v3/api-docs and /swagger-ui.html without credentials.
3. Expect a 404 or a 401, not a page.
4. Check that Spring Security rules do not accidentally permit these paths for everyone. Rules match in order and the first match wins, so a broad permitAll above a narrow rule can open more than you intended.
5. Add the check to CI so a config change cannot quietly reopen them.

Why scanners look here first

A scanner has no way to know your routes in advance, so it asks for the well known description paths before anything else. A hit gives it every route, method and parameter in one request. A miss means it falls back to crawling and guessing, which finds less. That asymmetry is why these two paths matter more than their size suggests, and why teams that switch them off should still give their own tests a copy of the description exported at build time.

Gotchas

• Setting the description off in one profile but forgetting a base properties file means the default stays on.
• Security rules and application properties are separate layers. A path can be permitted by security and still return 404 because the feature is off, or the reverse.
• If you keep docs on for partners, put them behind authentication through Spring Security instead.
• Custom paths set through springdoc configuration will not match a scanner's default guesses, but that is obscurity, not control.

Try it yourself

Click through it at your own pace, or open it full screen. Watch how discovery of documented routes feeds the later test steps.

Safeguard's SBOM and dependency scanning records springdoc and the rest of your Java dependencies, and you can try a free scan.

Quick check

Sources

• springdoc-openapi
• Spring Security: authorize HTTP requests

Last reviewed: 19 October 2026.