FastAPI serves Swagger UI, ReDoc and the OpenAPI JSON by default. Spring Boot serves them only after you add springdoc. NestJS serves them only after you call SwaggerModule.setup. Rails API mode generates nothing on its own. Each has different off switches, and scanners probe for all of these paths.
Comparison table
| Framework | Docs by default? | Typical paths | How to turn off |
|---|---|---|---|
| FastAPI | Yes | /docs, /redoc, /openapi.json | openapi_url=None, or docs_url and redoc_url set to None |
| Spring Boot with springdoc | Only if the library is added | /v3/api-docs, /v3/api-docs.yaml, /swagger-ui.html | springdoc.api-docs.enabled=false and springdoc.swagger-ui.enabled=false |
| NestJS with @nestjs/swagger | Only if you call setup | Mount path, plus api-json and api-yaml for a mount path of api | ui false and raw false |
| Rails API mode | No | None in the base framework | Nothing to switch off unless you add a gem |
The paths and options come from each project's documentation, linked below. springdoc and @nestjs/swagger are separate packages, so whether they exist in your project depends on your dependency list.
Why defaults matter
A scanner or an attacker does not need to guess what you built. Common paths are tried first. If a framework serves docs by default, any app built on it with no extra care exposes them. The OWASP security misconfiguration page lists unnecessary enabled features and exposed endpoints among common causes of API weakness, and its prevention advice includes repeatable hardening and automated checks across environments.
Steps to find out what your app serves
- Check your dependency manifest for springdoc, @nestjs/swagger and any Rails documentation gem.
- Search code for FastAPI( with its arguments, for SwaggerModule.setup, and for springdoc properties.
- Request the default paths in the table against staging and production from outside.
- Record the result next to each service in your API inventory. The OWASP inventory guidance suggests documenting hosts, environment, network access and version.
- For each exposed doc, decide to keep, protect or remove. The production decision guide walks through it.
- Put the switch in environment specific configuration and test it in CI.
How to read the table honestly
The table describes defaults from project documentation, not your deployment. A team may have changed paths, added authentication in front of the docs, or wrapped them behind a gateway. Always test your own app from outside before concluding anything. The point of the table is to tell you which paths to try first and which switch to look for in code review.
Per framework write ups
Try it yourself
Click through it at your own pace, or open it full screen. Look for documentation libraries in the inventory.
Safeguard's SBOM and dependency scanning lists packages like springdoc and @nestjs/swagger, and a free scan is available.
Quick check
Which framework here exposes docs without any extra package?
FastAPI. The others need a library or explicit setup.
Does a custom path make docs private?
No. Renaming only avoids the laziest guesses. Use authentication or disable the docs.
Sources
- FastAPI: metadata and docs URLs
- springdoc-openapi
- NestJS: OpenAPI introduction
- Using Rails for API-only applications
- OWASP API8:2023 Security Misconfiguration
- OWASP API9:2023 Improper Inventory Management
Last reviewed: 19 October 2026.
