DOCS · RULES
The 16 rules.
What Procyon checks your spec and your running API against. Each page says what the rule catches, why it matters, how to fix it, and what it cannot see.
procyon lint
Checks the spec itself: no network, in a second.
- PRC001highOperation has no authentication
- PRC002highSecurity requirement names an undefined scheme
- PRC003mediumWeak authentication scheme
- PRC004highServer URL does not use TLS
- PRC005highResponse returns a secret
- PRC006highPersonal data returned without authentication
- PRC007highObject addressed by ID without authentication
- PRC008lowUnbounded input or output
- PRC009mediumClient can write a privileged field
- PRC010mediumAdmin operation uses only the default security
- PRC011mediumOAuth2 flow is deprecated
procyon test
Calls a disposable running copy of the API as two test accounts and anonymously.