PRC002 — Security requirement names an undefined scheme

What it catches

A security requirement, on the whole spec or on an operation, that names a scheme not defined under components.securitySchemes. Usually a typo (apikey instead of apiKey) or a scheme deleted while operations still use it.

Strict OpenAPI validators reject such a spec outright. Procyon reports it as a finding instead, pointing at the security field and naming the scheme, because what it means in practice is a security problem: the protection the spec documents does not exist.

Why it matters

Clients, SDKs and API gateways generated from the spec cannot authenticate against a scheme that is not defined. Gateways that enforce the spec may skip the check altogether. And nobody reading the spec can tell how the operation is really protected, or whether it is.

How to fix it

Define the scheme, or correct the name to match one that is defined:

security:
  - apiKey: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the operation, or the spec's root when the finding is about the default security, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

x-procyon-ignore:
  - rule: PRC002
    reason: "The gateway defines this scheme; it is not in this spec"

Examples

Reported (token is never defined):

security:
  - token: []

Not reported: every name in every requirement is defined.