PRC101 — Anonymous caller reached an operation that requires authentication

What it catches

procyon test calls every operation that is not marked x-procyon-public with no credentials at all. If the spec requires authentication for it and the running API answers with a 2xx, the operation is reachable by anyone. An operation the spec itself leaves open is not this rule's business: it is PRC001's, when you lint.

401, 403, 404 and every other non-2xx status pass. Public operations are not called. An operation whose path needs a value (/notes/{id}) is called with one of test account A's IDs; one Procyon cannot fill is listed under Notes, never silently passed.

The finding's evidence is the request Procyon sent and the start of the response.

Why it matters

PRC001 (lint) checks that the spec declares authentication. PRC101 checks that the server enforces it. A missing middleware, a route registered before the auth filter, or a debug flag left on gives anonymous callers what only signed-in users should get, and the spec never shows it.

How to fix it

Make the server answer 401 to requests without valid credentials on this operation, before it does any work. Check the order in which your framework applies authentication to routes. If the operation is meant to be open, mark it in the spec:

/status:
  get:
    x-procyon-public: "Status page, returns no user data"

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the operation, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

/reports:
  get:
    x-procyon-ignore:
      - rule: PRC101
        reason: "Public until the auth migration"
        expires: 2027-01-31

Examples

Reported: the spec requires a bearer token on GET /notes, and

GET /notes            (no Authorization header)
200 [{"id":"1","owner":"alice",...}]

Not reported: the same request answered 401, or GET /health marked x-procyon-public.