Authentication Security Best Practices

general > security-fields-operation-empty

Guidance

This field should not be empty. If you leave the security field of the operation empty, anyone
can use the API operation. All they need to know is the URL for the API operation and how to invoke it.

Applies to Operation

Constraint

Type: Declarative Validation