OpenAPI 3.1 Spec Guide

OpenAPI 3.1 is the industry standard for describing REST APIs. This guide walks through every section of a production-quality spec — from info and paths to authentication, schema reuse, and automated validation in CI.

Spec Skeleton (OpenAPI 3.1)

openapi: "3.1.0"

info:
  title: Acme API
  version: "1.0.0"
  description: |
    Public REST API for Acme services.
    Rate limits: 100 req/min (standard), 1000 req/min (pro).
  contact:
    name: Acme Engineering
    email: [email protected]
  license:
    name: MIT
    identifier: MIT   # SPDX identifier (new in 3.1)

servers:
  - url: https://api.acme.example/v1
    description: Production
  - url: https://staging-api.acme.example/v1
    description: Staging

tags:
  - name: users
    description: User management
  - name: orders
    description: Order operations

paths:
  /users:
    get:
      operationId: listUsers
      tags: [users]
      summary: List all users
      parameters:
        - $ref: '#/components/parameters/LimitParam'
        - $ref: '#/components/parameters/CursorParam'
      responses:
        '200':
          description: Paginated user list
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
      security:
        - BearerAuth: []

    post:
      operationId: createUser
      tags: [users]
      summary: Create a new user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserRequest'
            example:
              email: [email protected]
              name: Jane Doe
      responses:
        '201':
          description: User created
          headers:
            Location:
              description: URL of the created user
              schema:
                type: string
                format: uri
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '422':
          $ref: '#/components/responses/ValidationError'
      security:
        - BearerAuth: []

Components: Schemas, Parameters & Responses

components:
  # --- Reusable schemas ---
  schemas:
    User:
      type: object
      required: [id, email, created_at]
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: "550e8400-e29b-41d4-a716-446655440000"
        email:
          type: string
          format: email
          example: "[email protected]"
        name:
          type: ["string", "null"]  # nullable in OAS 3.1 (not nullable: true)
          example: "Jane Doe"
        roles:
          type: array
          items:
            type: string
            enum: [admin, editor, viewer]
          default: [viewer]
        created_at:
          type: string
          format: date-time
          readOnly: true

    CreateUserRequest:
      type: object
      required: [email]
      properties:
        email:
          type: string
          format: email
        name:
          type: string
          minLength: 1
          maxLength: 100

    UserListResponse:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/User'
        meta:
          type: object
          properties:
            next_cursor:
              type: ["string", "null"]
            has_more:
              type: boolean

    ErrorResponse:
      type: object
      required: [error]
      properties:
        error:
          type: object
          required: [code, message]
          properties:
            code:
              type: string
              example: VALIDATION_FAILED
            message:
              type: string
            details:
              type: array
              items:
                type: object
                properties:
                  field:
                    type: string
                  issue:
                    type: string
            trace_id:
              type: string

  # --- Reusable parameters ---
  parameters:
    LimitParam:
      name: limit
      in: query
      description: Number of results per page (max 100)
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 20

    CursorParam:
      name: cursor
      in: query
      description: Pagination cursor from previous response
      schema:
        type: string

  # --- Reusable responses ---
  responses:
    Unauthorized:
      description: Missing or invalid authentication token
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'

    ValidationError:
      description: Request validation failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'

  # --- Security schemes ---
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://auth.acme.example/oauth/authorize
          tokenUrl: https://auth.acme.example/oauth/token
          scopes:
            read:users: Read user data
            write:users: Create and update users

Validation with Spectral (CI)

# Install Spectral CLI
npm install -g @stoplight/spectral-cli

# Lint against built-in OAS ruleset
spectral lint openapi.yaml

# Custom ruleset (.spectral.yaml)
extends: ["spectral:oas"]
rules:
  operation-tag-defined: error       # all operations must have tags
  operation-success-response: error  # must have 2xx response
  no-$ref-siblings: off              # relax for OAS 3.1
  info-contact: warn
  oas3-api-servers: error

# GitHub Actions integration
# .github/workflows/api-lint.yml
name: Lint OpenAPI Spec
on: [pull_request]
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm install -g @stoplight/spectral-cli
      - run: spectral lint openapi.yaml --fail-severity=warn

Generating Swagger UI & Redoc

// Express + swagger-ui-express
import express from 'express';
import swaggerUi from 'swagger-ui-express';
import yaml from 'js-yaml';
import fs from 'fs';

const app = express();
const spec = yaml.load(fs.readFileSync('./openapi.yaml', 'utf8'));

app.use('/docs', swaggerUi.serve, swaggerUi.setup(spec, {
  customCss: '.swagger-ui .topbar { display: none }',
  swaggerOptions: { persistAuthorization: true },
}));

// Serve raw spec for SDK generators
app.get('/openapi.json', (req, res) => res.json(spec));

# Generate static Redoc HTML (zero runtime deps)
npx @redocly/cli build-docs openapi.yaml -o docs/api.html

# Bundle multi-file spec into single file
npx @redocly/cli bundle openapi.yaml -o dist/openapi.yaml

# Generate TypeScript client SDK
npx @openapitools/openapi-generator-cli generate \
  -i openapi.yaml \
  -g typescript-fetch \
  -o src/api-client

Tooling Quick Reference