Security

x-scopes

`x-scopes` appears on operations. Its value is a list. Used by 54 providers across 66 OpenAPI documents. Observed values include `read:policy`. Consistent with security — this is inferred from where the key appears and what it carries, not from any published definition.

Security derived description

How this description was produced. It is assembled from what was measured in the corpus — where this key appears in a document, what shape its value takes, the values observed, and how many providers use it. It is not taken from a published definition, because for most extensions none exists. Read it as evidence, not as a specification. If you own this extension and want it described properly, tell us.

893 occurrences

66 documents

54 providers

purpose-named

Where it appears

Location in the document	Occurrences
operation	882
securityScheme	10
root	1

What its value looks like

Value shape	Occurrences
array	851
object	26
empty	15
string	1

Observed values

Sampled from the specifications, most frequent first.

read:policy

Providers publishing it

Showing 50 of 54.

aemo alex-bank alinta-energy amp-bank anz australian-military-bank auswide-bank bank-first bank-of-queensland bank-of-sydney bank-of-us banksa bankwest bcu-bank bendigo-and-adelaide-bank beyond-bank constellation-space defence-bank energy-queensland energyaustralia gateway-bank gc-mutual-bank great-southern-bank greater-bank hsbc-australia hume-bank imb-bank impact impact-radius ing-australia judo-bank macquarie-bank makeup-land meow mystate-bank national-australia-bank newcastle-permanent nylas people-first-bank pn-bank police-bank qudos-bank rabobank-australia racq-bank red-energy regional-australia-bank simply-energy sumup suncorp-bank teachers-mutual-bank

Why this is not in OpenAPI

Extensions exist because a provider needed something the specification would not carry. Most of what they hold is not the API contract at all — it is operational metadata about the contract: documentation, lifecycle, policy, provenance, and now agents. That metadata is usually better placed alongside the contract, in an Overlay or an APIs.json index, than crammed inside it. See everything else doing the security job.