Your API spec is already a security policy.

OAShield turns your OpenAPI specification into WAF rules that permit exactly the requests your API defines, and deny everything else. Free, open source, and deployable on ModSecurity or Coraza.

Get Started Why OAShield? View on GitHub

One spec. One command. A positive security model.

A traditional WAF is a blocklist. It tries to recognize known-bad requests, and anything it hasn’t seen before gets through. OAShield flips that around: your OpenAPI spec defines what’s valid, and the generated rules deny everything else by default.

java -cp oashield-cli.jar org.openapitools.codegen.OpenAPIGenerator \
  generate -g modsecurity3 -i your-api.yaml -o rules/

The output is standard SecLang. Deploy it to OWASP ModSecurity v3 or Coraza alongside your API, in a sidecar, or at your edge.

What the generated rules enforce

Deny by default

Endpoints, methods, and parameters not declared in your spec are rejected. As far as an attacker can tell, undocumented and “shadow” API surfaces don’t exist. Fails closed, not open.

Full parameter validation

Path, query, and form parameters are checked against your schema: types, formats, enums, patterns, numeric bounds, lengths, and cardinality. Undeclared parameters are blocked.

Request-body validation

JSON bodies are validated field by field: required properties, types, bounds, and an allowlist that rejects undeclared fields. On Coraza, the raw body is also validated against a generated JSON Schema.

Two engines, one option

Target ModSecurity v3 (libmodsecurity) or Coraza with a single flag. Most rules are identical across both, and OAShield handles the engine-specific differences for you.

Configurable blocking

Deny with any status code, drop, redirect, or run in detection-only mode that logs contract violations without blocking anything. Handy for rolling out safely.

Built for CI/CD

Regenerate rules on every release so your WAF always matches your API. No drift, no manual rule writing. Pairs well with the OWASP Core Rule Set for defense in depth.

Explore the docs

Why OAShield?

The case for spec-driven WAF rules, and where they fit in your stack. Read why →

Quick Start

Generate and deploy your first rule set in minutes. Get started →

How It Works

Walk through the generated rules, block by block. Read the walkthrough →

Use Cases

Legacy apps, shadow APIs, virtual patching, and more. See the use cases →

Positive Security Models

Why allowlists beat blocklists for APIs, in depth. Learn the model →