# Fix: An OpenAPI description is published

> Web-audit fix skill for the `openapi` check (MCP & API, MUST).

## Goal

Publish an OpenAPI description so non-MCP agents can call your HTTP API.

## Fix

If your service exposes an HTTP/REST API (separate from any MCP endpoint), publish an OpenAPI
3.1 description of it at `/openapi.json` (or `/openapi.yaml`, or `/.well-known/openapi.json`).
Non-MCP agents use it to discover endpoints, parameters, and response shapes, and to generate
typed clients. A service whose only machine surface is MCP has no REST API to describe here.

## Resources

- [OpenAPI 3.1](https://spec.openapis.org/oas/latest.html)

## Copy-paste prompt

Paste this into your coding agent, replacing the Issue line with the Result line from [your audit](https://anc.dev/web-audit):

```text
Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API
Issue: <the audit's finding for this check>
Fix: If your service exposes an HTTP/REST API (separate from any MCP endpoint), publish an OpenAPI 3.1 description of it at `/openapi.json` (or `/openapi.yaml`, or `/.well-known/openapi.json`). Non-MCP agents use it to discover endpoints, parameters, and response shapes, and to generate typed clients. A service whose only machine surface is MCP has no REST API to describe here.
Skill: https://anc.dev/web-audit/skill/openapi
Docs: https://spec.openapis.org/oas/latest.html
```

## Verify

Re-run the audit at [https://anc.dev/web-audit](https://anc.dev/web-audit) or call the `audit_website` MCP tool; the `openapi` check should report `pass`.