Schema-first
Required fields, composition, enums, examples, and nested models.
Runs in your browser No sign-up OpenAPI 3.2 ready
Open OpenAPI or Swagger JSON and YAML, search endpoints and models,
follow $ref relationships, and spot structural issues —
privately in this browser tab.
Local by default. Pasted text and files never go to our server.
The built-in sample is loaded so you can inspect the product before
choosing a file. Descriptions render as inert text; external
$ref targets are never fetched automatically.
Required fields, composition, enums, examples, and nested models.
Jump through internal refs, see backlinks, broken targets, and cycles.
Filter endpoints, operation IDs, tags, models, and property names.
Copy cURL skeletons without sending API requests or storing credentials.
Three steps, no setup
Use a local file for confidential contracts, paste a snippet while debugging, or fetch a public document directly from its host.
Choose JSON or YAML, drag a file onto the workspace, paste text, enter a CORS-enabled HTTPS URL, or keep the sample.
Search paths, methods, summaries, tags, operation IDs, models, property names, formats, and descriptions.
Open requests and responses, jump through reusable schemas, copy pointers and examples, then review diagnostics.
One document, two questions
Documentation renderers emphasize endpoints. Generic JSON viewers emphasize raw structure. This viewer keeps paths and schemas linked so you can move from an operation to its model and back.
Inspect path and webhook operations, parameters, request bodies, responses, media types, security requirements, servers, deprecation, and operation IDs.
Read objects, arrays, required properties, nullable unions,
formats, constraints, examples, enums, additional properties, and
allOf, oneOf, or anyOf.
Visualize reusable-model dependencies, open internal references, find who points back to a model, and identify unresolved or cyclic links without dereferencing forever.
Copy a JSON Pointer, schema JSON, generated example, endpoint path, or ready-to-edit cURL skeleton. Download normalized JSON when another tool needs it.
Version-honest viewing
Version detection changes where the viewer looks for reusable models, request bodies, servers, and security definitions. New or unknown 3.x fields remain visible instead of causing blanket rejection.
components.schemas
Reads JSON Schema-aligned types, webhooks, composition, and modern request bodies.
components.schemas
Reads paths, servers, content media types, callbacks, security, and reusable components.
definitions
Reads host/basePath, body parameters, response schemas, and security definitions.
Specification reference: OpenAPI Specification 3.2.0. Reading shared structures is not the same as proving every version-specific rule.
Know where the bytes go
“Secure” is vague. The input mode determines the network behavior, so the viewer states it before you commit a document.
The source is read with browser APIs and kept in this tab's memory. It is not posted to this site.
Your browser contacts the source host directly without our proxy, credentials, or referrer. The host must allow CORS.
Small documents can be compressed into the URL fragment. The server does not receive fragments, but anyone with the full link can read the source.
External $ref targets are listed as diagnostics and
are never fetched behind your back.
Choose the right tool
Choose a dedicated editor for autocomplete, code actions, refactoring, bundling, and continuous design feedback.
Choose a version-specific validator or linter in CI for complete rules, organization policies, and reproducible build failures.
Practical answers
No. Pasted text and local files are parsed in the current browser tab. Loading a URL makes a direct request from your browser to that source host; it does not pass through our server.
The viewer reads Swagger 2.0 and OpenAPI 3.x documents, including OpenAPI 3.2, in JSON or YAML. It renders stable shared structures and keeps unknown fields visible, but does not promise full conformance validation.
No. Internal references such as
#/components/schemas/Book can be followed inside the
document. External file or URL references are reported and never
fetched automatically.
Browsers require the source host to allow cross-origin requests with CORS, and an HTTPS page cannot fetch an insecure HTTP document. Download the file and open it locally when the host does not allow browser access.
For documents up to 200 KB, “Share locally” can compress the source into the URL fragment. Fragments are not sent in HTTP requests. Still treat the full URL as confidential because recipients, chat systems, browser history, and screenshots can expose it.
No. The diagnostics cover syntax, missing core fields, broken internal refs, cycles, duplicate operation IDs, and path parameter mismatches. Use a dedicated version-specific validator or linter in CI for complete conformance.
The viewer intentionally stays read-only. It generates a cURL skeleton that you can review and edit, but it does not collect credentials or send requests that might change real data.
Local, pasted, and URL-loaded documents are limited to 5 MB to keep the browser responsive. Share links use a smaller 200 KB pre-compression limit because extremely long URLs are unreliable.