An API schema is a structured description of an application programming interface. It defines available endpoints, expected inputs, data types, authentication requirements, and the shape of responses. Common schema formats include OpenAPI and similar specifications used by development and security tools.
In cyber security, schemas matter because they help testers and scanners understand how an API is supposed to behave. A schema-aware DAST tool can explore routes more accurately than a generic crawler, generate valid requests, and cover hidden or parameterized functions. This improves detection of issues such as broken authentication, injection, excessive data exposure, and authorization flaws. Attackers may also use schema information to map an API faster and find weakly protected methods. Defenders use schemas in testing pipelines, access reviews, and contract validation to spot drift between documented and live behavior.