# Should I expose Swagger / OpenAPI docs on my backend?

It depends on one question: **is this hosted endpoint itself a public product surface, or is it internal plumbing?**

Frameworks like FastAPI serve interactive docs out of the box - Swagger UI at `/docs`, ReDoc at `/redoc`, and the raw schema at `/openapi.json`. For a public, deliberately-open API, that is a **feature**. For an **internal or admin backend** (a logging control plane, a database proxy, a file-admin service) it is **free reconnaissance**: it hands anyone the full list of your endpoints, their parameters, and your admin and destructive paths, in a clean clickable UI, before they have tried anything. The endpoints still have their own auth, so this is information disclosure rather than a breach - but there is no upside to publishing the map of your internal surface.

**The trap worth checking for.** Many apps hide the visible `/docs` and `/redoc` pages and leave `/openapi.json` open. **That JSON is the actual schema.** Hiding the UI while leaving the schema open is not hiding anything. In FastAPI it is three arguments - `docs_url=None`, `redoc_url=None`, `openapi_url=None` - and the most common miss is the third. Verify all three return 404, not just the Swagger page.

**Judge by the hosted endpoint, not by the code.** Not by whether the endpoint names look harmless, and not by whether the project is open source. A backend can have its code published for others to self-host while its own hosted instance stays internal - in that case the schema for self-hosters already lives in the public repo, so hiding it on your live endpoint costs nothing.

Severity is INFO (recon, not a breach), so this is hardening rather than an emergency - but for an internal backend it is the cleanest recon an attacker gets for free. Full item: [https://www.tigzig.com/security/backend](https://www.tigzig.com/security/backend).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/should-i-expose-swagger-docs-on-my-backend
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms