Swagger Petstore (reference demo): spec vs live

Summary

Spec: https://petstore3.swagger.io/api/v3/openapi.json (OpenAPI 3)
Base URL: https://petstore3.swagger.io/api/v3
Run: 2026-10-30, read-only GET requests, no credentials
Coverage: 19 operations in the spec, 8 requests sent, 6 successful,8 operations observed
Hard violations: 1 distinct schema locations
Reviewer note: Confirmed: GET /user/login returns a plain-text session string under application/json.

A typed client generated from the spec would break on these.

Hide 1 finding

GET /user/login > response 200 > application/json

the 200 response is documented as "application/json" but the body is not valid JSON

GET /user/login → 200 application/json

If the spec is the source of truth: Return valid JSON from GET /user/login for the 200 response.
If the implementation is the source of truth: Change the media type at paths["/user/login"].get.responses["200"].content to what is actually returned.

The first hard violation came from this request. Compare the response to the schema at the location named in the finding.

curl -s -H 'Accept: application/json' 'https://petstore3.swagger.io/api/v3/user/login'

Findings JSON: every finding on this page with its classification and fixes.
Observations JSON: every request sent and the status it received.
Reproduce with apidrifter run; the target definition is in tools/survey/targets.json in the repository.

If a finding is wrong, open an issue; if it is right, a pull request on the spec is welcome.