Which OpenAPI specifications declare no authentication and require it?

Documents whose security field is empty and whose API refuses an anonymous request with 401 on 2026-09-10. An agent trusting the document plans a call that cannot work.

28 records across 3 subjects, observed 2026-09-10. Every one carries a check you can run in a single request.

All subjects · the whole registry, machine-readable

Asking about something not listed here, before you use it — one request, no key: GET https://apidefects.com/check?tool=<identity>. never_examined is an answer too, and it is not a clean bill of health.

This is not a list of good APIs or bad ones. It is a list of observations, each dated and each disprovable in one request. Absence from it means an operation was not examined, not that it is fine.