Turn your OpenAPI spec into a Web Application Firewall that only allows valid API calls.
OAShield (pronounced like "away shield", /əˈweɪ ʃild/) generates Web Application Firewall (WAF) rules directly from your OpenAPI specification. The generated rules act as a positive security model: they permit exactly the requests your API defines and deny everything else.
It produces standard SecLang rules for both OWASP ModSecurity v3 (libmodsecurity) and Coraza, selectable with a single option.
Traditional WAFs rely on pattern matching — a blocklist that tries to recognize known-bad requests. That leaves a gap: anything the patterns haven't seen gets through.
OAShield flips the model. Instead of guessing what's malicious, it uses your OpenAPI spec as the definition of what's valid:
- Deny by default. If your spec doesn't define a
POST /orders, the rules reject everyPOST /ordersrequest — no signature required. - Enforce your contract. Undeclared endpoints, methods, parameters, and request-body fields are blocked. Type and range constraints from the schema are checked.
- Deploy anywhere SecLang runs. Ship the rules alongside your API or in a sidecar for an extra layer that mirrors your API surface exactly.
Your OpenAPI spec is already the source of truth for your API. OAShield makes it the source of truth for your perimeter too. Curious what the rules look like? See How It Works.
# 1. Get the CLI (or download from Releases)
git clone https://github.com/cognitivegears/oashield.git
cd oashield
mvn package -P build-cli-jar
# 2. Generate rules from your spec
java -cp target/oashield-cli.jar org.openapitools.codegen.OpenAPIGenerator \
generate -g modsecurity3 \
-i samples/petstore.yaml \
-o output/
# 3. Deploy the generated .conf files to your ModSecurity or Coraza setupFull walkthrough: Getting Started.
| Guide | What's inside |
|---|---|
| Getting Started | Install, generate rules, and deploy them |
| How It Works | What the generated rules do, block by block |
| Configuration | Options, engine flavors, and validation limitations |
| Integration Testing | Running the test suite against real WAF engines |
Sample OpenAPI specs live in samples/, with pre-generated rules in
samples/output/petstore/ so you can see what
OAShield produces before running it yourself.
Issues and pull requests are welcome. Please run mvn test before submitting;
see Integration Testing for the full suite.
Licensed under the Apache License 2.0. See LICENSE.md.