Exposed API documentation means a route like /swagger.json, /openapi.json, /api-docs, or a GraphQL Playground/GraphiQL UI is publicly reachable on your live domain, handing anyone who finds it a complete, structured reference for every endpoint your API exposes: paths, parameters, request and response shapes, and often authentication requirements. These routes exist specifically to make an API easy to explore, which is exactly the problem when the audience finding them isn't your own developers.
Why this happens in AI-generated apps
API documentation generators (springdoc/OpenAPI for backend frameworks, Swagger UI, GraphQL's built-in playground) auto-mount their docs route the moment the API itself is running: there's no separate step to "turn on" the documentation, so there's also no separate step that obviously needs to be reversed for production. A generated backend that copies its local dev setup straight to a live deployment brings the docs route with it by default.
Because the docs UI is a genuinely useful tool during development, it's easy to treat it as part of the app rather than as an internal artifact that shouldn't ship to production at all.
What a public docs route hands over
A full OpenAPI/Swagger spec lists every route, every parameter and its type, every possible response shape, and frequently notes which endpoints require authentication and which don't, effectively a table of contents for probing your API, including routes that were never linked from your actual frontend and that an attacker would otherwise have no way to discover. A public GraphQL Playground goes further: it's a live, interactive console for sending real queries and mutations directly against your production API from inside the browser.
How to fix it
If the documentation isn't meant to be public, disable the docs route in production or put it behind the same authentication as the rest of your app.
- Spring/springdoc: set `springdoc.api-docs.enabled=false` and `springdoc.swagger-ui.enabled=false` for the production profile.
- Swagger UI served as static files: remove the route or require auth on it at your web server/framework level.
- GraphQL Playground / GraphiQL: most GraphQL server libraries tie the playground UI to the same flag as introspection. Disable both together for production (see the GraphQL introspection article).
- If internal teams need the docs, gate the route behind your existing login rather than leaving it open to anyone with the URL.
Frequently asked
Is it ever fine to leave API docs public?
Yes, for a genuinely public API meant to be integrated against by third parties (a documented public REST API, for example). That's a deliberate product decision, not an accident. The problem is an internal or partner-only API's docs shipping publicly by default, with no one having decided it should be reachable.
Does removing the docs route also require auth on the underlying endpoints?
No. Hiding the documentation doesn't change what the underlying endpoints do or who can call them. If those endpoints also need authentication or authorization, that's a separate fix. Removing exposed docs closes the reconnaissance surface; it doesn't close a missing auth check on the API itself.