Openapi-specification: Multiple security requirements at once, or neither

[jacobweber]

Say you have two types of authorization: oauth2 and apiKey. But when using apiKey authorization, you require two headers to be present. So you need to specify something like (A OR (B AND C)) in your security requirements. Is this possible?

The comments in #14 make reference to this, but I don't see a way to do it. This is needed, for example, if you want to support 3Scale's "Application Identifier and Key pairs" and "OAuth 2.0" patterns at the same time.

[webron]

Yup, you can do that. Say you have 3 security requirements defined A for oauth2, B for apiKey 1, C for apiKey 2 (it's a header, let's face it), then your security would be defined as:

security: [
  { "A": [] },
  { "B": [], "C": [] }
]

Didn't add scopes for oauth2, but that's the general idea.

[jacobweber]

Thanks, that's very helpful.