httpbin.org (self-served Swagger 2.0): spec vs live

Summary

Spec: https://httpbin.org/spec.json (Swagger 2.0, converted to OpenAPI 3 before checking)
Base URL: https://httpbin.org
Run: 2026-10-30, read-only GET requests, no credentials
Coverage: 78 operations in the spec, 20 requests sent, 18 successful,20 operations observed
Hard violations: 0 distinct schema locations
Reviewer note: Confirmed: GET /cookies/set and /cookies/delete respond 302, documented as 200 only. Earlier input mistakes fixed.

3xx and 4xx statuses the spec does not mention, usually auth or not-found cases.

Show 2 findings

GET /cookies/delete > response 302

status 302 is not documented for "GET /cookies/delete"

GET /cookies/delete?freeform=a → 302 text/html; charset=utf-8

expected ["200"] actual 302

If the spec is the source of truth: Return one of the documented statuses (200) from GET /cookies/delete.
If the implementation is the source of truth: Add a "302" response under paths["/cookies/delete"].get.responses.

GET /cookies/set > response 302

status 302 is not documented for "GET /cookies/set"

GET /cookies/set?freeform=a → 302 text/html; charset=utf-8

expected ["200"] actual 302

If the spec is the source of truth: Return one of the documented statuses (200) from GET /cookies/set.
If the implementation is the source of truth: Add a "302" response under paths["/cookies/set"].get.responses.

Findings JSON: every finding on this page with its classification and fixes.
Observations JSON: every request sent and the status it received.
Reproduce with apidrifter run; the target definition is in tools/survey/targets.json in the repository.

If a finding is wrong, open an issue; if it is right, a pull request on the spec is welcome.