---
title: "httpbin.org (self-served Swagger 2.0): spec vs live"
date: 2026-10-30
canonical: https://apidrifter.com/research/public-api-spec-drift-2026-11/httpbin/
part_of: https://apidrifter.com/research/public-api-spec-drift-2026-11/
---

# httpbin.org (self-served Swagger 2.0): spec vs live

Part of [We checked 13 public APIs against their own OpenAPI specs. 9 had hard mismatches.](https://apidrifter.com/research/public-api-spec-drift-2026-11/).

## Summary

- Spec: https://httpbin.org/spec.json (Swagger 2.0, converted to OpenAPI 3 before checking)
- Base URL: `https://httpbin.org`
- Run: 2026-10-30, read-only GET requests, no credentials
- Coverage: 78 operations in the spec, 20 requests sent, 18 successful, 20 operations observed
- Hard violations: 0 distinct schema locations
- Reviewer note: Confirmed: GET /cookies/set and /cookies/delete respond 302, documented as 200 only. Earlier input mistakes fixed.

## Undocumented error responses (2)

3xx and 4xx statuses the spec does not mention, usually auth or not-found cases.

- `undocumented-status` (errors, breaking) at `GET /cookies/delete > response 302`
  - status 302 is not documented for "GET /cookies/delete"
  - Request: `GET /cookies/delete?freeform=a -> 302 text/html; charset=utf-8`
  - Expected: `["200"]`
  - Actual: `302`
  - If the spec is the source of truth: Return one of the documented statuses (200) from GET /cookies/delete.
  - If the implementation is the source of truth: Add a "302" response under paths["/cookies/delete"].get.responses.
- `undocumented-status` (errors, breaking) at `GET /cookies/set > response 302`
  - status 302 is not documented for "GET /cookies/set"
  - Request: `GET /cookies/set?freeform=a -> 302 text/html; charset=utf-8`
  - Expected: `["200"]`
  - Actual: `302`
  - If the spec is the source of truth: Return one of the documented statuses (200) from GET /cookies/set.
  - If the implementation is the source of truth: Add a "302" response under paths["/cookies/set"].get.responses.

## Data

- Findings: https://github.com/apidrifter/apidrifter/tree/main/tools/survey/results/httpbin.findings.json
- Requests sent: https://github.com/apidrifter/apidrifter/tree/main/tools/survey/results/httpbin.observations.json
- Tool: https://apidrifter.com/docs/cli/ (reproduce with apidrifter run; target definition in tools/survey/targets.json)