openapi-core

What it is and what it does

openapi-core is a Python library that validates and unmarshals HTTP request and response data against OpenAPI v3.0, v3.1, and v3.2 specifications. It extracts and type-converts parameters, headers, cookies, and request bodies according to the schema, raising an error if the data does not conform. The library works both client-side (validating responses from external APIs) and server-side (validating incoming requests), and includes built-in integrations with Requests, Werkzeug, Django, Flask, FastAPI, Starlette, Falcon, and AIOHTTP.

The package depends on jsonschema, openapi-schema-validator, and openapi-spec-validator to perform the actual validation logic. It is actively maintained, supports modern Python versions, and carries no known security vulnerabilities. Installation is straightforward via pip with low friction.

Use it for:

• Validate incoming API requests against an OpenAPI spec in a Flask or Django view to reject malformed data early.
• Unmarshal and type-convert query parameters and path variables from a FastAPI or Starlette middleware layer.
• Verify that responses from a third-party API conform to its published OpenAPI specification before processing.
• Extract and validate security credentials (API keys, Bearer tokens, Basic auth) from requests according to the spec.
• Build an API gateway or proxy that enforces OpenAPI compliance on both inbound and outbound traffic.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates and unmarshals OpenAPI v3.0, v3.1, and v3.2 request and response data against a specification, with built-in support for popular frameworks like Django, Flask, FastAPI, and Starlette.

Yes. openapi-core is well-maintained, has no known vulnerabilities, and offers low install friction. It is the right choice if you need to validate or unmarshal OpenAPI v3.x data in a Python application, especially if you are already using one of its supported frameworks. The permissive BSD-3-Clause license poses no restrictions.

Install

openapi-core on PyPI

pip install openapi-core

uv add openapi-core

poetry add openapi-core

Installing openapi-core

Before you install

Low install friction with a pure-Python wheel distribution. Actively maintained with a recent release and no known vulnerabilities. Supports current Python versions (3.10–3.14).

License in practice

BSD-3-Clause is permissive; you may use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions.

Quickstart

from openapi_core import OpenAPI

openapi = OpenAPI.from_file_path('openapi.json')
result = openapi.unmarshal_request(request)
path_params = result.parameters.path
query_params = result.parameters.query
body = result.body

Requires a request object that implements the OpenAPI Request protocol; for frameworks like Django, Flask, or Starlette, use the corresponding integration adapter.

Verify before relying

• Whether the package handles OpenAPI v2.0 (Swagger) specifications, or only v3.x versions as stated in the description.
• Performance characteristics when validating large or deeply nested OpenAPI specifications.
• Whether custom deserializers and unmarshallers are easy to implement for non-standard media types.

Package facts

Evidence: openapi_core-0.23.1-py3-none-any.whl

Keywords: openapi, swagger, schema

Tags

More Libraries packages