---
id: openapi-core
version: "0.23.1"
license: BSD-3-Clause
license_treatment: permissive
maintenance: active
---

# openapi-core — client-side and server-side support for the OpenAPI Specification v3

License: permissive · Maintenance: active · Downloads: 4.3M/mo

## What it is and what it does

openapi-core is a Python library that validates and unmarshals HTTP request and response data against OpenAPI v3.0, v3.1, and v3.2 specifications. It extracts and type-converts parameters, headers, cookies, and request bodies according to the schema, raising an error if the data does not conform. The library works both client-side (validating responses from external APIs) and server-side (validating incoming requests), and includes built-in integrations with Requests, Werkzeug, Django, Flask, FastAPI, Starlette, Falcon, and AIOHTTP.

The package depends on jsonschema, openapi-schema-validator, and openapi-spec-validator to perform the actual validation logic. It is actively maintained, supports modern Python versions, and carries no known security vulnerabilities. Installation is straightforward via pip with low friction.

Use it for:

- Validate incoming API requests against an OpenAPI spec in a Flask or Django view to reject malformed data early.
- Unmarshal and type-convert query parameters and path variables from a FastAPI or Starlette middleware layer.
- Verify that responses from a third-party API conform to its published OpenAPI specification before processing.
- Extract and validate security credentials (API keys, Bearer tokens, Basic auth) from requests according to the spec.
- Build an API gateway or proxy that enforces OpenAPI compliance on both inbound and outbound traffic.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Validates and unmarshals OpenAPI v3.0, v3.1, and v3.2 request and response data against a specification, with built-in support for popular frameworks like Django, Flask, FastAPI, and Starlette.

Yes. openapi-core is well-maintained, has no known vulnerabilities, and offers low install friction. It is the right choice if you need to validate or unmarshal OpenAPI v3.x data in a Python application, especially if you are already using one of its supported frameworks. The permissive BSD-3-Clause license poses no restrictions.

## Install

pip install openapi-core
uv add openapi-core
poetry add openapi-core

## Installing openapi-core

Before you install: Low install friction with a pure-Python wheel distribution. Actively maintained with a recent release and no known vulnerabilities. Supports current Python versions (3.10–3.14).

License in practice: BSD-3-Clause is permissive; you may use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions.

Quickstart:

from openapi_core import OpenAPI

openapi = OpenAPI.from_file_path('openapi.json')
result = openapi.unmarshal_request(request)
path_params = result.parameters.path
query_params = result.parameters.query
body = result.body

Requires a request object that implements the OpenAPI Request protocol; for frameworks like Django, Flask, or Starlette, use the corresponding integration adapter.

Verify before relying:

- Whether the package handles OpenAPI v2.0 (Swagger) specifications, or only v3.x versions as stated in the description.
- Performance characteristics when validating large or deeply nested OpenAPI specifications.
- Whether custom deserializers and unmarshallers are easy to implement for non-standard media types.

## Package facts

- License: BSD-3-Clause (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 4.3M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

openapi validation, openapi request response validation, openapi unmarshalling, openapi schema validation, api specification validation, openapi framework integration, openapi data unmarshalling, api-validation, openapi, schema-validation

[View on SkillFed](https://skillfed.io/packages/openapi-core) · [View on PyPI](https://pypi.org/project/openapi-core/)