oasdiff/oasdiff: OpenAPI Diff and Breaking Changes · GitHub

Command-line tool to compare and detect breaking changes in OpenAPI specs.

Run it locally, in CI via the GitHub Action, or use the hosted PR review workflow at oasdiff.com to approve or reject each change with a CI commit status.

No install needed — try it with Docker against two sample specs:

docker run --rm -t tufin/oasdiff changelog \
  https://raw.githubusercontent.com/oasdiff/oasdiff/main/data/openapi-test1.yaml \
  https://raw.githubusercontent.com/oasdiff/oasdiff/main/data/openapi-test5.yaml

That prints a human-readable changelog of the changes that can affect API consumers, breaking and non-breaking. Swap changelog for breaking to see only the changes that break existing API clients, or diff for the full machine-readable diff of the API definition, including documentation-only edits.

go install github.com/oasdiff/oasdiff@latest

brew install oasdiff

The install.sh script downloads the latest oasdiff binary into /usr/local/bin:

curl -fsSL https://raw.githubusercontent.com/oasdiff/oasdiff/main/install.sh | sh

To pin a specific version, set the version env var:

curl -fsSL https://raw.githubusercontent.com/oasdiff/oasdiff/main/install.sh | version=1.11.7 sh

https://github.com/oasdiff/asdf-oasdiff

Pre-built binaries for macOS, Linux, and Windows (both x86_64 and arm64) are on the releases page.

Grouped by what you're trying to do. New to oasdiff? Start with Commands.

The top-level subcommands.

• diff — full diff of the API definition, including documentation-only edits (output: html, json, markdown, markup, text, or yaml — default yaml)
• summary — high-level count of changes between two specs (built on the diff engine; same shared options)
• breaking — only the changes that break existing API clients
• changelog — changes that can affect API consumers, breaking or not, in human-readable form
• flatten — replace allOf schemas with a merged equivalent
• upgrade — canonicalize an OpenAPI 3.0 spec to the latest 3.x
• validate — check a single spec for per-RFC violations (invalid types, missing required fields, bad regex, unresolved $refs)
• checks changelog — list the rules breaking and changelog use to classify changes (customize them)
• checks validate — list the rules validate reports
• schema — print a JSON Schema for the breaking/changelog json output
• git-diff-driver — run as a git external diff driver so git log --patch renders an OpenAPI changelog inline

Where specs come from.

• Git revisions — compare against a branch, tag, or commit
• Local files, http/s URLs, YAML or JSON — all handled transparently

How oasdiff pairs up base and revision and what counts as a difference.

• Endpoint matching — handles renamed path parameters and duplicate endpoints
• Nullability changes — the three equivalent nullable forms and when changing them is breaking
• Compare APIs split across multiple files — e.g. an API gateway with one spec per service
• Filter endpoints — narrow the diff to a subset of endpoints

Align each spec before diffing so equivalent things line up.

• Merge allOf schemas
• Merge common (path-level) parameters
• Path prefix modification — strip or add a prefix so a moved API still matches
• Case-insensitive header comparison — treat Content-Type and content-type as the same header

Communicate intent across versions.

• Deprecate APIs and parameters
• API stability levels (draft / alpha / beta / stable)
• Version bumps — report a breaking change released without a major version bump

Choose which kinds of differences are reported.

• Exclude certain kinds of changes — e.g. ignore description-only edits
• Track OpenAPI extensions — opt in to reporting changes in x-* fields
• Exclude specific extension names — when extensions are tracked, skip ones you don't care about

Shape and enrich the report.

• Customize HTML and Markdown changelog templates
• Add OpenAPI-extension attributes to changelog entries
• Source location tracking
• Change fingerprints — stable IDs across commits
• Error reporting
• Localization: en, ru, pt-br, es

• Docker
• Configuration file
• Embed in a Go program
• GitHub Action for CI — and oasdiff.com for teams, which adds a per-change PR comment with approve/reject and commit-status checks
• MCP server — call oasdiff from an AI assistant (Claude, Cursor, ...) via the hosted server at https://api.oasdiff.com/mcp

• OpenAPI 3.1 and 3.2 support — what's supported
• Security: control external $ref loading to prevent SSRF
• Usage examples — recipes for common scenarios
• Contributing

This project relies on the excellent implementation of OpenAPI 3.0 and 3.1 for Go: kin-openapi.

We welcome your feedback.
If you have ideas for improvement or additional needs around APIs, please let us know.