Public API docs hand over the whole map

Generated API documentation reads your routes and publishes them: every endpoint, every parameter, every field, often with example values. It is enormously useful during development.

In production it removes all of the guesswork for anyone probing you — and it usually reveals internal and admin routes your front end never calls, which are exactly the routes least likely to have been given careful authorisation checks.

FastAPI: pass docs_url=None, redoc_url=None and openapi_url=None outside development. Express with swagger-ui-express: only mount the route when NODE_ENV is not production. Spring: springdoc.api-docs.enabled=false in the production profile.

If the team needs the docs live, put them behind authentication rather than removing them.

Request /openapi.json, /docs, /api-docs and /swagger-ui/index.html on your live site. All should 404 or ask for credentials.

Before you switch it off, read it. Any route in the specification that your front end never calls is worth checking by hand — those are the ones where an authorisation check is most often missing, because no real user ever exercised them.