OpenAPI Overlays for Compliance and Redaction Profiles

Somewhere in every regulated company there is a document, or a wiki page, or a Slack message pinned to a channel, that says something like “before we publish the EU version of the API, remember to take out the SSN field and turn off the cancellation endpoint.” It is a checklist. A human reads it, or forgets to read it, and then edits the spec by hand until it looks compliant. When the auditor…