{"record":{"id":"eae1759c0c89b13f","repo":"microsoft/semantic-kernel","slug":"security-scheme-scheme-name-is-not-defined-in","errorCode":null,"errorMessage":"Security scheme '{scheme_name}' is not defined in components.","messagePattern":"Security scheme '(.+?)' is not defined in components\\.","errorType":"exception","errorClass":"PluginInitializationError","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/openapi_plugin/openapi_parser.py","lineNumber":203,"sourceCode":"            in_=security_scheme_data.get(\"in\", \"\"),\n            scheme=security_scheme_data.get(\"scheme\", \"\"),\n            bearer_format=security_scheme_data.get(\"bearerFormat\"),\n            flows=security_scheme_data.get(\"flows\"),\n            open_id_connect_url=security_scheme_data.get(\"openIdConnectUrl\", \"\"),\n        )\n\n    def _create_security_requirements(\n        self,\n        security: list[dict[str, list[str]]],\n        security_schemes: dict[str, dict],\n    ) -> list[RestApiSecurityRequirement]:\n        security_requirements: list[RestApiSecurityRequirement] = []\n\n        for requirement in security:\n            for scheme_name, scopes in requirement.items():\n                scheme_data = security_schemes.get(scheme_name)\n                if not scheme_data:\n                    raise PluginInitializationError(f\"Security scheme '{scheme_name}' is not defined in components.\")\n                scheme = self._create_rest_api_security_scheme(scheme_data)\n                security_requirements.append(RestApiSecurityRequirement({scheme: scopes}))\n\n        return security_requirements\n\n    def create_rest_api_operations(\n        self,\n        parsed_document: Any,\n        execution_settings: \"OpenAPIFunctionExecutionParameters | None\" = None,\n    ) -> dict[str, RestApiOperation]:\n        \"\"\"Create REST API operations from the parsed OpenAPI document.\n\n        Args:\n            parsed_document: The parsed OpenAPI document.\n            execution_settings: The execution settings.\n\n        Returns:\n            A dictionary of RestApiOperation instances.","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/openapi_plugin/openapi_parser.py#L185-L221","documentation":"`_create_security_requirements` looks up each security scheme referenced by a requirement in `security_schemes` (sourced from `components.securitySchemes`). If the scheme name is missing there, it raises `PluginInitializationError`. The connector will not register an operation whose security it cannot resolve.","triggerScenarios":"A `security` requirement (global or per-operation) referencing a scheme name that is not present in `components.securitySchemes`; a typo in the scheme name; schemes defined in a referenced file that was not bundled.","commonSituations":"Renaming a scheme in one place but not the other; splitting a spec into multiple files without bundling; copy-pasting a security requirement from another spec; specs where `components.securitySchemes` lives behind an unresolved `$ref`.","solutions":["Add the missing scheme to `components.securitySchemes` with the correct name.","Fix the typo so the requirement name exactly matches a defined scheme.","Bundle/dereference the spec so external `$ref`s resolve before loading.","Remove the security requirement if it is no longer relevant."],"exampleFix":"# before\nsecurity:\n  - oauth2: [read]      # raises 1493 if 'oauth2' not defined\ncomponents:\n  securitySchemes:\n    apiKey: { type: apiKey, in: header, name: X-API-KEY }\n\n# after\nsecurity:\n  - apiKey: []\ncomponents:\n  securitySchemes:\n    apiKey: { type: apiKey, in: header, name: X-API-KEY }","handlingStrategy":"validation","validationCode":"def dangling_security_refs(spec) -> list[str]:\n    defined = set((spec.get(\"components\") or {}).get(\"securitySchemes\", {}))\n    problems = []\n    # global\n    for req in spec.get(\"security\", []):\n        for name in req:\n            if name not in defined:\n                problems.append(f\"global security: '{name}'\")\n    # per-op\n    for path, methods in spec.get(\"paths\", {}).items():\n        for method, d in methods.items():\n            for req in d.get(\"security\", []):\n                for name in req:\n                    if name not in defined:\n                        problems.append(f\"{method} {path}: '{name}'\")\n    return problems\n\nproblems = dangling_security_refs(spec)\nassert not problems, problems","typeGuard":"def security_requirement_is_resolved(req, schemes) -> bool:\n    return all(name in schemes for name in req)","tryCatchPattern":"from semantic_kernel.exceptions import PluginInitializationError\n\ntry:\n    kernel.add_openapi_plugin(plugin_name=\"x\", openapi_parsed_spec=spec)\nexcept PluginInitializationError as e:\n    if \"not defined in components\" in str(e):\n        # add the missing scheme or drop the requirement, then retry\n        raise\n    raise","preventionTips":["Bundle multi-file specs so `components.securitySchemes` resolves.","Keep scheme names in sync across `security` and `securitySchemes`.","Lint specs for dangling security refs.","Review security requirements after any rename."],"tags":["openapi-plugin","security","spec-validation","semantic-kernel"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}