Security Schema definition in the spec is not clear.

[guptasu]

Reading security field in Swagger object, I interpret it as there is a logical OR between the security requirement objects.
Then reading security requirement object, I interpret it as, it is an object with multiple fields (which reference to schemas defined security schema definition) and there is a logical AND between them.
Is my understanding right ?

For example:

                "security": [
                    {
                        "petstore_auth": [
                            "write_pets",
                            "read_pets"
                        ],
                        "api_key" : []
                    },
                    {
                        "petstore_advance_auth": [
                            "write_pets",
                            "read_pets"
                        ]
                    }
                ]

would mean required authentication for the operation is either
(petstore_advance_auth) OR (petstore_auth AND api_key)

Is my understanding correct, if so an example for that in the spec would be really helpful.

If I am not right, then what is the recommended way to specify if an operation needs 2 auth and both are required, else its treated as unauthorized.

[webron]

Your understanding is correct.

[handrews]

Answered more than 6 years ago with no further comment. Closing.