Bearer authentication is not supported by OAuth2Rule.

[tkrop]

Rule https://opensource.zalando.com/restful-api-guidelines/#104 does not match exactly the title: MUST secure endpoints with OAuth 2.0. In the text we propose Bearer Authentication, which is not classified as OAuth 2.0 but as HTTP Authentication according to OpenAPI (see https://swagger.io/docs/specification/authentication/bearer-authentication/):components:

  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

Consequently, The Zally rule implementation is currently rejecting the security schema, since it is not of the required type (see https://github.com/zalando/zally/blob/master/server/zally-ruleset-zalando/src/main/kotlin/org/zalando/zally/ruleset/zalando/SecureWithOAuth2Rule.kt#L23).