We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_OPENAPI_20 incorrectly flags API keys via HTTPS
**Describe the issue**

#5253 added CKV_OPENAPI_20 with the message "Ensure that API keys are not sent over cleartext", but the [check](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) does not check the API's supported schemes.

If the intent of this check is to prevent cleartext use of API keys, then if the root level [`schemes`](https://swagger.io/docs/specification/2-0/api-host-and-base-path/) key in OpenAPI 2.0 or [`servers`](https://swagger.io/docs/specification/api-host-and-base-path/) key in OpenAPI 3.0 specifies only `https` (2.0) or only `url`s which are HTTPS (3.0), this check should pass.

**Examples**

[fail2.json](https://github.com/bridgecrewio/checkov/blob/main/tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.json) and its YAML counterpart should fail, but if they specified `"schemes": ["https"]`, they should not.

Ditto for the OpenAPI 3.0 version of this example.

**Version (please complete the following information):**

2.3.312

**Additional context**

It may be that the message is wrong and you actually intend to flag all use of API keys, but if that's the case, the message should convey that. I also would argue that header API keys should not be scrutinized the same way as query parameter API keys, since the risk of leaking the API key unintentionally is higher with the latter.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/openapi/checks/resource/generic/ClearTextAPIKey.py`
Content:
```
1 from __future__ import annotations
2 
3 from typing import Any
4 from checkov.common.models.enums import CheckResult, CheckCategories
5 from checkov.common.checks.enums import BlockType
6 from checkov.common.util.consts import LINE_FIELD_NAMES
7 from checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck
8 
9 
10 class ClearTestAPIKey(BaseOpenapiCheck):
11     def __init__(self) -> None:
12         id = "CKV_OPENAPI_20"
13         name = "Ensure that API keys are not sent over cleartext"
14         categories = (CheckCategories.API_SECURITY,)
15         supported_resources = ('paths',)
16         super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,
17                          block_type=BlockType.DOCUMENT)
18 
19     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class
20         components = conf.get("components")
21         security_def = conf.get("securityDefinitions")
22         if components and isinstance(components, dict):
23             security_schemes = components.get("securitySchemes") or {}
24         elif security_def:
25             security_schemes = security_def
26         else:
27             return CheckResult.PASSED, conf
28 
29         paths = conf.get('paths')
30         if not isinstance(paths, dict):
31             return CheckResult.PASSED, security_schemes
32 
33         filtered_dict = {}
34         if isinstance(security_schemes, dict):
35             for name, scheme in security_schemes.items():
36                 if isinstance(scheme, dict) and scheme.get('type') == "apiKey":
37                     filtered_dict[name] = scheme
38 
39         if not filtered_dict:
40             return CheckResult.PASSED, security_schemes
41 
42         for key, path in paths.items():
43             if not path:
44                 continue
45             if key in LINE_FIELD_NAMES:
46                 continue
47             for value in path.values():
48                 if not isinstance(value, dict):
49                     continue
50                 operation_security = value.get('security')
51                 if operation_security and isinstance(operation_security, list):
52                     for sec in operation_security[0]:
53                         if sec in filtered_dict:
54                             return CheckResult.FAILED, security_schemes
55 
56         return CheckResult.PASSED, conf
57 
58 
59 check = ClearTestAPIKey()
60
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
--- a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
+++ b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py
@@ -17,6 +17,16 @@
                          block_type=BlockType.DOCUMENT)
 
     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class
+        schemes = conf.get("schemes")
+        if schemes and isinstance(schemes, list):
+            if "http" not in schemes and "wp" not in schemes:
+                return CheckResult.PASSED, conf
+
+        servers = conf.get("servers")
+        if servers and isinstance(servers, list):
+            if not any(server['url'].startswith('http://') for server in servers):
+                return CheckResult.PASSED, conf
+
         components = conf.get("components")
         security_def = conf.get("securityDefinitions")
         if components and isinstance(components, dict):

{"golden_diff": "diff --git a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n--- a/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n+++ b/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py\n@@ -17,6 +17,16 @@\n                          block_type=BlockType.DOCUMENT)\n \n     def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class\n+        schemes = conf.get(\"schemes\")\n+        if schemes and isinstance(schemes, list):\n+            if \"http\" not in schemes and \"wp\" not in schemes:\n+                return CheckResult.PASSED, conf\n+\n+        servers = conf.get(\"servers\")\n+        if servers and isinstance(servers, list):\n+            if not any(server['url'].startswith('http://') for server in servers):\n+                return CheckResult.PASSED, conf\n+\n         components = conf.get(\"components\")\n         security_def = conf.get(\"securityDefinitions\")\n         if components and isinstance(components, dict):\n", "issue": "CKV_OPENAPI_20 incorrectly flags API keys via HTTPS\n**Describe the issue**\r\n\r\n#5253 added CKV_OPENAPI_20 with the message \"Ensure that API keys are not sent over cleartext\", but the [check](https://github.com/bridgecrewio/checkov/blob/main/checkov/openapi/checks/resource/generic/ClearTextAPIKey.py) does not check the API's supported schemes.\r\n\r\nIf the intent of this check is to prevent cleartext use of API keys, then if the root level [`schemes`](https://swagger.io/docs/specification/2-0/api-host-and-base-path/) key in OpenAPI 2.0 or [`servers`](https://swagger.io/docs/specification/api-host-and-base-path/) key in OpenAPI 3.0 specifies only `https` (2.0) or only `url`s which are HTTPS (3.0), this check should pass.\r\n\r\n**Examples**\r\n\r\n[fail2.json](https://github.com/bridgecrewio/checkov/blob/main/tests/openapi/checks/resource/generic/example_ClearTextAPIKey/fail2.json) and its YAML counterpart should fail, but if they specified `\"schemes\": [\"https\"]`, they should not.\r\n\r\nDitto for the OpenAPI 3.0 version of this example.\r\n\r\n**Version (please complete the following information):**\r\n\r\n2.3.312\r\n\r\n**Additional context**\r\n\r\nIt may be that the message is wrong and you actually intend to flag all use of API keys, but if that's the case, the message should convey that. I also would argue that header API keys should not be scrutinized the same way as query parameter API keys, since the risk of leaking the API key unintentionally is higher with the latter.\n", "before_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.checks.enums import BlockType\nfrom checkov.common.util.consts import LINE_FIELD_NAMES\nfrom checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck\n\n\nclass ClearTestAPIKey(BaseOpenapiCheck):\n    def __init__(self) -> None:\n        id = \"CKV_OPENAPI_20\"\n        name = \"Ensure that API keys are not sent over cleartext\"\n        categories = (CheckCategories.API_SECURITY,)\n        supported_resources = ('paths',)\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,\n                         block_type=BlockType.DOCUMENT)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class\n        components = conf.get(\"components\")\n        security_def = conf.get(\"securityDefinitions\")\n        if components and isinstance(components, dict):\n            security_schemes = components.get(\"securitySchemes\") or {}\n        elif security_def:\n            security_schemes = security_def\n        else:\n            return CheckResult.PASSED, conf\n\n        paths = conf.get('paths')\n        if not isinstance(paths, dict):\n            return CheckResult.PASSED, security_schemes\n\n        filtered_dict = {}\n        if isinstance(security_schemes, dict):\n            for name, scheme in security_schemes.items():\n                if isinstance(scheme, dict) and scheme.get('type') == \"apiKey\":\n                    filtered_dict[name] = scheme\n\n        if not filtered_dict:\n            return CheckResult.PASSED, security_schemes\n\n        for key, path in paths.items():\n            if not path:\n                continue\n            if key in LINE_FIELD_NAMES:\n                continue\n            for value in path.values():\n                if not isinstance(value, dict):\n                    continue\n                operation_security = value.get('security')\n                if operation_security and isinstance(operation_security, list):\n                    for sec in operation_security[0]:\n                        if sec in filtered_dict:\n                            return CheckResult.FAILED, security_schemes\n\n        return CheckResult.PASSED, conf\n\n\ncheck = ClearTestAPIKey()\n", "path": "checkov/openapi/checks/resource/generic/ClearTextAPIKey.py"}], "after_files": [{"content": "from __future__ import annotations\n\nfrom typing import Any\nfrom checkov.common.models.enums import CheckResult, CheckCategories\nfrom checkov.common.checks.enums import BlockType\nfrom checkov.common.util.consts import LINE_FIELD_NAMES\nfrom checkov.openapi.checks.base_openapi_check import BaseOpenapiCheck\n\n\nclass ClearTestAPIKey(BaseOpenapiCheck):\n    def __init__(self) -> None:\n        id = \"CKV_OPENAPI_20\"\n        name = \"Ensure that API keys are not sent over cleartext\"\n        categories = (CheckCategories.API_SECURITY,)\n        supported_resources = ('paths',)\n        super().__init__(name=name, id=id, categories=categories, supported_entities=supported_resources,\n                         block_type=BlockType.DOCUMENT)\n\n    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # return type is different than the base class\n        schemes = conf.get(\"schemes\")\n        if schemes and isinstance(schemes, list):\n            if \"http\" not in schemes and \"wp\" not in schemes:\n                return CheckResult.PASSED, conf\n\n        servers = conf.get(\"servers\")\n        if servers and isinstance(servers, list):\n            if not any(server['url'].startswith('http://') for server in servers):\n                return CheckResult.PASSED, conf\n\n        components = conf.get(\"components\")\n        security_def = conf.get(\"securityDefinitions\")\n        if components and isinstance(components, dict):\n            security_schemes = components.get(\"securitySchemes\") or {}\n        elif security_def:\n            security_schemes = security_def\n        else:\n            return CheckResult.PASSED, conf\n\n        paths = conf.get('paths')\n        if not isinstance(paths, dict):\n            return CheckResult.PASSED, security_schemes\n\n        filtered_dict = {}\n        if isinstance(security_schemes, dict):\n            for name, scheme in security_schemes.items():\n                if isinstance(scheme, dict) and scheme.get('type') == \"apiKey\":\n                    filtered_dict[name] = scheme\n\n        if not filtered_dict:\n            return CheckResult.PASSED, security_schemes\n\n        for key, path in paths.items():\n            if not path:\n                continue\n            if key in LINE_FIELD_NAMES:\n                continue\n            for value in path.values():\n                if not isinstance(value, dict):\n                    continue\n                operation_security = value.get('security')\n                if operation_security and isinstance(operation_security, list):\n                    for sec in operation_security[0]:\n                        if sec in filtered_dict:\n                            return CheckResult.FAILED, security_schemes\n\n        return CheckResult.PASSED, conf\n\n\ncheck = ClearTestAPIKey()\n", "path": "checkov/openapi/checks/resource/generic/ClearTextAPIKey.py"}]}