• Have a localServicesRouterDeployment.war, defining a root level security element, e.g.:

  security:
    # a global security requirement declaration, must match a .components.securityScheme
    api_key:
    - admins
  ...
  components:
    ...
    securitySchemes:
      api_key:
        type: apiKey
        name: api_key
        in: header
  ...
  

• Then, have a anotherLocalServicesRouterDeployment.war, defining a root level security element, with the same name, but different attributes, e.g.:

  security:
    # a global security requirement declaration, must match a .components.securityScheme
    api_key:
    - root
  ...
  components:
    securitySchemes:
      api_key:
        type: apiKey
        name: apiKey
        in: cookie
  ...
  

When deploying both the applications, the resulting OpenAPI document components element holds the result of what has been defined, and at the operation level (and conflicting names are resolved):

---
components:
  schemas:
    ...
  securitySchemes:
    anotherLocalServicesRouterDeploymentapi_key:
      in: cookie
      name: apiKey
      type: apiKey
    localServicesRouterDeploymentapi_key:
      in: header
      name: api_key
      type: apiKey
...

but the root level security element is not present.