WSO2

WSO2 Rulesets API

for managing rulesets.

Documentation GitHub OpenAPI

Operations 7

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /rulesets List governance rulesets · Retrieves a list of rulesets #

Ask an LLM

“What rulesets does my organization have for API governance?”

“Can I search rulesets by name and page through results?”

Tell an agent

List our governance rulesets.

Search rulesets matching {query}, returning {limit} at a time.

POST /rulesets Create a governance ruleset · Create a new ruleset #

Ask an LLM

“How do I upload a new linting ruleset for API definitions in WSO2?”

“Can I add a ruleset that validates async API artifacts?”

Tell an agent

Create a ruleset named {name} of type {ruleType} for {artifactType} artifacts with content {rulesetContent}.

Add a new ruleset {name} from this YAML: {rulesetContent}, applying to {ruleType} on {artifactType}.

GET /rulesets/{rulesetId} Get a ruleset's details · Retrieves details of a specific ruleset #

Ask an LLM

“What are the details and metadata of a specific ruleset?”

“Who provided a given ruleset and what artifact type does it check?”

Tell an agent

Get ruleset {rulesetId}.

Show me the metadata for ruleset {rulesetId}.

PUT /rulesets/{rulesetId} Update an existing ruleset · Updates a specific ruleset #

Ask an LLM

“How do I change the rules inside a ruleset I already created?”

“Can I rename an existing ruleset and edit its documentation link?”

Tell an agent

Update ruleset {rulesetId} with new content {rulesetContent}, name {name}, type {ruleType}, artifact {artifactType}.

Rename existing ruleset {rulesetId} to {name}, keeping type {ruleType}, artifact {artifactType} and content {rulesetContent}.

DELETE /rulesets/{rulesetId} Delete a ruleset · Deletes a specific ruleset #

Ask an LLM

“How do I remove a ruleset we no longer use?”

“Can I delete a governance ruleset permanently?”

Tell an agent destructive · confirm first

Delete ruleset {rulesetId}.

Remove the obsolete ruleset {rulesetId}.

GET /rulesets/{rulesetId}/content Download a ruleset's rule file · Retrieves the content of a specific ruleset #

Ask an LLM

“Where can I read the raw YAML or JSON rules inside a ruleset?”

“Can I download the actual rule file content of a ruleset?”

Tell an agent

Get the rule file content of ruleset {rulesetId}.

Download the raw rules for ruleset {rulesetId}.

GET /rulesets/{rulesetId}/usage See which policies use a ruleset · Retrieves the policy usage of a specific ruleset #

Ask an LLM

“Which governance policies depend on this ruleset?”

“Is a ruleset still referenced by any policy before I delete it?”

Tell an agent

List the policies that use ruleset {rulesetId}.

Check where ruleset {rulesetId} is used.

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/wso2:wso2-rulesets-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  version: v1.1
  title: WSO2 API Manager - Governance Rulesets API
  description: This document specifies a **RESTful API** for WSO2 **API Manager** - Governance.
  contact:
    name: WSO2
    url: http://wso2.com/products/api-manager/
    email: architecture@wso2.com
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://apis.wso2.com/api/am/governance/v1
tags:
- name: Rulesets
  description: for managing rulesets.
paths:
  /rulesets:
    get:
      summary: Retrieves a list of rulesets
      description: Returns a list of all rulesets associated with the requested organization.
      operationId: getRulesets
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - name: query
        in: query
        schema:
          type: string
          example: name:WSO2 Security Practices artifactType:REST_API ruleType:API_DEFINITION
        description: "You can search for rulesets using the following format:\n\n  - \"query=name:{NAME}\" searches rulesets by name.\n  - \"query=artifactType:{ARTIFACT_TYPE}\" searches rulesets by artifact type.\n  - \"query=ruleType:{RULE_TYPE}\" searches rulesets by rule type.\n\nYou can combine multiple attributes to search for rulesets:\n  - \"query=name:{NAME} artifactType:{ARTIFACT_TYPE} ruleType:{RULE_TYPE}\" searches rulesets by name, artifact type, and rule type.\n\nRemember to use URL encoding if your client does not support it (e.g., curl).\n"
      responses:
        '200':
          description: OK. Successful response with a list of rulesets.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RulesetList'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_read
    post:
      summary: Create a new ruleset
      description: Creates a new ruleset in the user's organization.
      operationId: createRuleset
      tags:
      - Rulesets
      requestBody:
        required: true
        description: JSON object containing the details of the new ruleset.
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/RulesetInput'
      responses:
        '201':
          description: OK. Ruleset created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RulesetInfo'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_manage
  /rulesets/{rulesetId}:
    get:
      summary: Retrieves details of a specific ruleset
      description: Retrieves details of the ruleset identified by the rulesetId.
      operationId: getRulesetById
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/rulesetId'
      responses:
        '200':
          description: OK. Ruleset details retrieved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RulesetInfo'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_read
    put:
      summary: Updates a specific ruleset
      description: Updates the details of the ruleset identified by the `rulesetId`.
      operationId: updateRulesetById
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/rulesetId'
      requestBody:
        required: true
        description: JSON object containing the updated ruleset details.
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/RulesetInput'
      responses:
        '200':
          description: OK. Ruleset updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RulesetInfo'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_manage
    delete:
      summary: Deletes a specific ruleset
      description: Deletes an existing ruleset identified by the rulesetId.
      operationId: deleteRuleset
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/rulesetId'
      responses:
        '204':
          description: OK. Ruleset deleted successfully.
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_manage
  /rulesets/{rulesetId}/content:
    get:
      summary: Retrieves the content of a specific ruleset
      description: Retrieves the content of the ruleset identified by the rulesetId.
      operationId: getRulesetContent
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/rulesetId'
      responses:
        '200':
          description: OK. Ruleset content retrieved successfully.
          content:
            application/x-yaml:
              schema:
                type: string
            application/json:
              schema:
                type: string
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_read
  /rulesets/{rulesetId}/usage:
    get:
      summary: Retrieves the policy usage of a specific ruleset
      description: Retrieves the list of policies using the ruleset identified by the rulesetId.
      operationId: getRulesetUsage
      tags:
      - Rulesets
      parameters:
      - $ref: '#/components/parameters/rulesetId'
      responses:
        '200':
          description: OK. Ruleset usage retrieved successfully.
          content:
            application/json:
              schema:
                type: array
                description: List of artifacts using the ruleset.
                items:
                  type: string
                  example: 123e4567-e89b-12d3-a456-426614174000
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - OAuth2Security:
        - apim:gov_rule_read
components:
  schemas:
    Pagination:
      title: Pagination
      type: object
      properties:
        offset:
          type: integer
          example: 0
        limit:
          type: integer
          example: 1
        total:
          type: integer
          example: 10
        next:
          type: string
          description: 'Link to the next subset of resources qualified.

            Empty if no more resources are to be returned.

            '
        previous:
          type: string
          description: 'Link to the previous subset of resources qualified.

            Empty if current subset is the first subset returned.

            '
    RulesetInput:
      type: object
      description: Detailed information about a ruleset.
      properties:
        name:
          type: string
          maxLength: 256
          description: Name of the ruleset.
          example: API Security Ruleset
        description:
          type: string
          maxLength: 1024
          description: A brief description of the ruleset.
          example: A ruleset designed to enforce security standards for APIs.
        rulesetContent:
          type: string
          description: The content of the ruleset file (YAML or JSON).
          format: binary
          example: "rules:\n  oas2-always-use-https:\n    given:\n      - '$.schemes[*]'\n    severity: error\n    then:\n      function: enumeration\n      functionOptions:\n        values:\n          - https\n    description: >-\n      Host schemes must use the HTTPS protocol. Applies to: OpenAPI 2.0`\n    message: API host schemes must use the HTTPS protocol.\n    formats:\n      - oas2\n"
        ruleCategory:
          type: string
          description: Category the rules included in ruleset.
          enum:
          - SPECTRAL
          example: SPECTRAL
          default: SPECTRAL
        ruleType:
          type: string
          description: Context or area to which the ruleset applies.
          enum:
          - API_METADATA
          - API_DEFINITION
          - API_DOCUMENTATION
          example: API_DEFINITION
          x-enum-varnames:
          - API_METADATA
          - API_DEFINITION
          - API_DOCUMENTATION
        artifactType:
          type: string
          description: The type of artifact that the ruleset validates.
          enum:
          - REST_API
          - ASYNC_API
          - MCP
          example: REST_API
        documentationLink:
          type: string
          description: URL to the documentation related to the ruleset.
          example: https://example.com/docs/api-security-ruleset
        provider:
          type: string
          description: Entity or individual providing the ruleset.
          example: TechWave
      required:
      - name
      - rulesetContent
      - ruleType
      - artifactType
    Error:
      title: Error object returned with 4XX HTTP Status
      required:
      - code
      - message
      properties:
        code:
          type: integer
          format: int64
        message:
          type: string
          description: Error message.
        description:
          type: string
          description: 'A detail description about the error message.

            '
    RulesetList:
      type: object
      description: A list of rulesets.
      properties:
        count:
          type: integer
          description: Number of rulesets returned.
          example: 2
        list:
          type: array
          description: List of rulesets.
          items:
            $ref: '#/components/schemas/RulesetInfo'
        pagination:
          $ref: '#/components/schemas/Pagination'
    RulesetInfo:
      type: object
      description: Detailed information about a ruleset.
      properties:
        id:
          type: string
          description: UUID of the ruleset.
          readOnly: true
          example: 123e4567-e89b-12d3-a456-426614174000
        name:
          type: string
          description: Name of the ruleset.
          example: API Security Ruleset
        description:
          type: string
          description: A brief description of the ruleset.
          example: A ruleset designed to enforce security standards for APIs.
        ruleCategory:
          type: string
          description: Category the rules included in ruleset.
          enum:
          - SPECTRAL
          example: SPECTRAL
        ruleType:
          type: string
          description: Context or area to which the ruleset applies.
          enum:
          - API_METADATA
          - API_DEFINITION
          - API_DOCUMENTATION
          example: API_DEFINITION
          x-enum-varnames:
          - API_METADATA
          - API_DEFINITION
          - API_DOCUMENTATION
        artifactType:
          type: string
          description: The type of artifact that the ruleset validates.
          enum:
          - REST_API
          - ASYNC_API
          - MCP
          example: REST_API
        documentationLink:
          type: string
          description: URL to the documentation related to the ruleset.
          example: https://example.com/docs/api-security-ruleset
        provider:
          type: string
          description: Entity or individual providing the ruleset.
          example: TechWave
        createdBy:
          type: string
          description: Identifier of the user who created the ruleset.
          readOnly: true
          example: admin@gmail.com
        createdTime:
          type: string
          description: Timestamp when the ruleset was created.
          readOnly: true
          example: '2024-08-01T12:00:00Z'
        updatedBy:
          type: string
          description: Identifier of the user who last updated the ruleset.
          readOnly: true
          example: admin@gmail.com
        updatedTime:
          type: string
          description: Timestamp when the ruleset was last updated.
          readOnly: true
          example: '2024-08-02T12:00:00Z'
      required:
      - name
      - ruleType
      - artifactType
      - provider
  parameters:
    limit:
      name: limit
      in: query
      description: 'Maximum size of resource array to return.

        '
      schema:
        type: integer
        default: 25
    offset:
      name: offset
      in: query
      description: 'Starting point within the complete list of items qualified.

        '
      schema:
        type: integer
        default: 0
    rulesetId:
      name: rulesetId
      in: path
      description: '**UUID** of the Ruleset.

        '
      required: true
      schema:
        type: string
  securitySchemes:
    OAuth2Security:
      type: oauth2
      flows:
        password:
          tokenUrl: https://localhost:9443/oauth2/token
          scopes:
            openid: Authorize access to user details
            apim:gov_rule_read: Read governance rulesets
            apim:gov_rule_manage: Manage governance rulesets
            apim:gov_policy_read: Read governance policies
            apim:gov_policy_manage: Manage governance policies
            apim:gov_result_read: Read governance results

WSO2 Rulesets API

Operations 7

Documentation

Specifications

Schemas & Data

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification