Contract Governance
Artifacts that describe and constrain the CONTRACT — rulesets, vocabulary, declared conformance, overlays. Renamed in 0.12 from "Governance": it never measured how the organisation governs itself, and the standalone `accountability` layer now does, so one word could not carry both. NOTE ON WHAT THIS SCORES (0.12, roadmap#62): these checks read what a ruleset DECLARES, not the result of running it. Spectral is never executed against the provider's own spec. The facet text through 0.11 described lint outcomes, which was the source of a reported and confirmed defect. Outcome-based linting is a separate artifact class and is not in this release.
How it is scored
6 checks worth 33 points, grouped by the artifact each one reads. A facet's sub-score is its awarded points normalized against the points that were actually applicable to that provider — a check needing an artifact the provider does not publish at all is N/A, and leaves both sides of the fraction.
spectral| Check | Rule | Points |
|---|---|---|
| Publishes a rulesetA Spectral ruleset exists. The provider has written down what "good" means for their API surface instead of leaving it to reviewer taste. | rules[0].rule_count >= 1 | 10 |
| Substantial rulesetTwenty or more rules ENFORCED — authored plus whatever an `extends:` brings in. 0.12 (roadmap#62): this counted authored rules only, so a ruleset extending spectral:oas and adding a focused handful was measured on the handful. As the provider who reported it put it, the alternative was "inlining 41 rules I didn't write in order to be measured on the 9 I did". Extending a maintained base is the better engineering choice and the threshold was punishing it. | rules[0].effective_rule_count >= 20 | 5 |
| Balanced severitiesThe ruleset uses warn and info, not only error. A ruleset where everything is an error cannot express guidance — only refusal. | warn and info both > 0 | 3 |
| Publishes a vocabularyA controlled vocabulary is published, so the provider's naming is a documented decision rather than an accident of whoever wrote each endpoint. | common[].type includes "Vocabulary" | 5 |
| Declared conformance profileThe provider declares which standards it conforms to — FHIR, FAPI, PCI, ISO 20022, CAMARA — as a machine-readable artifact resolving against the standards catalog, rather than as a logo on a marketing page.PROVENANCE-GRADED, and the grading is the whole point. Half the conformance artifacts in the catalog (1,881 of 3,784) are API-Evangelist-derived readings of a provider's specs, not claims the provider made. Only a first-party declaration earns full credit here.THE BOUNDARY THIS CHECK HOLDS: adopting someone else's standard is not governance. Telecom is full of organizations that joined CAMARA, TM Forum or GSMA Open Gateway and govern nothing; governance is what you do to yourself. This credits evidence of INTERNALIZATION — a declared profile, an overlay, a published lint posture — never bare membership in a programme. | a conformance/ artifact declares conformance to named standards | 6 |
| Publishes an OpenAPI OverlayAn OpenAPI Overlay — the provider expressing a repeatable, versioned transformation of its own contract rather than hand-editing it. Evidence of a spec pipeline, which is what governance looks like in practice. | overlays/ contains an OpenAPI Overlay document | 4 |
How the catalog distributes on it
Every one of the 27,504 providers this facet is scored on, bucketed by sub-score.
Top providers
The top 500 of 9,073 providers scoring above zero on this facet, ranked by facet sub-score, ties broken by composite.
The other 7 facets
github.com/api-evangelist/<provider>, and each check above names the exact artifact it
reads. Publish the artifact, open a pull request, and the next scoring run picks it up — no gatekeeping
and no fee. The full rubric is at apis.io/rating/, and
prioritized profiling
is the fast lane if you would rather have it done for you.
Scored on rubric v0.17.2 across 27,504 providers · lists rebuilt 2026-09-01 · capped at the top 500 per page.