AB Tasty · API Governance Rules

AB Tasty API Rules

Spectral linting rules defining API design standards and conventions for AB Tasty.

46 Rules error 13 warn 27 info 6
Generated by API Evangelist Written by API Evangelist tooling for AB Tasty's APIs. It is a starting point, not a ruleset AB Tasty publishes or enforces.
View Rules File View on GitHub

Rule Categories

delete error examples get info microcks no openapi operation parameter path paths post request response schema security servers tag

Rules

error
info-title-required
API info must have a title
$.info
warn
info-title-prefix
API title should start with "AB Tasty"
$.info.title
error
info-description-required
API info must have a description
$.info
warn
info-description-min-length
API description should be meaningful (at least 30 characters)
$.info.description
error
info-version-required
API info must have a version
$.info
warn
info-contact-required
API info should have contact information
$.info
warn
openapi-version-3
Should use OpenAPI 3.x
$
error
servers-defined
Servers must be defined
$
error
servers-https
Server URLs must use HTTPS
$.servers[*].url
warn
servers-description
Each server should have a description
$.servers[*]
warn
paths-kebab-case
Path segments should use kebab-case
$.paths[*]~
warn
paths-no-trailing-slash
Paths should not have trailing slashes
$.paths[*]~
error
operation-summary-required
Every operation must have a summary
$.paths[*][get,post,put,patch,delete,options,head]
warn
operation-summary-prefix
Operation summaries should start with "AB Tasty"
$.paths[*][get,post,put,patch,delete,options,head].summary
warn
operation-description-required
Every operation must have a description
$.paths[*][get,post,put,patch,delete,options,head]
error
operation-id-required
Every operation must have an operationId
$.paths[*][get,post,put,patch,delete,options,head]
warn
operation-id-camel-case
operationId should use camelCase
$.paths[*][get,post,put,patch,delete,options,head].operationId
error
operation-tags-required
Every operation must have at least one tag
$.paths[*][get,post,put,patch,delete,options,head]
warn
tag-global-defined
Tags used in operations should be defined at the global level
$.tags
info
tag-description
Global tags should have descriptions
$.tags[*]
warn
parameter-description-required
All parameters must have a description
$..parameters[*]
warn
parameter-schema-type
All parameters should have a schema with type defined
$..parameters[*].schema
warn
parameter-api-key-in-header
API keys should be passed in headers, not query parameters
$.components.securitySchemes[?(@.type == 'apiKey')]
warn
request-body-content-type
Request bodies should use application/json content type
$.paths[*][post,put,patch].requestBody.content
error
response-success-required
Operations must have at least one 2xx response
$.paths[*][get,post,put,patch,delete]
error
response-description-required
All responses must have a description
$.paths[*][*].responses[*]
warn
response-401-for-secured-endpoints
Secured endpoints should document 401 responses
$.paths[*][post,get,put,delete].responses
info
response-429-rate-limit
APIs with rate limits should document 429 responses
$.paths[*][post].responses
warn
schema-description-required
Top-level schemas should have descriptions
$.components.schemas[*]
warn
schema-property-type
Schema properties should have types defined
$.components.schemas[*].properties[*]
info
schema-property-description
Schema properties should have descriptions
$.components.schemas[*].properties[*]
error
security-schemes-defined
Security schemes should be defined in components
$.components.securitySchemes
warn
security-scheme-description
Security schemes should have descriptions
$.components.securitySchemes[*]
warn
security-global-defined
Global security should be defined
$
error
get-no-request-body
GET operations should not have request bodies
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have request bodies
$.paths[*].delete
warn
post-should-have-request-body
POST operations should have request bodies
$.paths[*].post
error
no-empty-descriptions
Descriptions should not be empty strings
$..description
info
examples-encouraged
Schema properties should have examples
$.components.schemas[*].properties[*]
info
microcks-operation-extension
Operations should have x-microcks-operation extension for mock compatibility
$.paths[*][get,post,put,patch,delete]
warn
servers-expected-domain
Server URLs should be on the flagship.io domain.
$.servers[*].url
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (Error) should be defined for error payloads.
$.components.schemas
warn
operation-documents-401
Operations should document a 401 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# ab-tasty — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 1/1 servers on flagship.io
#   - path-params-casing: camel @ 100% (n=4)
#   - operationid-casing: camel @ 100% (n=4)
#   - schema-names-casing: pascal @ 100% (n=14)
#   - schema-properties-casing: snake @ 65% (n=43)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: Error
#   - operation-documents-401: 100% adherence
#   - merge: kept 40 existing, added 6 measured, upgraded 0
#   - added: servers-expected-domain, path-params-casing, schema-names-casing, schema-properties-casing, error-schema-defined, operation-documents-401
extends:
- spectral:oas
rules:
  info-title-required:
    description: API info must have a title
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-title-prefix:
    description: API title should start with "AB Tasty"
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^AB Tasty
  info-description-required:
    description: API info must have a description
    severity: error
    given: $.info
    then:
      field: description
      function: truthy
  info-description-min-length:
    description: API description should be meaningful (at least 30 characters)
    severity: warn
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 30
  info-version-required:
    description: API info must have a version
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: API info should have contact information
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  openapi-version-3:
    description: Should use OpenAPI 3.x
    severity: warn
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.
  servers-defined:
    description: Servers must be defined
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs must use HTTPS
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-description:
    description: Each server should have a description
    severity: warn
    given: $.servers[*]
    then:
      field: description
      function: truthy
  paths-kebab-case:
    description: Path segments should use kebab-case
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(\/([a-z0-9-{}]+))*\/?$
  paths-no-trailing-slash:
    description: Paths should not have trailing slashes
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \/$
  operation-summary-required:
    description: Every operation must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete,options,head]
    then:
      field: summary
      function: truthy
  operation-summary-prefix:
    description: Operation summaries should start with "AB Tasty"
    severity: warn
    given: $.paths[*][get,post,put,patch,delete,options,head].summary
    then:
      function: pattern
      functionOptions:
        match: ^AB Tasty
  operation-description-required:
    description: Every operation must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete,options,head]
    then:
      field: description
      function: truthy
  operation-id-required:
    description: Every operation must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete,options,head]
    then:
      field: operationId
      function: truthy
  operation-id-camel-case:
    description: operationId should use camelCase
    severity: warn
    given: $.paths[*][get,post,put,patch,delete,options,head].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-tags-required:
    description: Every operation must have at least one tag
    severity: error
    given: $.paths[*][get,post,put,patch,delete,options,head]
    then:
      field: tags
      function: truthy
  tag-global-defined:
    description: Tags used in operations should be defined at the global level
    severity: warn
    given: $.tags
    then:
      function: truthy
  tag-description:
    description: Global tags should have descriptions
    severity: info
    given: $.tags[*]
    then:
      field: description
      function: truthy
  parameter-description-required:
    description: All parameters must have a description
    severity: warn
    given: $..parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-type:
    description: All parameters should have a schema with type defined
    severity: warn
    given: $..parameters[*].schema
    then:
      field: type
      function: truthy
  parameter-api-key-in-header:
    description: API keys should be passed in headers, not query parameters
    severity: warn
    given: $.components.securitySchemes[?(@.type == 'apiKey')]
    then:
      field: in
      function: pattern
      functionOptions:
        match: ^header$
  request-body-content-type:
    description: Request bodies should use application/json content type
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
  response-success-required:
    description: Operations must have at least one 2xx response
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: responses
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
  response-description-required:
    description: All responses must have a description
    severity: error
    given: $.paths[*][*].responses[*]
    then:
      field: description
      function: truthy
  response-401-for-secured-endpoints:
    description: Secured endpoints should document 401 responses
    severity: warn
    given: $.paths[*][post,get,put,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
  response-429-rate-limit:
    description: APIs with rate limits should document 429 responses
    severity: info
    given: $.paths[*][post].responses
    then:
      function: truthy
  schema-description-required:
    description: Top-level schemas should have descriptions
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schema-property-type:
    description: Schema properties should have types defined
    severity: warn
    given: $.components.schemas[*].properties[*]
    then:
      field: type
      function: truthy
  schema-property-description:
    description: Schema properties should have descriptions
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: description
      function: truthy
  security-schemes-defined:
    description: Security schemes should be defined in components
    severity: error
    given: $.components.securitySchemes
    then:
      function: truthy
  security-scheme-description:
    description: Security schemes should have descriptions
    severity: warn
    given: $.components.securitySchemes[*]
    then:
      field: description
      function: truthy
  security-global-defined:
    description: Global security should be defined
    severity: warn
    given: $
    then:
      field: security
      function: truthy
  get-no-request-body:
    description: GET operations should not have request bodies
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not have request bodies
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  post-should-have-request-body:
    description: POST operations should have request bodies
    severity: warn
    given: $.paths[*].post
    then:
      field: requestBody
      function: truthy
  no-empty-descriptions:
    description: Descriptions should not be empty strings
    severity: error
    given: $..description
    then:
      function: pattern
      functionOptions:
        notMatch: ^\s*$
  examples-encouraged:
    description: Schema properties should have examples
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: example
      function: truthy
  microcks-operation-extension:
    description: Operations should have x-microcks-operation extension for mock compatibility
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  servers-expected-domain:
    description: Server URLs should be on the flagship.io domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: flagship\.io
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: camel
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (Error) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Error
      function: truthy
  operation-documents-401:
    description: Operations should document a 401 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/ab-tasty-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.