Acquia · API Governance Rules

Acquia API Rules

Spectral linting rules defining API design standards and conventions for Acquia.

37 Rules error 14 warn 14 info 9
Generated by API Evangelist Written by API Evangelist tooling for Acquia's APIs. It is a starting point, not a ruleset Acquia publishes or enforces.
View Rules File View on GitHub

Rule Categories

actions delete error get hal info no openapi operation operationid parameter paths post query response schema security servers tags

Rules

error
info-title-required
OpenAPI info.title must be present and non-empty
$.info
warn
info-description-required
OpenAPI info.description must be present
$.info
error
info-version-required
OpenAPI info.version must be defined
$.info
warn
info-contact-required
API info should include contact information
$.info
error
openapi-version-3x
Acquia APIs must use OpenAPI 3.x
$
error
servers-required
At least one server must be defined
$
error
servers-https
Server URLs must use HTTPS
$.servers[*]
info
servers-acquia-cloud-domain
Acquia Cloud API server should use cloud.acquia.com domain
$.servers[*]
error
paths-no-trailing-slash
Paths must not end with a trailing slash
$.paths[*]~
info
paths-uuid-format
Resource identifiers in paths should use UUID suffix pattern
$.paths[*]~
error
operation-summary-required
All operations must have a summary
$.paths[*][get,post,put,patch,delete]
warn
operation-description-required
All operations should have a description
$.paths[*][get,post,put,patch,delete]
error
operation-id-required
All operations must have an operationId
$.paths[*][get,post,put,patch,delete]
error
operation-tags-required
All operations must have at least one tag
$.paths[*][get,post,put,patch,delete]
info
operation-summary-acquia-prefix
Operation summaries should start with 'Acquia'
$.paths[*][get,post,put,patch,delete].summary
warn
tags-global-defined
Global tags array should be defined
$
warn
parameter-description-required
All parameters should have a description
$.paths[*][get,post,put,patch,delete].parameters[*]
error
parameter-schema-required
All parameters must have a schema
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameter-uuid-naming
UUID path parameters should end with 'Uuid' suffix
$.paths[*][get,post,put,patch,delete].parameters[?(@.in == 'path')]
error
response-success-required
All operations must define at least one 2xx response
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
All responses must have a description
$.paths[*][get,post,put,patch,delete].responses[*]
warn
response-401-unauthorized
Protected endpoints should define 401 Unauthorized responses
$.paths[*][get,post,put,patch,delete].responses
warn
response-403-forbidden
Protected endpoints should define 403 Forbidden responses
$.paths[*][post,put,patch,delete].responses
warn
schema-type-defined
Schema components should define a type
$.components.schemas[*]
error
security-schemes-defined
Security schemes must be defined in components
$
info
security-oauth2-scheme
Acquia Cloud API uses OAuth2 authentication
$.components.securitySchemes[*]
error
get-no-request-body
GET operations must not have a request body
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have a request body
$.paths[*].delete
info
post-has-request-body
POST operations creating resources should have a request body
$.paths[*].post
info
actions-paths-pattern
Action endpoints should follow /resources/{id}/actions/{action-name} pattern
$.paths[*~\/actions\/]~
info
hal-json-content-type
Acquia Cloud API responses use application/hal+json content type
$.paths[*][get,post,put,patch,delete].responses[*].content
warn
no-empty-descriptions
Descriptions must not be empty strings
$..description
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
operationid-casing
Operation IDs should be camelCase (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].operationId
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (Acquia_Cloud_API_Documentation_Error) should be defined for error payloads.
$.components.schemas
warn
operation-documents-404
Operations should document a 404 response (documented on 95% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# acquia — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - path-params-casing: camel @ 96% (n=750)
#   - query-params-casing: snake @ 100% (n=410)
#   - operationid-casing: camel @ 96% (n=638)
#   - schema-properties-casing: snake @ 78% (n=52120)
#   - security: neither global nor consistently per-op — schemes-defined only
#   - error-schema-defined: Acquia_Cloud_API_Documentation_Error
#   - operation-documents-404: 95% adherence
#   - pagination params observed: ['limit', 'offset']
#   - merge: kept 32 existing, added 5 measured, upgraded 0
#   - added: query-params-casing, operationid-casing, schema-properties-casing, error-schema-defined, operation-documents-404
extends:
  - spectral:oas
rules:
  info-title-required:
    description: OpenAPI info.title must be present and non-empty
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-description-required:
    description: OpenAPI info.description must be present
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: OpenAPI info.version must be defined
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: API info should include contact information
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  openapi-version-3x:
    description: Acquia APIs must use OpenAPI 3.x
    severity: error
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.
  servers-required:
    description: At least one server must be defined
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs must use HTTPS
    severity: error
    given: $.servers[*]
    then:
      field: url
      function: pattern
      functionOptions:
        match: ^https://
  servers-acquia-cloud-domain:
    description: Acquia Cloud API server should use cloud.acquia.com domain
    severity: info
    given: $.servers[*]
    then:
      field: url
      function: pattern
      functionOptions:
        match: acquia\.com
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \/$
  paths-uuid-format:
    description: Resource identifiers in paths should use UUID suffix pattern
    severity: info
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^\/
  operation-summary-required:
    description: All operations must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-description-required:
    description: All operations should have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-id-required:
    description: All operations must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-tags-required:
    description: All operations must have at least one tag
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-summary-acquia-prefix:
    description: Operation summaries should start with 'Acquia'
    severity: info
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^Acquia '
  tags-global-defined:
    description: Global tags array should be defined
    severity: warn
    given: $
    then:
      field: tags
      function: truthy
  parameter-description-required:
    description: All parameters should have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: All parameters must have a schema
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: schema
      function: truthy
  parameter-uuid-naming:
    description: UUID path parameters should end with 'Uuid' suffix
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in == 'path')]
    then:
      field: name
      function: pattern
      functionOptions:
        match: Uuid$|Id$|Name$
  response-success-required:
    description: All operations must define at least one 2xx response
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  response-description-required:
    description: All responses must have a description
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  response-401-unauthorized:
    description: Protected endpoints should define 401 Unauthorized responses
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '401'
  response-403-forbidden:
    description: Protected endpoints should define 403 Forbidden responses
    severity: warn
    given: $.paths[*][post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '403'
  schema-type-defined:
    description: Schema components should define a type
    severity: warn
    given: $.components.schemas[*]
    then:
      field: type
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components
    severity: error
    given: $
    then:
      field: components.securitySchemes
      function: truthy
  security-oauth2-scheme:
    description: Acquia Cloud API uses OAuth2 authentication
    severity: info
    given: $.components.securitySchemes[*]
    then:
      field: type
      function: pattern
      functionOptions:
        match: oauth2
  get-no-request-body:
    description: GET operations must not have a request body
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not have a request body
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  post-has-request-body:
    description: POST operations creating resources should have a request body
    severity: info
    given: $.paths[*].post
    then:
      field: requestBody
      function: truthy
  actions-paths-pattern:
    description: Action endpoints should follow /resources/{id}/actions/{action-name} pattern
    severity: info
    given: $.paths[*~\/actions\/]~
    then:
      function: pattern
      functionOptions:
        match: \/actions\/
  hal-json-content-type:
    description: Acquia Cloud API responses use application/hal+json content type
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses[*].content
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - application/hal+json
          - required:
            - application/json
  no-empty-descriptions:
    description: Descriptions must not be empty strings
    severity: warn
    given: $..description
    then:
      function: pattern
      functionOptions:
        match: .+
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  operationid-casing:
    description: Operation IDs should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][A-Za-z0-9]*$
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (Acquia_Cloud_API_Documentation_Error) should be defined for error
      payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Acquia_Cloud_API_Documentation_Error
      function: truthy
  operation-documents-404:
    description: Operations should document a 404 response (documented on 95% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '404'
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/acquia-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.