Adyen · API Governance Rules

Adyen API Rules

Spectral linting rules defining API design standards and conventions for Adyen.

32 Rules error 12 warn 14 info 6
Authorship not recorded No authorship marker is recorded for this file. It is not presented as the provider's; it was most likely written by an API Evangelist pass before outputs were stamped.
View Rules File View on GitHub

Rule Categories

delete get info microcks no openapi operation parameter paths request response schema security servers

Rules

error
info-title-required
API info must have a title.
$.info
warn
info-description-required
API info must have a description.
$.info
error
info-version-required
API info must have a version.
$.info
warn
openapi-version-3
APIs should use OpenAPI 3.x specification.
$
error
servers-defined
At least one server must be defined.
$
error
servers-https-only
All server URLs must use HTTPS.
$.servers[*]
info
servers-description-required
Each server should have a description.
$.servers[*]
warn
paths-no-trailing-slash
Path must not have a trailing slash.
$.paths[*]~
error
paths-no-query-string
Path must not contain a query string.
$.paths[*]~
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete,head,options]
warn
operation-summary-adyen-prefix
Operation summaries should start with "Adyen".
$.paths[*][get,post,put,patch,delete,head,options].summary
warn
operation-description-required
Every operation should have a description.
$.paths[*][get,post,put,patch,delete,head,options]
error
operation-id-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete,head,options]
warn
operation-id-camel-case
operationId should use camelCase.
$.paths[*][get,post,put,patch,delete,head,options].operationId
warn
operation-tags-required
Every operation must have at least one tag.
$.paths[*][get,post,put,patch,delete,head,options]
warn
parameter-description-required
Every parameter must have a description.
$.paths[*][get,post,put,patch,delete,head,options].parameters[*]
error
parameter-schema-required
Every parameter must have a schema.
$.paths[*][get,post,put,patch,delete,head,options].parameters[*]
warn
parameter-api-key-in-header
API keys should be passed in headers, not query parameters.
$.components.securitySchemes[?(@.type=='apiKey')]
info
request-body-description
Request body should have a description.
$.paths[*][post,put,patch].requestBody
warn
request-body-content-json
Request body should support application/json content type.
$.paths[*][post,put,patch].requestBody.content
error
response-success-required
Every operation must have at least one 2xx response.
$.paths[*][get,post,put,patch,delete]
error
response-description-required
Every response must have a description.
$.paths[*][get,post,put,patch,delete].responses[*]
info
response-401-defined
Operations with authentication should define a 401 response.
$.paths[*][get,post,put,patch,delete].responses
info
schema-description-required
Top-level schemas should have a description.
$.components.schemas[*]
warn
schema-type-defined
Schema properties should define a type.
$.components.schemas[*].properties[*]
error
security-schemes-defined
Security schemes must be defined in components.
$.components
info
security-scheme-description
Security schemes should have a description.
$.components.securitySchemes[*]
warn
security-api-key-header-name
Adyen API key header should be named X-API-Key.
$.components.securitySchemes[?(@.type=='apiKey')]
error
get-no-request-body
GET operations must not have a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have a request body.
$.paths[*].delete
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..[description]
info
microcks-operation-present
Each operation should have x-microcks-operation for mock server support.
$.paths[*][get,post,put,patch,delete]

Spectral Ruleset

Raw ↑ 
rules:

  # INFO / METADATA
  info-title-required:
    description: API info must have a title.
    severity: error
    given: "$.info"
    then:
      field: title
      function: truthy

  info-description-required:
    description: API info must have a description.
    severity: warn
    given: "$.info"
    then:
      field: description
      function: truthy

  info-version-required:
    description: API info must have a version.
    severity: error
    given: "$.info"
    then:
      field: version
      function: truthy

  # OPENAPI VERSION
  openapi-version-3:
    description: APIs should use OpenAPI 3.x specification.
    severity: warn
    given: "$"
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: "^3\\."

  # SERVERS
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: "$"
    then:
      field: servers
      function: truthy

  servers-https-only:
    description: All server URLs must use HTTPS.
    severity: error
    given: "$.servers[*]"
    then:
      field: url
      function: pattern
      functionOptions:
        match: "^https://"

  servers-description-required:
    description: Each server should have a description.
    severity: info
    given: "$.servers[*]"
    then:
      field: description
      function: truthy

  # PATHS — NAMING CONVENTIONS
  paths-no-trailing-slash:
    description: Path must not have a trailing slash.
    severity: warn
    given: "$.paths[*]~"
    then:
      function: pattern
      functionOptions:
        notMatch: "/$"

  paths-no-query-string:
    description: Path must not contain a query string.
    severity: error
    given: "$.paths[*]~"
    then:
      function: pattern
      functionOptions:
        notMatch: "\\?"

  # OPERATIONS
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: "$.paths[*][get,post,put,patch,delete,head,options]"
    then:
      field: summary
      function: truthy

  operation-summary-adyen-prefix:
    description: Operation summaries should start with "Adyen".
    severity: warn
    given: "$.paths[*][get,post,put,patch,delete,head,options].summary"
    then:
      function: pattern
      functionOptions:
        match: "^Adyen "

  operation-description-required:
    description: Every operation should have a description.
    severity: warn
    given: "$.paths[*][get,post,put,patch,delete,head,options]"
    then:
      field: description
      function: truthy

  operation-id-required:
    description: Every operation must have an operationId.
    severity: error
    given: "$.paths[*][get,post,put,patch,delete,head,options]"
    then:
      field: operationId
      function: truthy

  operation-id-camel-case:
    description: operationId should use camelCase.
    severity: warn
    given: "$.paths[*][get,post,put,patch,delete,head,options].operationId"
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  operation-tags-required:
    description: Every operation must have at least one tag.
    severity: warn
    given: "$.paths[*][get,post,put,patch,delete,head,options]"
    then:
      field: tags
      function: truthy

  # PARAMETERS
  parameter-description-required:
    description: Every parameter must have a description.
    severity: warn
    given: "$.paths[*][get,post,put,patch,delete,head,options].parameters[*]"
    then:
      field: description
      function: truthy

  parameter-schema-required:
    description: Every parameter must have a schema.
    severity: error
    given: "$.paths[*][get,post,put,patch,delete,head,options].parameters[*]"
    then:
      field: schema
      function: truthy

  parameter-api-key-in-header:
    description: API keys should be passed in headers, not query parameters.
    severity: warn
    given: "$.components.securitySchemes[?(@.type=='apiKey')]"
    then:
      field: in
      function: enumeration
      functionOptions:
        values:
          - header

  # REQUEST BODIES
  request-body-description:
    description: Request body should have a description.
    severity: info
    given: "$.paths[*][post,put,patch].requestBody"
    then:
      field: description
      function: truthy

  request-body-content-json:
    description: Request body should support application/json content type.
    severity: warn
    given: "$.paths[*][post,put,patch].requestBody.content"
    then:
      function: truthy

  # RESPONSES
  response-success-required:
    description: Every operation must have at least one 2xx response.
    severity: error
    given: "$.paths[*][get,post,put,patch,delete]"
    then:
      field: responses
      function: truthy

  response-description-required:
    description: Every response must have a description.
    severity: error
    given: "$.paths[*][get,post,put,patch,delete].responses[*]"
    then:
      field: description
      function: truthy

  response-401-defined:
    description: Operations with authentication should define a 401 response.
    severity: info
    given: "$.paths[*][get,post,put,patch,delete].responses"
    then:
      function: truthy

  # SCHEMAS — PROPERTY NAMING
  schema-description-required:
    description: Top-level schemas should have a description.
    severity: info
    given: "$.components.schemas[*]"
    then:
      field: description
      function: truthy

  schema-type-defined:
    description: Schema properties should define a type.
    severity: warn
    given: "$.components.schemas[*].properties[*]"
    then:
      field: type
      function: truthy

  # SECURITY
  security-schemes-defined:
    description: Security schemes must be defined in components.
    severity: error
    given: "$.components"
    then:
      field: securitySchemes
      function: truthy

  security-scheme-description:
    description: Security schemes should have a description.
    severity: info
    given: "$.components.securitySchemes[*]"
    then:
      field: description
      function: truthy

  security-api-key-header-name:
    description: Adyen API key header should be named X-API-Key.
    severity: warn
    given: "$.components.securitySchemes[?(@.type=='apiKey')]"
    then:
      field: name
      function: enumeration
      functionOptions:
        values:
          - X-API-Key

  # HTTP METHOD CONVENTIONS
  get-no-request-body:
    description: GET operations must not have a request body.
    severity: error
    given: "$.paths[*].get"
    then:
      field: requestBody
      function: falsy

  delete-no-request-body:
    description: DELETE operations should not have a request body.
    severity: warn
    given: "$.paths[*].delete"
    then:
      field: requestBody
      function: falsy

  # GENERAL QUALITY
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: "$..[description]"
    then:
      function: pattern
      functionOptions:
        match: ".+"

  microcks-operation-present:
    description: Each operation should have x-microcks-operation for mock server support.
    severity: info
    given: "$.paths[*][get,post,put,patch,delete]"
    then:
      field: x-microcks-operation
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/adyen-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.