# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# apache-apisix — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
# - servers-expected-domain: 2/2 servers on 0.1
# - path-params-casing: snake @ 100% (n=64)
# - operationid-casing: camel @ 100% (n=76)
# - schema-names-casing: pascal @ 94% (n=17)
# - schema-properties-casing: snake @ 98% (n=98)
# - security: global (root) — NOT emitting operation-security-required
# - merge: kept 19 existing, added 5 measured, upgraded 0
# - added: servers-expected-domain, path-params-casing, schema-names-casing, schema-properties-casing, no-empty-descriptions
extends:
- spectral:oas
rules:
info-title-prefix:
description: API title must start with "Apache APISIX"
severity: warn
given: $.info.title
then:
function: pattern
functionOptions:
match: ^Apache APISIX
info-description-required:
description: API must have a description.
severity: error
given: $.info
then:
field: description
function: truthy
info-version-required:
description: API must declare a version.
severity: error
given: $.info
then:
field: version
function: truthy
servers-defined:
description: At least one server must be defined.
severity: error
given: $
then:
field: servers
function: truthy
operation-summary-required:
description: Every operation must have a summary.
severity: error
given: $.paths[*][get,post,put,patch,delete]
then:
field: summary
function: truthy
operation-summary-starts-with-apache-apisix:
description: Operation summaries must start with "Apache APISIX".
severity: warn
given: $.paths[*][get,post,put,patch,delete].summary
then:
function: pattern
functionOptions:
match: ^Apache APISIX
operation-operationId-required:
description: Every operation must have an operationId.
severity: error
given: $.paths[*][get,post,put,patch,delete]
then:
field: operationId
function: truthy
operation-operationId-camelCase:
description: operationId must be camelCase.
severity: warn
given: $.paths[*][get,post,put,patch,delete].operationId
then:
function: pattern
functionOptions:
match: ^[a-z][a-zA-Z0-9]*$
operation-tags-required:
description: Every operation must have at least one tag.
severity: warn
given: $.paths[*][get,post,put,patch,delete]
then:
field: tags
function: truthy
operation-description-required:
description: Every operation should have a description.
severity: warn
given: $.paths[*][get,post,put,patch,delete]
then:
field: description
function: truthy
paths-kebab-case:
description: Path segments must use kebab-case or standard patterns.
severity: info
given: $.paths
then:
function: pattern
functionOptions:
match: ^(/[a-z0-9{}_\-*]+)+
parameter-description-required:
description: Every parameter must have a description.
severity: warn
given: $.paths[*][get,post,put,patch,delete].parameters[*]
then:
field: description
function: truthy
response-success-required:
description: Every operation must define at least one 2xx response.
severity: error
given: $.paths[*][get,post,put,patch,delete].responses
then:
function: schema
functionOptions:
schema:
anyOf:
- required:
- '200'
- required:
- '201'
- required:
- '204'
response-description-required:
description: Every response must have a description.
severity: error
given: $.paths[*][get,post,put,patch,delete].responses[*]
then:
field: description
function: truthy
security-schemes-defined:
description: Security schemes must be defined in components.
severity: warn
given: $.components
then:
field: securitySchemes
function: truthy
apikey-in-header:
description: API key authentication should use a header, not a query parameter.
severity: warn
given: $.components.securitySchemes[?(@.type=='apiKey')]
then:
field: in
function: enumeration
functionOptions:
values:
- header
get-no-request-body:
description: GET operations must not have a request body.
severity: error
given: $.paths[*].get
then:
field: requestBody
function: falsy
delete-returns-200-or-204:
description: DELETE operations should return 200 or 204.
severity: info
given: $.paths[*].delete.responses
then:
function: schema
functionOptions:
schema:
anyOf:
- required:
- '200'
- required:
- '204'
schema-type-defined:
description: Schema components must have a type defined.
severity: warn
given: $.components.schemas[*]
then:
field: type
function: truthy
servers-expected-domain:
description: Server URLs should be on the 0.1 domain.
severity: warn
given: $.servers[*].url
then:
function: pattern
functionOptions:
match: 0\.1
path-params-casing:
description: Path parameters should be snake_case (the dominant convention in this API).
severity: warn
given: $.paths[*].parameters[?(@.in=='path')].name
then:
function: casing
functionOptions:
type: snake
schema-names-casing:
description: Component schema names should be PascalCase (the dominant convention in this API).
severity: warn
given: $.components.schemas
then:
field: '@key'
function: pattern
functionOptions:
match: ^[A-Z][A-Za-z0-9]*$
schema-properties-casing:
description: Schema properties should be snake_case (the dominant convention in this API).
severity: warn
given: $.components.schemas[*].properties
then:
field: '@key'
function: casing
functionOptions:
type: snake
no-empty-descriptions:
description: Descriptions must not be empty strings.
severity: warn
given: $..description
then:
function: truthy