Apache OFBiz · API Governance Rules

Apache OFBiz API Rules

Spectral linting rules defining API design standards and conventions for Apache OFBiz.

36 Rules error 12 warn 19 info 5
Generated by API Evangelist Written by API Evangelist tooling for Apache OFBiz's APIs. It is a starting point, not a ruleset Apache OFBiz publishes or enforces.
View Rules File View on GitHub

Rule Categories

auth error get info no openapi operation parameter request response schema security servers tags

Rules

error
info-title-required
OpenAPI info must have a title.
$.info
warn
info-description-required
OpenAPI info must have a description.
$.info
error
info-version-required
OpenAPI info must define a version.
$.info
warn
info-contact-required
OpenAPI info should include contact information.
$.info
warn
info-license-required
OpenAPI info should include license information.
$.info
error
openapi-version-3
Specs must use OpenAPI 3.x.
$
error
servers-defined
At least one server must be defined.
$
warn
servers-https
Server URLs should use HTTPS.
$.servers[*].url
warn
servers-description
Each server should have a description.
$.servers[*]
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-description-required
Every operation should have a description.
$.paths[*][get,post,put,patch,delete]
error
operation-operationid-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-operationid-camel-case
operationId should use camelCase.
$.paths[*][get,post,put,patch,delete].operationId
error
operation-tags-required
Every operation must have at least one tag.
$.paths[*][get,post,put,patch,delete]
info
operation-summary-apache-ofbiz-prefix
Operation summaries should start with "Apache OFBiz".
$.paths[*][get,post,put,patch,delete].summary
warn
tags-global-defined
Global tags array should be defined.
$
warn
tags-description
Each global tag should have a description.
$.tags[*]
warn
parameter-description-required
Every parameter must have a description.
$.paths[*][get,post,put,patch,delete].parameters[*]
error
parameter-schema-required
Every parameter must have a schema.
$.paths[*][get,post,put,patch,delete].parameters[*]
warn
request-body-description
Request bodies should have a description.
$.paths[*][post,put,patch].requestBody
error
response-success-required
Every operation must define at least one 2xx response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-401-required
Secured operations should document 401 Unauthorized response.
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
Every response must have a description.
$.paths[*][get,post,put,patch,delete].responses[*]
warn
schema-description-required
Top-level component schemas should have a description.
$.components.schemas[*]
info
schema-property-description
Schema properties should have descriptions.
$.components.schemas[*].properties[*]
error
security-schemes-defined
Security schemes must be defined in components.
$.components
warn
security-global-defined
Global security requirements should be defined.
$
error
get-no-request-body
GET operations must not have a request body.
$.paths[*].get
info
auth-bearer-jwt
Bearer authentication should specify JWT format.
$.components.securitySchemes[?(@.scheme == 'bearer')]
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description
info
response-status-code-standard
OFBiz API responses should include statusCode, statusDescription, and data fields.
$.components.schemas[*].properties
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (ErrorResponse) should be defined for error payloads.
$.components.schemas
warn
operation-documents-401
Operations should document a 401 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
operation-documents-500
Operations should document a 500 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# apache-ofbiz — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - operationid-casing: camel @ 100% (n=5)
#   - schema-names-casing: pascal @ 100% (n=8)
#   - schema-properties-casing: snake @ 54% (n=26)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: ErrorResponse
#   - operation-documents-401: 100% adherence
#   - operation-documents-500: 100% adherence
#   - merge: kept 31 existing, added 5 measured, upgraded 0
#   - added: schema-names-casing, schema-properties-casing, error-schema-defined, operation-documents-401, operation-documents-500
extends:
  - spectral:oas
rules:
  info-title-required:
    description: OpenAPI info must have a title.
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-description-required:
    description: OpenAPI info must have a description.
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: OpenAPI info must define a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: OpenAPI info should include contact information.
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  info-license-required:
    description: OpenAPI info should include license information.
    severity: warn
    given: $.info
    then:
      field: license
      function: truthy
  openapi-version-3:
    description: Specs must use OpenAPI 3.x.
    severity: error
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs should use HTTPS.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-description:
    description: Each server should have a description.
    severity: warn
    given: $.servers[*]
    then:
      field: description
      function: truthy
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-description-required:
    description: Every operation should have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-operationid-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-operationid-camel-case:
    description: operationId should use camelCase.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-tags-required:
    description: Every operation must have at least one tag.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-summary-apache-ofbiz-prefix:
    description: Operation summaries should start with "Apache OFBiz".
    severity: info
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^Apache OFBiz '
  tags-global-defined:
    description: Global tags array should be defined.
    severity: warn
    given: $
    then:
      field: tags
      function: truthy
  tags-description:
    description: Each global tag should have a description.
    severity: warn
    given: $.tags[*]
    then:
      field: description
      function: truthy
  parameter-description-required:
    description: Every parameter must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: Every parameter must have a schema.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: schema
      function: truthy
  request-body-description:
    description: Request bodies should have a description.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody
    then:
      field: description
      function: truthy
  response-success-required:
    description: Every operation must define at least one 2xx response.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '204'
  response-401-required:
    description: Secured operations should document 401 Unauthorized response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '401'
  response-description-required:
    description: Every response must have a description.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  schema-description-required:
    description: Top-level component schemas should have a description.
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schema-property-description:
    description: Schema properties should have descriptions.
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: description
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components.
    severity: error
    given: $.components
    then:
      field: securitySchemes
      function: truthy
  security-global-defined:
    description: Global security requirements should be defined.
    severity: warn
    given: $
    then:
      field: security
      function: truthy
  get-no-request-body:
    description: GET operations must not have a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  auth-bearer-jwt:
    description: Bearer authentication should specify JWT format.
    severity: info
    given: $.components.securitySchemes[?(@.scheme == 'bearer')]
    then:
      field: bearerFormat
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: pattern
      functionOptions:
        match: .+
  response-status-code-standard:
    description: OFBiz API responses should include statusCode, statusDescription, and data fields.
    severity: info
    given: $.components.schemas[*].properties
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - statusCode
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (ErrorResponse) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: ErrorResponse
      function: truthy
  operation-documents-401:
    description: Operations should document a 401 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  operation-documents-500:
    description: Operations should document a 500 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '500'
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/apache-ofbiz-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.