Apidog · API Governance Rules

Apidog API Rules

Spectral linting rules defining API design standards and conventions for Apidog.

20 Rules error 8 warn 12
Authorship not recorded No authorship marker is recorded for this file. It is not presented as the provider's; it was most likely written by an API Evangelist pass before outputs were stamped.
View Rules File View on GitHub

Rule Categories

info openapi operation parameter paths post response security servers tag

Rules

warn
info-title-prefix
API title must start with 'Apidog'.
$.info
error
info-description-required
API must have a description.
$.info
error
info-version-required
API must have a version.
$.info
warn
openapi-version-3
Specs must use OpenAPI 3.x.
$
error
servers-defined
Servers must be defined.
$
error
servers-https
All server URLs must use HTTPS.
$.servers[*]
warn
paths-kebab-case
Path segments must use kebab-case.
$.paths
warn
paths-no-trailing-slash
Paths must not have a trailing slash.
$.paths
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-title-case
Operation summaries should start with an uppercase letter (Title Case).
$.paths[*][get,post,put,patch,delete]
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
error
operation-id-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-id-camelcase
OperationId must use camelCase.
$.paths[*][get,post,put,patch,delete]
warn
operation-tags-required
Every operation must have at least one tag.
$.paths[*][get,post,put,patch,delete]
warn
tag-description-required
All tags must have a description.
$.tags[*]
warn
parameter-description-required
All parameters must have a description.
$.paths[*][get,post,put,patch,delete].parameters[*]
error
response-success-required
Every operation must have a 2xx response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-401-required
Protected operations should have a 401 response.
$.paths[*][post,put,patch,delete].responses
error
security-scheme-defined
Security schemes must be defined in components.
$.components.securitySchemes
warn
post-has-request-body
POST operations should have a request body.
$.paths[*].post

Spectral Ruleset

Raw ↑ 
extends: spectral:oas
rules:
  # INFO / METADATA
  info-title-prefix:
    description: API title must start with 'Apidog'.
    severity: warn
    given: '$.info'
    then:
      field: title
      function: pattern
      functionOptions:
        match: '^Apidog'

  info-description-required:
    description: API must have a description.
    severity: error
    given: '$.info'
    then:
      field: description
      function: truthy

  info-version-required:
    description: API must have a version.
    severity: error
    given: '$.info'
    then:
      field: version
      function: truthy

  # OPENAPI VERSION
  openapi-version-3:
    description: Specs must use OpenAPI 3.x.
    severity: warn
    given: '$'
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: '^3\.'

  # SERVERS
  servers-defined:
    description: Servers must be defined.
    severity: error
    given: '$'
    then:
      field: servers
      function: truthy

  servers-https:
    description: All server URLs must use HTTPS.
    severity: error
    given: '$.servers[*]'
    then:
      field: url
      function: pattern
      functionOptions:
        match: '^https://'

  # PATHS — NAMING CONVENTIONS
  paths-kebab-case:
    description: Path segments must use kebab-case.
    severity: warn
    given: '$.paths'
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: '^(/[a-z0-9{}-]+)+$'

  paths-no-trailing-slash:
    description: Paths must not have a trailing slash.
    severity: warn
    given: '$.paths'
    then:
      field: '@key'
      function: pattern
      functionOptions:
        notMatch: '/$'

  # OPERATIONS
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: summary
      function: truthy

  operation-summary-title-case:
    description: Operation summaries should start with an uppercase letter (Title Case).
    severity: warn
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: summary
      function: pattern
      functionOptions:
        match: '^[A-Z]'

  operation-description-required:
    description: Every operation must have a description.
    severity: warn
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: description
      function: truthy

  operation-id-required:
    description: Every operation must have an operationId.
    severity: error
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: operationId
      function: truthy

  operation-id-camelcase:
    description: OperationId must use camelCase.
    severity: warn
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: operationId
      function: pattern
      functionOptions:
        match: '^[a-z][a-zA-Z0-9]*$'

  operation-tags-required:
    description: Every operation must have at least one tag.
    severity: warn
    given: '$.paths[*][get,post,put,patch,delete]'
    then:
      field: tags
      function: truthy

  # TAGS
  tag-description-required:
    description: All tags must have a description.
    severity: warn
    given: '$.tags[*]'
    then:
      field: description
      function: truthy

  # PARAMETERS
  parameter-description-required:
    description: All parameters must have a description.
    severity: warn
    given: '$.paths[*][get,post,put,patch,delete].parameters[*]'
    then:
      field: description
      function: truthy

  # RESPONSES
  response-success-required:
    description: Every operation must have a 2xx response.
    severity: error
    given: '$.paths[*][get,post,put,patch,delete].responses'
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
            - required: ['200']
            - required: ['201']
            - required: ['204']

  response-401-required:
    description: Protected operations should have a 401 response.
    severity: warn
    given: '$.paths[*][post,put,patch,delete].responses'
    then:
      function: schema
      functionOptions:
        schema:
          required: ['401']

  # SECURITY
  security-scheme-defined:
    description: Security schemes must be defined in components.
    severity: error
    given: '$.components.securitySchemes'
    then:
      function: truthy

  # HTTP METHOD CONVENTIONS
  post-has-request-body:
    description: POST operations should have a request body.
    severity: warn
    given: '$.paths[*].post'
    then:
      field: requestBody
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/apidog-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.