Ariba Guided Buying · API Governance Rules

Ariba Guided Buying API Rules

Spectral linting rules defining API design standards and conventions for Ariba Guided Buying.

39 Rules error 16 warn 19 info 4
Generated by API Evangelist Written by API Evangelist tooling for Ariba Guided Buying's APIs. It is a starting point, not a ruleset Ariba Guided Buying publishes or enforces.
View Rules File View on GitHub

Rule Categories

delete error get info microcks no openapi operation parameter path paths request response schema security servers

Rules

error
info-title-required
API title must be defined and follow the "Ariba Guided Buying - {API Name}" pattern.
$.info
warn
info-title-prefix
API title should start with "Ariba Guided Buying".
$.info.title
error
info-description-required
API info must have a description.
$.info
error
info-version-required
API version must be defined.
$.info
warn
info-contact-required
API info should include contact information.
$.info
error
openapi-version-3
APIs must use OpenAPI 3.0.x.
$
error
servers-required
Servers must be defined.
$
error
servers-https-only
All server URLs must use HTTPS.
$.servers[*].url
warn
servers-openapi-ariba-host
Production server should use openapi.ariba.com host.
$.servers[*].url
warn
paths-kebab-case
Path segments must use kebab-case.
$.paths[*]~
warn
paths-no-trailing-slash
Paths must not have a trailing slash.
$.paths[*]~
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-prefix
Operation summaries should start with "Ariba Guided Buying".
$.paths[*][get,post,put,patch,delete].summary
error
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
error
operation-id-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-id-camel-case
operationId should use camelCase.
$.paths[*][get,post,put,patch,delete].operationId
error
operation-tags-required
Every operation must have at least one tag.
$.paths[*][get,post,put,patch,delete]
error
parameter-description-required
All parameters must have a description.
$.paths[*][get,post,put,patch,delete].parameters[*]
error
parameter-schema-required
All parameters must have a schema.
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameter-realm-naming
Realm parameter should be named "realm" (SAP Ariba convention).
$.paths[*][get,post,put,patch,delete].parameters[*]
warn
request-body-description-required
Request bodies should have a description.
$.paths[*][post,put,patch].requestBody
warn
request-body-json-content
Request bodies should define application/json content.
$.paths[*][post,put,patch].requestBody.content
error
response-success-required
Every operation must have a 200 or 201 success response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-400-recommended
Operations should define a 400 Bad Request response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-401-recommended
Operations should define a 401 Unauthorized response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-500-recommended
Operations should define a 500 Internal Server Error response.
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
All responses must have a description.
$.paths[*][get,post,put,patch,delete].responses[*]
info
schema-property-description-recommended
Schema properties should have descriptions.
$.components.schemas[*].properties[*]
warn
schema-type-defined
Component schemas should define a type.
$.components.schemas[*]
error
security-schemes-defined
Security schemes must be defined in components.
$.components.securitySchemes
warn
security-oauth2-ariba
SAP Ariba APIs should use OAuth 2.0 with api.ariba.com token URL.
$.components.securitySchemes.OAuth2.flows.clientCredentials.tokenUrl
error
get-no-request-body
GET operations must not have a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have a request body.
$.paths[*].delete
info
microcks-operation-extension
Operations should include x-microcks-operation for mock server configuration.
$.paths[*][get,post,put,patch,delete]
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (ErrorResponse) should be defined for error payloads.
$.components.schemas
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# ariba-guided-buying — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 4/4 servers on ariba.com
#   - path-params-casing: camel @ 100% (n=3)
#   - operationid-casing: camel @ 100% (n=6)
#   - schema-names-casing: pascal @ 100% (n=15)
#   - schema-properties-casing: snake @ 62% (n=42)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: ErrorResponse
#   - operation-documents-400: 100% adherence
#   - operation-documents-500: 100% adherence
#   - merge: kept 34 existing, added 5 measured, upgraded 0
#   - added: path-params-casing, schema-names-casing, schema-properties-casing, error-schema-defined, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-required:
    description: API title must be defined and follow the "Ariba Guided Buying - {API Name}" pattern.
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-title-prefix:
    description: API title should start with "Ariba Guided Buying".
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Ariba Guided Buying
  info-description-required:
    description: API info must have a description.
    severity: error
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: API version must be defined.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: API info should include contact information.
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  openapi-version-3:
    description: APIs must use OpenAPI 3.0.x.
    severity: error
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.0\.
  servers-required:
    description: Servers must be defined.
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https-only:
    description: All server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-openapi-ariba-host:
    description: Production server should use openapi.ariba.com host.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: openapi\.ariba\.com
  paths-kebab-case:
    description: Path segments must use kebab-case.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(\/[a-zA-Z0-9{}\$._-]+)+$
  paths-no-trailing-slash:
    description: Paths must not have a trailing slash.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \/$
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-prefix:
    description: Operation summaries should start with "Ariba Guided Buying".
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: ^Ariba Guided Buying
  operation-description-required:
    description: Every operation must have a description.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-id-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-id-camel-case:
    description: operationId should use camelCase.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-tags-required:
    description: Every operation must have at least one tag.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  parameter-description-required:
    description: All parameters must have a description.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: All parameters must have a schema.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: schema
      function: truthy
  parameter-realm-naming:
    description: Realm parameter should be named "realm" (SAP Ariba convention).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      function: pattern
      functionOptions:
        match: ^(realm|\$filter|\$count|\$skip|\$select|\$expand|\$search|shopID|entity_id|entity_type)$
  request-body-description-required:
    description: Request bodies should have a description.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody
    then:
      field: description
      function: truthy
  request-body-json-content:
    description: Request bodies should define application/json content.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-success-required:
    description: Every operation must have a 200 or 201 success response.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '204'
  response-400-recommended:
    description: Operations should define a 400 Bad Request response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '400'
      function: truthy
  response-401-recommended:
    description: Operations should define a 401 Unauthorized response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  response-500-recommended:
    description: Operations should define a 500 Internal Server Error response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '500'
      function: truthy
  response-description-required:
    description: All responses must have a description.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  schema-property-description-recommended:
    description: Schema properties should have descriptions.
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: description
      function: truthy
  schema-type-defined:
    description: Component schemas should define a type.
    severity: warn
    given: $.components.schemas[*]
    then:
      field: type
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components.
    severity: error
    given: $.components.securitySchemes
    then:
      function: truthy
  security-oauth2-ariba:
    description: SAP Ariba APIs should use OAuth 2.0 with api.ariba.com token URL.
    severity: warn
    given: $.components.securitySchemes.OAuth2.flows.clientCredentials.tokenUrl
    then:
      function: pattern
      functionOptions:
        match: api\.ariba\.com
  get-no-request-body:
    description: GET operations must not have a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not have a request body.
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  microcks-operation-extension:
    description: Operations should include x-microcks-operation for mock server configuration.
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][A-Za-z0-9]*$
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (ErrorResponse) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: ErrorResponse
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/ariba-guided-buying-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.