AT&T · API Governance Rules

AT&T API Rules

Spectral linting rules defining API design standards and conventions for AT&T.

43 Rules error 16 warn 23 info 4
Authorship not recorded No authorship marker is recorded for this file. It is not presented as the provider's; it was most likely written by an API Evangelist pass before outputs were stamped.
View Rules File View on GitHub

Rule Categories

camara delete error get info microcks no openapi operation parameter paths post request response schema security servers tags

Rules

warn
info-title-pattern
API title must start with "AT&T"
$.info.title
error
info-description-required
API info must have a non-empty description
$.info
error
info-version-required
API info must have a version
$.info
warn
info-contact-required
API info should have contact information
$.info
warn
info-terms-of-service
API info should include a termsOfService URL
$.info
error
openapi-version
Must use OpenAPI 3.0.x
$.openapi
error
servers-required
At least one server must be defined
$
error
servers-https-only
All server URLs must use HTTPS
$.servers[*].url
warn
servers-description-required
Each server should have a description
$.servers[*]
warn
paths-kebab-case
Path segments must use kebab-case (lowercase with hyphens)
$.paths
warn
paths-no-trailing-slash
Paths must not end with a trailing slash
$.paths
error
operation-summary-required
Every operation must have a summary
$.paths[*][get,post,put,patch,delete,head,options]
warn
operation-summary-att-prefix
Operation summaries must start with "AT&T"
$.paths[*][get,post,put,patch,delete].summary
error
operation-description-required
Every operation must have a description
$.paths[*][get,post,put,patch,delete,head,options]
error
operation-operationid-required
Every operation must have an operationId
$.paths[*][get,post,put,patch,delete,head,options]
warn
operation-operationid-camel-case
operationId must use camelCase
$.paths[*][get,post,put,patch,delete].operationId
error
operation-tags-required
Every operation must have at least one tag
$.paths[*][get,post,put,patch,delete,head,options]
warn
tags-global-defined
Global tags array should be defined
$
error
parameter-description-required
Every parameter must have a description
$.paths[*][*].parameters[*]
error
parameter-schema-required
Every parameter must have a schema
$.paths[*][*].parameters[*]
warn
request-body-description
Request bodies should have a description
$.paths[*][post,put,patch].requestBody
warn
request-body-json-content
Request bodies should support application/json
$.paths[*][post,put,patch].requestBody.content
error
response-success-required
Every operation must have at least one 2xx response
$.paths[*][get,post,put,patch,delete]
error
response-description-required
Every response must have a description
$.paths[*][*].responses[*]
warn
response-401-required
Operations using security should have a 401 response
$.paths[*][get,post,put,patch,delete][?(@.security)]
warn
response-400-for-post
POST operations should document a 400 Bad Request response
$.paths[*].post
warn
schema-description-required
Top-level component schemas should have descriptions
$.components.schemas[*]
warn
schema-properties-types
Schema properties should have a type defined
$.components.schemas[*].properties[*]
error
security-schemes-defined
Security schemes must be defined in components
$.components
warn
security-oauth2-scopes
OAuth2 security schemes must define scopes
$.components.securitySchemes[?(@.type == 'oauth2')].flows[*]
error
get-no-request-body
GET operations must not have a request body
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have a request body
$.paths[*].delete
warn
post-has-request-body
POST operations should have a request body
$.paths[*].post
error
no-empty-descriptions
Descriptions must not be empty strings
$..description
info
operation-examples-encouraged
Operations should include request/response examples for Microcks compatibility
$.paths[*][get,post,put,patch,delete].responses[*].content[*]
info
microcks-operation-extension
Operations should include x-microcks-operation extension for mock server support
$.paths[*][get,post,put,patch,delete]
warn
servers-expected-domain
Server URLs should be on the att.com domain.
$.servers[*].url
warn
error-schema-defined
A shared error schema (ErrorResponse) should be defined for error payloads.
$.components.schemas
warn
operation-documents-401
Operations should document a 401 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
camara-error-schema
API should define an ErrorInfo schema in components for CAMARA compliance
$.components.schemas
info
camara-phone-number-e164
Phone number parameters should document E.164 format requirement
$.components.schemas[*].properties.phoneNumber
info
response-429-defined
Operations should document 429 Too Many Requests responses for rate limiting
$.paths[*][post]
warn
operation-security-required
Every operation should declare its security requirements.
$.paths[*][get,post,put,patch,delete]

Spectral Ruleset

Raw ↑ 
# AT&T — Spectral ruleset (merged)
# Merged 2026-07-25 from the at-and-t, atandt and at-t-developer-hub rulesets when those
# four AT&T provider repos were consolidated into one.
#   - base: at-and-t (richest, generically-named ruleset)
#   - added from at-t-developer-hub: camara-error-schema, camara-phone-number-e164, response-429-defined, operation-security-required
#   - dropped: the atandt-* prefixed rules (slug-namespaced duplicates of the same checks)
#   - dropped: the measured casing rules (schema-properties-casing, path-params-casing,
#     query-params-casing, schema-names-casing, operationid-casing, parameter-snake-case) —
#     each was measured against one repo's spec population and the three disagreed.
#     Re-run the ruleset strengthener against the merged corpus to re-measure them.
extends:
- spectral:oas
rules:
  info-title-pattern:
    description: API title must start with "AT&T"
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: '^AT&T '
  info-description-required:
    description: API info must have a non-empty description
    severity: error
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: API info must have a version
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: API info should have contact information
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  info-terms-of-service:
    description: API info should include a termsOfService URL
    severity: warn
    given: $.info
    then:
      field: termsOfService
      function: truthy
  openapi-version:
    description: Must use OpenAPI 3.0.x
    severity: error
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.0\.
  servers-required:
    description: At least one server must be defined
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https-only:
    description: All server URLs must use HTTPS
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-description-required:
    description: Each server should have a description
    severity: warn
    given: $.servers[*]
    then:
      field: description
      function: truthy
  paths-kebab-case:
    description: Path segments must use kebab-case (lowercase with hyphens)
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        match: ^(\/[a-z0-9{}\-]+)+$
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        notMatch: \/$
  operation-summary-required:
    description: Every operation must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete,head,options]
    then:
      field: summary
      function: truthy
  operation-summary-att-prefix:
    description: Operation summaries must start with "AT&T"
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^AT&T '
  operation-description-required:
    description: Every operation must have a description
    severity: error
    given: $.paths[*][get,post,put,patch,delete,head,options]
    then:
      field: description
      function: truthy
  operation-operationid-required:
    description: Every operation must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete,head,options]
    then:
      field: operationId
      function: truthy
  operation-operationid-camel-case:
    description: operationId must use camelCase
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]+$
  operation-tags-required:
    description: Every operation must have at least one tag
    severity: error
    given: $.paths[*][get,post,put,patch,delete,head,options]
    then:
      field: tags
      function: truthy
  tags-global-defined:
    description: Global tags array should be defined
    severity: warn
    given: $
    then:
      field: tags
      function: truthy
  parameter-description-required:
    description: Every parameter must have a description
    severity: error
    given: $.paths[*][*].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: Every parameter must have a schema
    severity: error
    given: $.paths[*][*].parameters[*]
    then:
      field: schema
      function: truthy
  request-body-description:
    description: Request bodies should have a description
    severity: warn
    given: $.paths[*][post,put,patch].requestBody
    then:
      field: description
      function: truthy
  request-body-json-content:
    description: Request bodies should support application/json
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      function: truthy
  response-success-required:
    description: Every operation must have at least one 2xx response
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: responses
      function: truthy
  response-description-required:
    description: Every response must have a description
    severity: error
    given: $.paths[*][*].responses[*]
    then:
      field: description
      function: truthy
  response-401-required:
    description: Operations using security should have a 401 response
    severity: warn
    given: $.paths[*][get,post,put,patch,delete][?(@.security)]
    then:
      field: responses.401
      function: truthy
  response-400-for-post:
    description: POST operations should document a 400 Bad Request response
    severity: warn
    given: $.paths[*].post
    then:
      field: responses.400
      function: truthy
  schema-description-required:
    description: Top-level component schemas should have descriptions
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schema-properties-types:
    description: Schema properties should have a type defined
    severity: warn
    given: $.components.schemas[*].properties[*]
    then:
      field: type
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components
    severity: error
    given: $.components
    then:
      field: securitySchemes
      function: truthy
  security-oauth2-scopes:
    description: OAuth2 security schemes must define scopes
    severity: warn
    given: $.components.securitySchemes[?(@.type == 'oauth2')].flows[*]
    then:
      field: scopes
      function: truthy
  get-no-request-body:
    description: GET operations must not have a request body
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not have a request body
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  post-has-request-body:
    description: POST operations should have a request body
    severity: warn
    given: $.paths[*].post
    then:
      field: requestBody
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings
    severity: error
    given: $..description
    then:
      function: pattern
      functionOptions:
        match: .+
  operation-examples-encouraged:
    description: Operations should include request/response examples for Microcks compatibility
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses[*].content[*]
    then:
      field: examples
      function: truthy
  microcks-operation-extension:
    description: Operations should include x-microcks-operation extension for mock server support
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  servers-expected-domain:
    description: Server URLs should be on the att.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: att\.com
  error-schema-defined:
    description: A shared error schema (ErrorResponse) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: ErrorResponse
      function: truthy
  operation-documents-401:
    description: Operations should document a 401 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  camara-error-schema:
    description: API should define an ErrorInfo schema in components for CAMARA compliance
    severity: warn
    given: $.components.schemas
    then:
      field: ErrorInfo
      function: truthy
  camara-phone-number-e164:
    description: Phone number parameters should document E.164 format requirement
    severity: info
    given: $.components.schemas[*].properties.phoneNumber
    then:
      field: description
      function: truthy
  response-429-defined:
    description: Operations should document 429 Too Many Requests responses for rate limiting
    severity: info
    given: $.paths[*][post]
    then:
      field: responses.429
      function: truthy
  operation-security-required:
    description: Every operation should declare its security requirements.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: security
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/att-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.