# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# avalara — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
# - servers-https-only: 95% of servers already https (warn)
# - path-params-casing: camel @ 67% (n=506)
# - operationid-casing: camel @ 98% (n=145)
# - schema-names-casing: pascal @ 95% (n=145)
# - schema-properties-casing: camel @ 53% (n=766)
# - security: global (root) — NOT emitting operation-security-required
# - error-schema-defined: ErrorResponse
# - pagination params observed: ['count', 'page', 'pageSize']
# - merge: kept 21 existing, added 5 measured, upgraded 0
# - added: path-params-casing, schema-names-casing, schema-properties-casing, security-schemes-defined, error-schema-defined
extends:
- spectral:oas
rules:
info-title-avalara-prefix:
description: API title should reference Avalara or a named product
severity: warn
given: $.info.title
then:
function: pattern
functionOptions:
match: ^(Avalara|AvaTax|CertCapture|MyLodgeTax|Communications)
info-description-required:
description: API info description must be present and non-empty
severity: error
given: $.info
then:
field: description
function: truthy
info-version-required:
description: API version must be present
severity: error
given: $.info
then:
field: version
function: truthy
info-contact-required:
description: API contact information should be provided
severity: warn
given: $.info
then:
field: contact
function: truthy
openapi-version-3x:
description: OpenAPI version must be 3.x
severity: error
given: $
then:
field: openapi
function: pattern
functionOptions:
match: ^3\.
servers-required:
description: At least one server must be defined
severity: error
given: $
then:
field: servers
function: truthy
servers-https-only:
description: All server URLs must use HTTPS
severity: error
given: $.servers[*].url
then:
function: pattern
functionOptions:
match: ^https://
paths-no-trailing-slash:
description: Paths should not have trailing slashes
severity: warn
given: $.paths[*]~
then:
function: pattern
functionOptions:
notMatch: /$
paths-no-query-strings:
description: Paths should not contain query strings
severity: error
given: $.paths[*]~
then:
function: pattern
functionOptions:
notMatch: \?
operation-summary-required:
description: Every operation must have a summary
severity: error
given: $.paths[*][get,post,put,patch,delete]
then:
field: summary
function: truthy
operation-summary-avalara-prefix:
description: Operation summaries should start with Avalara
severity: info
given: $.paths[*][get,post,put,patch,delete].summary
then:
function: pattern
functionOptions:
match: ^Avalara
operation-description-required:
description: Every operation must have a description
severity: warn
given: $.paths[*][get,post,put,patch,delete]
then:
field: description
function: truthy
operation-id-required:
description: Every operation must have an operationId
severity: error
given: $.paths[*][get,post,put,patch,delete]
then:
field: operationId
function: truthy
operation-id-camel-case:
description: operationId should use camelCase
severity: warn
given: $.paths[*][get,post,put,patch,delete].operationId
then:
function: pattern
functionOptions:
match: ^[a-z][a-zA-Z0-9]*$
operation-tags-required:
description: Every operation must have at least one tag
severity: warn
given: $.paths[*][get,post,put,patch,delete]
then:
field: tags
function: truthy
parameter-description-required:
description: All parameters must have a description
severity: warn
given: $.paths[*][get,post,put,patch,delete].parameters[*]
then:
field: description
function: truthy
request-body-json-content:
description: Request bodies should include application/json content type
severity: warn
given: $.paths[*][post,put,patch].requestBody.content
then:
field: application/json
function: truthy
response-description-required:
description: All responses must have a description
severity: error
given: $.paths[*][get,post,put,patch,delete].responses[*]
then:
field: description
function: truthy
schema-description-on-top-level:
description: Top-level schemas should have a description
severity: info
given: $.components.schemas[*]
then:
field: description
function: truthy
get-no-request-body:
description: GET operations must not have a request body
severity: error
given: $.paths[*].get
then:
field: requestBody
function: falsy
no-empty-descriptions:
description: Descriptions must not be empty strings
severity: warn
given: $..description
then:
function: pattern
functionOptions:
match: .+
path-params-casing:
description: Path parameters should be camelCase (the dominant convention in this API).
severity: warn
given: $.paths[*].parameters[?(@.in=='path')].name
then:
function: casing
functionOptions:
type: camel
schema-names-casing:
description: Component schema names should be PascalCase (the dominant convention in this API).
severity: warn
given: $.components.schemas
then:
field: '@key'
function: pattern
functionOptions:
match: ^[A-Z][A-Za-z0-9]*$
schema-properties-casing:
description: Schema properties should be camelCase (the dominant convention in this API).
severity: info
given: $.components.schemas[*].properties
then:
field: '@key'
function: pattern
functionOptions:
match: ^[a-z][A-Za-z0-9]*$
security-schemes-defined:
description: Security schemes should be defined in components.
severity: warn
given: $.components
then:
field: securitySchemes
function: truthy
error-schema-defined:
description: A shared error schema (ErrorResponse) should be defined for error payloads.
severity: warn
given: $.components.schemas
then:
field: ErrorResponse
function: truthy