Axway · API Governance Rules

Axway API Rules

Spectral linting rules defining API design standards and conventions for Axway.

40 Rules error 13 warn 18 info 9
Generated by API Evangelist Written by API Evangelist tooling for Axway's APIs. It is a starting point, not a ruleset Axway publishes or enforces.
View Rules File View on GitHub

Rule Categories

error info microcks naming no operation operations parameters path paths query request responses schema schemas security servers

Rules

error
info-title-required
API spec must have a non-empty info.title
$.info
error
info-description-required
API spec must have an info.description
$.info
warn
info-version-semver
Info version should follow semantic versioning
$.info.version
warn
info-contact-required
API spec should include contact information
$.info
error
paths-lowercase
Path segments must be lowercase
$.paths
error
paths-no-trailing-slash
Paths must not end with a trailing slash
$.paths
warn
paths-kebab-or-lower
Path segments should use lowercase or snake_case (Axway convention)
$.paths
warn
paths-no-file-extensions
Paths should not include file extensions
$.paths
error
operations-operation-id-required
Every operation must have an operationId
$.paths[*][get,post,put,patch,delete]
warn
operations-operation-id-underscore
operationId should use underscore convention (resource_action)
$.paths[*][get,post,put,patch,delete].operationId
error
operations-summary-required
Every operation must have a summary
$.paths[*][get,post,put,patch,delete]
warn
operations-description-required
Every operation must have a description
$.paths[*][get,post,put,patch,delete]
error
operations-tags-required
Every operation must have at least one tag
$.paths[*][get,post,put,patch,delete]
warn
operations-tags-lowercase
Tags should be lowercase (Axway convention)
$.paths[*][get,post,put,patch,delete].tags[*]
warn
parameters-description-required
Every parameter must have a description
$.paths[*][get,post,put,patch,delete].parameters[*]
error
parameters-schema-required
Every parameter must have a schema with type
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameters-camel-case
Parameter names should use camelCase or snake_case
$.paths[*][get,post,put,patch,delete].parameters[*].name
error
responses-success-required
Every operation must define a success response (2xx)
$.paths[*][get,post,put,patch,delete].responses
warn
responses-error-401
Operations with security should define a 401 response
$.paths[*][get,post,put,patch,delete].responses
info
responses-error-400
POST/PUT operations should define a 400 response
$.paths[*][post,put].responses
error
schemas-type-required
Every schema must declare a type
$.components.schemas[*]
info
schemas-description-recommended
Schemas should have a description
$.components.schemas[*]
info
schemas-properties-description
Schema properties should have descriptions
$.components.schemas[*].properties[*]
info
schemas-no-additional-properties-unset
Object schemas should explicitly set additionalProperties
$.components.schemas[?(@.type=='object')]
error
security-schemes-defined
API must define at least one security scheme
$.components
info
security-bearer-format
Bearer security schemes should specify bearerFormat
$.components.securitySchemes[?(@.scheme=='bearer')]
warn
security-oauth2-scopes
OAuth2 schemes should define scopes
$.components.securitySchemes[?(@.type=='oauth2')].flows[*]
warn
request-body-json
Request bodies should use application/json content type
$.paths[*][post,put,patch].requestBody.content
error
request-body-schema
Request body JSON content must have a schema
$.paths[*][post,put,patch].requestBody.content.application/json
warn
naming-schema-pascal-case
Schema names should use PascalCase
$.components.schemas
info
microcks-operation-extension
Operations should include x-microcks-operation for mock compatibility
$.paths[*][get,post,put,patch,delete]
info
microcks-response-examples
Success responses should include named examples for Microcks
$.paths[*][get,post,put,patch,delete].responses.200.content.application/json
error
servers-https-only
Server URLs must use HTTPS.
$.servers[*].url
warn
servers-expected-domain
Server URLs should be on the axway.com domain.
$.servers[*].url
warn
path-params-casing
Path parameters should be snake_case (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
operation-security-required
Every operation should declare its security requirements.
$.paths[*][get,post,put,patch,delete]
warn
error-schema-defined
A shared error schema (Error) should be defined for error payloads.
$.components.schemas
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# axway — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 1/1 servers on axway.com
#   - path-params-casing: snake @ 100% (n=113)
#   - query-params-casing: snake @ 99% (n=380)
#   - schema-properties-casing: snake @ 76% (n=731)
#   - operation-security-required: 122/141 ops declare per-op security
#   - error-schema-defined: Error
#   - operation-documents-400: 100% adherence
#   - pagination params observed: ['limit', 'page']
#   - merge: kept 32 existing, added 8 measured, upgraded 0
#   - added: servers-https-only, servers-expected-domain, path-params-casing, query-params-casing, schema-properties-casing, operation-security-required, error-schema-defined, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-required:
    description: API spec must have a non-empty info.title
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-description-required:
    description: API spec must have an info.description
    severity: error
    given: $.info
    then:
      field: description
      function: truthy
  info-version-semver:
    description: Info version should follow semantic versioning
    severity: warn
    given: $.info.version
    then:
      function: pattern
      functionOptions:
        match: ^[0-9]+\.[0-9]+\.[0-9]+
  info-contact-required:
    description: API spec should include contact information
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  paths-lowercase:
    description: Path segments must be lowercase
    severity: error
    given: $.paths
    then:
      function: pattern
      functionOptions:
        match: ^[/a-z0-9_{}.-]+$
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash
    severity: error
    given: $.paths
    then:
      function: pattern
      functionOptions:
        notMatch: /$
  paths-kebab-or-lower:
    description: Path segments should use lowercase or snake_case (Axway convention)
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        match: ^[/a-z0-9_{}-]+$
  paths-no-file-extensions:
    description: Paths should not include file extensions
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        notMatch: \.(json|xml|yaml|html)$
  operations-operation-id-required:
    description: Every operation must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operations-operation-id-underscore:
    description: operationId should use underscore convention (resource_action)
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z]+_[a-zA-Z]+$
  operations-summary-required:
    description: Every operation must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operations-description-required:
    description: Every operation must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operations-tags-required:
    description: Every operation must have at least one tag
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operations-tags-lowercase:
    description: Tags should be lowercase (Axway convention)
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].tags[*]
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_-]*$
  parameters-description-required:
    description: Every parameter must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameters-schema-required:
    description: Every parameter must have a schema with type
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: schema
      function: truthy
  parameters-camel-case:
    description: Parameter names should use camelCase or snake_case
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9_]*$
  responses-success-required:
    description: Every operation must define a success response (2xx)
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  responses-error-401:
    description: Operations with security should define a 401 response
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  responses-error-400:
    description: POST/PUT operations should define a 400 response
    severity: info
    given: $.paths[*][post,put].responses
    then:
      field: '400'
      function: truthy
  schemas-type-required:
    description: Every schema must declare a type
    severity: error
    given: $.components.schemas[*]
    then:
      field: type
      function: truthy
  schemas-description-recommended:
    description: Schemas should have a description
    severity: info
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schemas-properties-description:
    description: Schema properties should have descriptions
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: description
      function: truthy
  schemas-no-additional-properties-unset:
    description: Object schemas should explicitly set additionalProperties
    severity: info
    given: $.components.schemas[?(@.type=='object')]
    then:
      field: additionalProperties
      function: defined
  security-schemes-defined:
    description: API must define at least one security scheme
    severity: error
    given: $.components
    then:
      field: securitySchemes
      function: truthy
  security-bearer-format:
    description: Bearer security schemes should specify bearerFormat
    severity: info
    given: $.components.securitySchemes[?(@.scheme=='bearer')]
    then:
      field: bearerFormat
      function: truthy
  security-oauth2-scopes:
    description: OAuth2 schemes should define scopes
    severity: warn
    given: $.components.securitySchemes[?(@.type=='oauth2')].flows[*]
    then:
      field: scopes
      function: truthy
  request-body-json:
    description: Request bodies should use application/json content type
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  request-body-schema:
    description: Request body JSON content must have a schema
    severity: error
    given: $.paths[*][post,put,patch].requestBody.content.application/json
    then:
      field: schema
      function: truthy
  naming-schema-pascal-case:
    description: Schema names should use PascalCase
    severity: warn
    given: $.components.schemas
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][a-zA-Z0-9]*$
  microcks-operation-extension:
    description: Operations should include x-microcks-operation for mock compatibility
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  microcks-response-examples:
    description: Success responses should include named examples for Microcks
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses.200.content.application/json
    then:
      field: examples
      function: truthy
  servers-https-only:
    description: Server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-expected-domain:
    description: Server URLs should be on the axway.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: axway\.com
  path-params-casing:
    description: Path parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: snake
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  operation-security-required:
    description: Every operation should declare its security requirements.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: security
      function: truthy
  error-schema-defined:
    description: A shared error schema (Error) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Error
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/axway-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.