BBVA · API Governance Rules

BBVA — apicheck rules

Spectral linting rules defining API design standards and conventions for BBVA.

23 Rules error 9 warn 9
Published by BBVA Served by the provider at https://github.com/BBVA/apicheck/blob/8f455e8d3863c56ed75fc5d68df0a52830c7749b/tools-edge/oas-checker/spectral.yml; the copy below was fetched from there.
View Rules File View on GitHub

Rule Categories

array has hint missing no number patch paths request response servers string use

Rules

warn
paths-kebab-case
Paths should be kebab-case.
$.paths[*]~
hint
request-headers-pascal-case
Headers should be pascal-case.
$.[parameters][?(@.in=="header")].name
hint
response-headers-pascal-case
Headers should be pascal-case.
$.[responses][*].headers.*~
error
no-forbidden-headers
OAS do not allow using Authorization, Content-Type and Accept in the spec.
$..parameters[?(@.in == 'header')].name$.[responses][*].headers.*~
warn
no-x-headers-request
All 'HTTP' headers SHOULD NOT include 'X-' headers (https://tools.ietf.org/html/rfc6648).
$..parameters[?(@.in == 'header')].name
warn
no-x-headers-response
All 'HTTP' headers SHOULD NOT include 'X-' headers (https://tools.ietf.org/html/rfc6648).
$.[responses][*].headers.*~
error
servers-description
Servers must have a description.
$.servers[*]
error
servers-use-https
Servers must use https
$.servers[?(@["x-sandbox"] != true)]
error
has-termsOfService
API MUST reference the URL of the Terms of Service in #/info/termsOfService
$
error
has-contact
API MUST reference a contact, either url or email in #/info/contact
$
error
use-semver
$.info.version
error
no-swagger-2
Swagger 2 files are not allowed. Use OpenAPI >= 3.0
$
error
patch-media-type
application/json is not an appropriate media-type for PATCH.
$.[patch][requestBody][content]
error
use-problem-json-for-errors
Error responses should support [RFC 7807](https://tools.ietf.org/html/rfc7807)
$.paths.[*].responses[?(@property.match(/^(4|5|default)/))].content.*~
hint
use-problem-schema
WARN: This rule is under implementation. Your problem schema doesn't seem to match RFC7807. Are you sure it is ok?
$.paths.[*].responses[?(@property.match(/^(4|5|default)/))][[schema]]
hint
hint-problem-schema
Your problem schema doesn't seem to match RFC7807. Are you sure it is ok?
$.[responses][?(@property.match(/^(4|5|default)/))][[schema]][properties].*~
warn
missing-retry-after
APIs should use Retry-After on 429 and 503 responses.
$.[responses][?(@property == "429" || @property == "503" )][headers]
warn
missing-ratelimit
APIs should use ratelimit headers at least on successful responses.
$.[responses][?(@property[0] == "2" )][headers]
warn
response-with-json-object
$.[responses][*][content][?(@property.match("json$"))][schema]
warn
array-boundaries
Arrays should be limited.
$.[?(@.type=="array")]
warn
number-boundaries
Schema of type number or integer must specify a maximum and a minimum.
$.[?(@.type=="number")]$.[?(@.type=="integer")]
warn
string-maxlength
String length should be limited.
$.[?(@.type=="string" && !@.enum )]
hint
string-pattern-or-format-or-enum
String values should be constrained.
$.[[?( @.type == "string" && !@.enum )]]

Spectral Ruleset

bbva-apicheck-spectral-rules.yml Raw ↑ 
# harvested from https://github.com/BBVA/apicheck/blob/8f455e8d3863c56ed75fc5d68df0a52830c7749b/tools-edge/oas-checker/spectral.yml on 2026-10-09 — a Spectral ruleset published in the provider's own GitHub repository (BBVA/apicheck); found by GitHub code search, fetched verbatim
x-method: harvested
x-stamped: 2026-10-09
x-source-url: https://github.com/BBVA/apicheck/blob/8f455e8d3863c56ed75fc5d68df0a52830c7749b/tools-edge/oas-checker/spectral.yml
#
# See technical recommendations on Italian Guidelines
#  in https://github.com/italia/api-oas-checker for discussing rules.
#
#
extends: spectral:oas
# Skipping has-x-summary: off
# Skipping has-x-api-id: off
# Skipping number-format: off
# Skipping integer-format: off
# Skipping allowed-integer-format: off
# Skipping allowed-number-format: off
rules:
  paths-kebab-case:
    description: |
      Paths should be kebab-case.
    message: "{{property}} is not kebab-case: {{error}}"
    severity: warn
    recommended: true
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(/[a-z0-9-.]+|/{[a-zA-Z0-9_]+})+$
  request-headers-pascal-case:
    description: |
      Headers should be pascal-case.
    message: "{{value}} {{error}} in {{path}}"
    severity: hint
    recommended: true
    given:
      - $.[parameters][?(@.in=="header")].name
    then:
      function: casing
      functionOptions:
        type: pascal
        separator:
          char: "-"
  response-headers-pascal-case:
    description: |
      Headers should be pascal-case.
    message: "Header {{error}}: {{path}}"
    severity: hint
    recommended: true
    given:
      - $.[responses][*].headers.*~
    then:
      function: casing
      functionOptions:
        type: pascal
        separator:
          char: "-"
  no-forbidden-headers:
    description: OAS do not allow using Authorization, Content-Type and Accept in the spec.
    message: "{{error}} in {{path}} {{value}}"
    severity: error
    given:
      - $..parameters[?(@.in == 'header')].name
      - $.[responses][*].headers.*~
    then:
      function: pattern
      functionOptions:
        notMatch: /^(accept|content-type|authorization)$/i
  no-x-headers-request:
    description: All 'HTTP' headers SHOULD NOT include 'X-' headers
      (https://tools.ietf.org/html/rfc6648).
    severity: warn
    given:
      - $..parameters[?(@.in == 'header')].name
    message: HTTP header '{{value}}' SHOULD NOT include 'X-' prefix in {{path}}
    recommended: true
    type: style
    then:
      function: pattern
      functionOptions:
        match: /^([^x]|.[^-])|RateLimit-/i
  no-x-headers-response:
    description: All 'HTTP' headers SHOULD NOT include 'X-' headers
      (https://tools.ietf.org/html/rfc6648).
    severity: warn
    given:
      - $.[responses][*].headers.*~
    message: HTTP response header SHOULD NOT include 'X-' prefix in {{path}}
    recommended: true
    type: style
    then:
      function: pattern
      functionOptions:
        match: /^([^x]|.[^-])|RateLimit-/i
  servers-description:
    description: Servers must have a description.
    message: Server {{path}} must have a description.
    given: $.servers[*]
    severity: error
    recommended: true
    then:
      field: description
      function: truthy
  servers-use-https:
    description: Servers must use https
    message: "Non-sandbox url  {{value}} {{error}}. Add `x-sandbox: true` to declare
      the server as a sandbox."
    given: $.servers[?(@["x-sandbox"] != true)]
    severity: error
    recommended: true
    then:
      field: url
      function: pattern
      functionOptions:
        match: ^https://.*
  has-termsOfService:
    description: "API MUST reference the URL of the Terms of Service in
      #/info/termsOfService"
    given: $
    severity: error
    recommended: true
    type: style
    formats:
      - oas3
    then:
      field: info.termsOfService
      function: truthy
  has-contact:
    description: "API MUST reference a contact, either url or email in #/info/contact"
    given: $
    severity: error
    recommended: true
    type: style
    formats:
      - oas3
    then:
      field: info.contact
      function: truthy
  use-semver:
    severity: error
    recommended: true
    message: |-
      Specs should follow semantic versioning. {{value}} is not a valid version.
      See https://semver.org/#semantic-versioning-specification-semver
    given: $.info.version
    then:
      function: pattern
      functionOptions:
        match: ^[0-9]+.[0-9]+.[0-9]+(-[a-z0-9+.-]+)?
  oas2: false
  no-swagger-2:
    description: Swagger 2 files are not allowed. Use OpenAPI >= 3.0
    given: $
    severity: error
    recommended: true
    type: style
    formats:
      - oas2
    then:
      field: swagger
      function: falsy
  patch-media-type:
    description: application/json is not an appropriate media-type for PATCH.
    message: application/json is not an appropriate media-type for PATCH. {{path}}
      See https://www.rfc-editor.org/errata/eid3169
    formats:
      - oas3
    severity: error
    recommended: true
    given: $.[patch][requestBody][content]
    then:
      field: application/json
      function: falsy
  use-problem-json-for-errors:
    description: "Error responses should support [RFC
      7807](https://tools.ietf.org/html/rfc7807) "
    message: Error responses should support [RFC
      7807](https://tools.ietf.org/html/rfc7807) in {{path}}.
    formats:
      - oas3
    severity: error
    given: $.paths.[*].responses[?(@property.match(/^(4|5|default)/))].content.*~
    then:
      function: enumeration
      functionOptions:
        values:
          - application/problem+xml
          - application/problem+json
  use-problem-schema:
    description: >-
      WARN: This rule is under implementation.

      Your problem schema doesn't seem to match RFC7807. Are you sure it is ok?

    message: Your schema doesn't seem to match RFC7807. Are you sure it is ok? {{path}}
    formats:
      - oas3
    severity: hint
    recommended: false
    given: $.paths.[*].responses[?(@property.match(/^(4|5|default)/))][[schema]]
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          properties:
            status:
              type: integer
            title:
              type: string
            detail:
              type: string
  hint-problem-schema:
    description: Your problem schema doesn't seem to match RFC7807. Are you sure it
      is ok?
    message: Error response doesn't seem to match RFC7807. Are you sure it is ok?
      {{path}}
    formats:
      - oas3
    severity: hint
    recommended: true
    given: $.[responses][?(@property.match(/^(4|5|default)/))][[schema]][properties].*~
    then:
      field: "@key"
      function: pattern
      functionOptions:
        notMatch: message|code|msg
  missing-retry-after:
    description: APIs should use Retry-After on 429 and 503 responses.
    message: "Missing ratelimit header: {{property}} in {{path}}"
    formats:
      - oas3
    severity: warn
    recommended: true
    given: $.[responses][?(@property == "429" || @property == "503"  )][headers]
    then:
      field: Retry-After
      function: truthy
  missing-ratelimit:
    description: APIs should use ratelimit headers at least on successful responses.
    message: Missing ratelimit headers. {{property}} {{error}} {{path}}
    formats:
      - oas3
    severity: warn
    recommended: true
    given: $.[responses][?(@property[0] == "2" )][headers]
    then:
      - functionOptions:
          properties:
            - X-RateLimit-Limit
            - RateLimit-Limit
        function: xor
      - functionOptions:
          properties:
            - X-RateLimit-Remaining
            - RateLimit-Remaining
        function: xor
      - functionOptions:
          properties:
            - X-RateLimit-Reset
            - RateLimit-Reset
        function: xor
#
# Extra security rule
#
  response-with-json-object:
    message: JSON responses must use json objects (eg "{}"), not {{value}}. {{path}}
    severity: warn
    recommended: true
    given: $.[responses][*][content][?(@property.match("json$"))][schema]
    then:
      field: type
      function: pattern
      functionOptions:
        match: object

  array-boundaries:
    description: Arrays should be limited.
    message: Schema of type array must specify maxItems and minItems. {{path}} {{error}}
    formats:
      - oas3
    severity: warn
    recommended: true
    given:
      - $.[?(@.type=="array")]
    then:
      - field: maxItems
        function: defined
      - field: minItems
        function: defined
  number-boundaries:
    description: Schema of type number or integer must specify a maximum and a minimum.
    message: Schema of type number or integer must specify a maximum and a minimum.
      {{path}} {{error}}
    formats:
      - oas3
    severity: warn
    recommended: true
    given:
      - $.[?(@.type=="number")]
      - $.[?(@.type=="integer")]
    then:
      - field: maximum
        function: defined
      - field: minimum
        function: defined
  string-maxlength:
    description: String length should be limited.
    message: Strings (non enum) must specify a maximum length. {{path}} {{error}}
    formats:
      - oas3
    severity: warn
    recommended: true
    given:
      - $.[?(@.type=="string" && !@.enum )]
    then:
      - field: maxLength
        function: defined
  string-pattern-or-format-or-enum:
    description: String values should be constrained.
    message: Strings (non enum) must specify a pattern or a format. {{path}}
    formats:
      - oas3
    severity: hint
    recommended: true
    given:
      - $.[[?( @.type == "string" && !@.enum )]]
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required:
                - pattern
            - required:
                - format
          additionalProperties: true

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/bbva-apicheck-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.