Carnegie Mellon University API Rules

---
# authorship: API Evangelist tooling. Not published by Carnegie Mellon University.
x-generated: '2026-08-19'
x-method: derived
x-source: >-
  openapi/carnegie-mellon-university-delphi-epidata-openapi.yml,
  openapi/carnegie-mellon-university-cert-vulnerability-notes-openapi.yml,
  openapi/carnegie-mellon-university-library-publishing-openapi.yml
# Spectral ruleset encoding the conventions actually observed across the three API surfaces
# Carnegie Mellon University itself operates: Delphi Epidata (api.delphi.cmu.edu), the CERT/CC
# Vulnerability Notes API (kb.cert.org, CMU Software Engineering Institute) and the Library
# Publishing Service (lps.library.cmu.edu). Rewritten 2026-08-19 — the 2026-06 ruleset was
# derived from the figshare v2 contract and encoded figshare's conventions as Carnegie Mellon's.
#
# The dominant real finding these rules encode: both of CMU's long-standing research APIs
# return errors with HTTP 200. Delphi signals failure in a `result` integer; CERT/CC returns a
# single undifferentiated error object. Anything built against a CMU surface must validate the
# body, not the status line.
extends: [[spectral:oas, off]]
formats:
  - oas3
rules:
  cmu-info-operator:
    description: >-
      Every spec in a CMU repo must declare info.x-operator, because most surfaces that look like
      the university's are a vendor's.
    severity: error
    given: $.info
    then:
      field: x-operator
      function: truthy
  cmu-info-operator-evidence:
    description: An x-operator claim must carry the evidence that settled it.
    severity: error
    given: $.info
    then:
      field: x-operator-evidence
      function: truthy
  cmu-info-provenance:
    description: >-
      Every spec must carry x-provenance, because none of these contracts was published by CMU —
      all three were derived from live probes by API Evangelist.
    severity: error
    given: $.info
    then:
      field: x-provenance
      function: truthy
  cmu-institutional-contact:
    description: Every CMU-operated API should name the institutional unit that runs it.
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy
  cmu-single-server:
    description: >-
      Each CMU surface is a single host. A spec listing servers from more than one registrable
      domain has almost certainly welded separate surfaces together — the failure that produced
      eleven figshare entries under this slug in June 2026.
    severity: warn
    given: $.servers
    then:
      function: length
      functionOptions:
        max: 2
  cmu-operation-id:
    description: Every operation carries an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  cmu-operation-summary:
    description: Every operation carries a summary.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  cmu-operation-tagged:
    description: Every operation is tagged, so the refine step can split cleanly.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  cmu-read-only-surfaces:
    description: >-
      All three CMU-operated public APIs are read-only. A write operation appearing in one of
      these specs is a signal that a vendor contract has been merged in.
    severity: warn
    given: $.paths[*]
    then:
      field: post
      function: falsy
  cmu-no-auth-required:
    description: >-
      CMU's public APIs are anonymous. A securitySchemes block appearing here usually means a
      vendor's OAuth model (figshare's) has been reattributed to the university.
    severity: info
    given: $.components
    then:
      field: securitySchemes
      function: falsy
  cmu-error-not-in-status:
    description: >-
      Documented responses must include 200 even for error cases, because Delphi and CERT/CC both
      serve failures with HTTP 200. Specs that model errors only under 4xx misdescribe these APIs.
    severity: info
    given: $.paths[*][get].responses
    then:
      field: '200'
      function: truthy