Deliverect · API Governance Rules

Deliverect API Rules

Spectral linting rules defining API design standards and conventions for Deliverect.

35 Rules error 8 warn 19 info 8
Generated by API Evangelist Written by API Evangelist tooling for Deliverect's APIs. It is a starting point, not a ruleset Deliverect publishes or enforces.
View Rules File View on GitHub

Rule Categories

get info no openapi operation operationid parameter path query request response schema security servers tag tags

Rules

warn
info-title-deliverect-prefix
API title should start with "Deliverect".
$.info.title
warn
info-description-required
Info object must have a non-empty description.
$.info
error
info-version-required
Info object must declare a version.
$.info
info
info-contact-required
A contact should be provided.
$.info
warn
openapi-version-3-1
Specs should target OpenAPI 3.1.x.
$.openapi
error
servers-defined
At least one server must be defined.
$.servers
error
servers-https-only
Server URLs must use HTTPS.
$.servers[*].url
info
servers-deliverect-host
Production/staging hosts should be on the deliverect.com domain.
$.servers[*].url
warn
path-no-trailing-slash
Paths should not end with a trailing slash.
$.paths[*]~
error
path-no-double-slash
Paths must not contain a double slash.
$.paths[*]~
error
path-no-query-string
Paths must not embed a query string.
$.paths[*]~
error
operation-operationid-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-deliverect-prefix
Operation summaries should start with "Deliverect".
$.paths[*][get,post,put,patch,delete].summary
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
warn
operation-tags-required
Every operation must be tagged.
$.paths[*][get,post,put,patch,delete]
info
operation-microcks-extension
Operations should carry the x-microcks-operation extension for mocking.
$.paths[*][get,post,put,patch,delete]
info
tags-global-defined
A global tags array should be declared.
$
warn
tag-title-case
Tag names should use Title Case.
$.tags[*].name
info
tag-description
Global tags should have a description.
$.tags[*]
warn
parameter-description-required
Parameters must have a description.
$.paths[*][get,post,put,patch,delete].parameters[*]
error
parameter-schema-required
Parameters must declare a schema with a type.
$.paths[*][get,post,put,patch,delete].parameters[*].schema
info
parameter-camelcase
Parameter names should use camelCase (Deliverect convention, e.g. channelLinkId, accountId).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='path' || @.in=='query')].name
warn
request-body-json-content
Request bodies should offer application/json content.
$.paths[*][post,put,patch].requestBody.content
warn
response-success-defined
Operations must define at least one 2xx response.
$.paths[*][get,post,put,patch,delete].responses
info
response-unauthorized-defined
Operations should document a 401 response (OAuth tokens can be rejected).
$.paths[*][get,post,put,patch,delete].responses
warn
response-description-required
Every response must have a description.
$.paths[*][get,post,put,patch,delete].responses[*]
warn
security-global-defined
A global security requirement should be declared (OAuth 2.0).
$
warn
security-oauth2-scheme
An OAuth 2.0 security scheme should be defined in components.
$.components.securitySchemes
error
get-no-request-body
GET operations must not declare a request body.
$.paths[*].get
info
schema-property-examples
Encourage examples on schema properties for richer mocks.
$.paths[*][get,post,put,patch,delete].responses[*].content.application/json.schema.properties[*]
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
operationid-casing
Operation IDs should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].operationId
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# deliverect — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 20/20 servers on deliverect.com
#   - path-params-casing: camel @ 99% (n=82)
#   - query-params-casing: snake @ 69% (n=16)
#   - operationid-casing: snake @ 95% (n=104)
#   - security: global (root) — NOT emitting operation-security-required
#   - pagination params observed: ['page', 'size']
#   - merge: kept 32 existing, added 4 measured, upgraded 0
#   - added: path-params-casing, query-params-casing, operationid-casing, no-empty-descriptions
extends:
- spectral:oas
rules:
  info-title-deliverect-prefix:
    description: API title should start with "Deliverect".
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Deliverect
  info-description-required:
    description: Info object must have a non-empty description.
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: Info object must declare a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: A contact should be provided.
    severity: info
    given: $.info
    then:
      field: contact
      function: truthy
  openapi-version-3-1:
    description: Specs should target OpenAPI 3.1.x.
    severity: warn
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.1\.
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: $.servers
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1
  servers-https-only:
    description: Server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-deliverect-host:
    description: Production/staging hosts should be on the deliverect.com domain.
    severity: info
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: deliverect\.com
  path-no-trailing-slash:
    description: Paths should not end with a trailing slash.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: .+/$
  path-no-double-slash:
    description: Paths must not contain a double slash.
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: //
  path-no-query-string:
    description: Paths must not embed a query string.
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \?
  operation-operationid-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-summary-required:
    description: Every operation must have a summary.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-deliverect-prefix:
    description: Operation summaries should start with "Deliverect".
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^Deliverect '
  operation-description-required:
    description: Every operation must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-tags-required:
    description: Every operation must be tagged.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-microcks-extension:
    description: Operations should carry the x-microcks-operation extension for mocking.
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  tags-global-defined:
    description: A global tags array should be declared.
    severity: info
    given: $
    then:
      field: tags
      function: truthy
  tag-title-case:
    description: Tag names should use Title Case.
    severity: warn
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]*( [A-Z][A-Za-z0-9]*)*$
  tag-description:
    description: Global tags should have a description.
    severity: info
    given: $.tags[*]
    then:
      field: description
      function: truthy
  parameter-description-required:
    description: Parameters must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: Parameters must declare a schema with a type.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*].schema
    then:
      field: type
      function: truthy
  parameter-camelcase:
    description: Parameter names should use camelCase (Deliverect convention, e.g. channelLinkId, accountId).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='path' || @.in=='query')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$|^_
  request-body-json-content:
    description: Request bodies should offer application/json content.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-success-defined:
    description: Operations must define at least one 2xx response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  response-unauthorized-defined:
    description: Operations should document a 401 response (OAuth tokens can be rejected).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  response-description-required:
    description: Every response must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  security-global-defined:
    description: A global security requirement should be declared (OAuth 2.0).
    severity: warn
    given: $
    then:
      field: security
      function: truthy
  security-oauth2-scheme:
    description: An OAuth 2.0 security scheme should be defined in components.
    severity: warn
    given: $.components.securitySchemes
    then:
      field: oauth2
      function: truthy
  get-no-request-body:
    description: GET operations must not declare a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  schema-property-examples:
    description: Encourage examples on schema properties for richer mocks.
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses[*].content.application/json.schema.properties[*]
    then:
      field: example
      function: truthy
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: camel
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  operationid-casing:
    description: Operation IDs should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: casing
      functionOptions:
        type: snake
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/deliverect-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.