Dependency-Track API Rules

# harvested from https://github.com/DependencyTrack/dependency-track/blob/e3abb0a09bb4dd7a8e926a26eda6c1b6324fd76c/api/src/main/spectral/ruleset.yaml on 2026-10-09 — a Spectral ruleset published in the provider's own GitHub repository (DependencyTrack/dependency-track); found by GitHub code search, fetched verbatim
# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
extends:
- ["spectral:oas", "all"]
- ["./zalando.yaml", "all"]
formats:
- "oas3"
functions:
- paginated-response-uses-items
- response-conventions
rules:
  # Built-in Spectral rules for tag presence and validity, raised to error.
  operation-tags: error
  operation-tag-defined: error

  # Every operation must declare exactly one tag. Combined with
  # operation-tag-defined (above), this guarantees the tag is from the
  # canonical list in openapi.yaml.
  operation-must-have-exactly-one-tag:
    message: "Operations must declare exactly one tag"
    severity: error
    given: "$.paths.*[get,post,put,patch,delete].tags"
    then:
      function: length
      functionOptions:
        min: 1
        max: 1

  must-use-snake-case-for-path-parameters:
    message: MUST use snake_case for path parameters
    severity: error
    given: $.paths.*.*.parameters[?(@ && @.in=='path')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][_a-z0-9]*$

  paginated-response-must-use-items-array:
    message: "{{error}}"
    severity: error
    given: "$.paths.*.get.responses.*.content.application/json.schema"
    then:
      function: paginated-response-uses-items

  # Enforce consistent naming of operations, depending on their HTTP method.
  operation-id-get-prefix:
    message: GET operation IDs must start with "get" or "list"
    severity: error
    given: $.paths.*.get.operationId
    then:
      function: pattern
      functionOptions:
        match: ^(get|list)[A-Z]
  operation-id-post-prefix:
    message: POST operation IDs must not use prefixes reserved for other methods (get, list, delete, update)
    severity: error
    given: $.paths.*.post.operationId
    then:
      function: pattern
      functionOptions:
        notMatch: ^(get|list|delete|update)[A-Z]
  operation-id-put-prefix:
    message: PUT operation IDs must start with "update"
    severity: error
    given: $.paths.*.put.operationId
    then:
      function: pattern
      functionOptions:
        match: ^update[A-Z]
  operation-id-patch-prefix:
    message: PATCH operation IDs must start with "update"
    severity: error
    given: $.paths.*.patch.operationId
    then:
      function: pattern
      functionOptions:
        match: ^update[A-Z]
  operation-id-delete-prefix:
    message: DELETE operation IDs must start with "delete"
    severity: error
    given: $.paths.*.delete.operationId
    then:
      function: pattern
      functionOptions:
        match: ^delete[A-Z]

  # Enforce consistent response structure, depending on the operation's HTTP method.
  # The oauth token endpoint is exempt because RFC 6749 requires 200 and its own error object.
  response-conventions-post:
    message: "{{error}}"
    severity: error
    given: "$.paths[?(!@property.match(/(\\/test|^\\/oauth\\/token)$/))].post.responses"
    then:
      function: response-conventions
      functionOptions:
        method: post
  response-conventions-put:
    message: "{{error}}"
    severity: error
    given: $.paths.*.put.responses
    then:
      function: response-conventions
      functionOptions:
        method: put
  response-conventions-patch:
    message: "{{error}}"
    severity: error
    given: $.paths.*.patch.responses
    then:
      function: response-conventions
      functionOptions:
        method: patch
  response-conventions-delete:
    message: "{{error}}"
    severity: error
    given: $.paths.*.delete.responses
    then:
      function: response-conventions
      functionOptions:
        method: delete

  # Same rule as in zalando.yaml, but skipping the oauth token endpoint,
  # whose errors follow RFC 6749 instead of RFC 9457.
  must-use-problem-json-for-errors:
    message: Error response must be application/problem+json
    description: MUST support problem JSON [176]
    documentationUrl: https://opensource.zalando.com/restful-api-guidelines/#176
    severity: error
    given: "$.paths[?(!@property.match(/^\\/oauth\\/token$/))].*.responses[?(@ && @property.match(/^(4|5)/))]"
    then:
      field: content.application/problem+json
      function: truthy