Doordash · API Governance Rules

Doordash API Rules

Spectral linting rules defining API design standards and conventions for Doordash.

42 Rules error 7 warn 27 info 8
Generated by API Evangelist Written by API Evangelist tooling for Doordash's APIs. It is a starting point, not a ruleset Doordash publishes or enforces.
View Rules File View on GitHub

Rule Categories

delete error get global info no openapi operation parameter path request response schema security server servers tag

Rules

warn
info-title-doordash-prefix
API title should start with "DoorDash".
$.info.title
warn
info-description-required
A meaningful info.description is required (min 40 chars).
$.info
warn
info-description-length
info.description should be substantive.
$.info.description
error
info-version-required
info.version is required.
$.info
info
info-contact-required
info.contact should be present.
$.info
warn
openapi-version-3-1
DoorDash specs target OpenAPI 3.1.0.
$.openapi
error
servers-defined
At least one server must be defined.
$
error
servers-https-only
Server URLs must use HTTPS.
$.servers[*].url
info
server-description-required
Each server should have a description.
$.servers[*]
warn
path-no-trailing-slash
Paths must not end with a trailing slash.
$.paths[*]~
warn
path-segments-snake-case
Static path segments should be snake_case (lowercase letters, digits, underscores).
$.paths[*]~
error
path-no-query-string
Path keys must not contain query strings.
$.paths[*]~
error
operation-operationId-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-operationId-camel-case
operationId should be camelCase with a verb prefix.
$.paths[*][get,post,put,patch,delete].operationId
warn
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-doordash-prefix
Operation summaries should start with "DoorDash".
$.paths[*][get,post,put,patch,delete].summary
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
warn
operation-tags-required
Every operation must be tagged.
$.paths[*][get,post,put,patch,delete]
info
operation-microcks-extension
Each operation should declare an x-microcks-operation block for mock compatibility.
$.paths[*][get,post,put,patch,delete]
info
global-tags-defined
A global tags array should be defined.
$
info
tag-description-required
Each global tag should have a description.
$.tags[*]
warn
tag-name-title-case
Tag names should be Title Case (e.g. "Deliveries", "Item Management").
$.tags[*].name
warn
parameter-description-required
Parameters must have a description.
$.paths[*][*].parameters[*]
warn
parameter-name-snake-case
Parameter names should be snake_case.
$.paths[*][*].parameters[*].name
warn
parameter-schema-typed
Each parameter must declare a schema with a type.
$.paths[*][*].parameters[*].schema
warn
request-body-json
Request bodies should offer application/json content.
$.paths[*][post,put,patch].requestBody.content
error
response-success-defined
Each operation must define at least one 2xx response.
$.paths[*][get,post,put,patch,delete].responses
info
response-auth-defined
Operations should document a 401 unauthorized response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-description-required
Every response must have a description.
$.paths[*][*].responses[*]
warn
schema-property-snake-case
Schema property names should be snake_case.
$.components.schemas[*].properties[*]~
info
schema-property-typed
Schema properties should declare a type or $ref.
$.components.schemas[*].properties[*]
warn
security-global-defined
A global security requirement should be declared.
$
warn
security-scheme-bearer-jwt
DoorDash APIs authenticate with a Bearer JWT security scheme.
$.components.securitySchemes[*]
info
security-scheme-described
Security schemes should be described.
$.components.securitySchemes[*]
error
get-no-request-body
GET operations must not declare a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not declare a request body.
$.paths[*].delete
warn
servers-expected-domain
Server URLs should be on the doordash.com domain.
$.servers[*].url
warn
path-params-casing
Path parameters should be snake_case (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
warn
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (Error) should be defined for error payloads.
$.components.schemas
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# doordash — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 5/5 servers on doordash.com
#   - path-params-casing: snake @ 100% (n=32)
#   - operationid-casing: camel @ 100% (n=42)
#   - schema-names-casing: pascal @ 100% (n=58)
#   - schema-properties-casing: snake @ 100% (n=296)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: Error
#   - operation-documents-401: 100% adherence
#   - merge: kept 36 existing, added 6 measured, upgraded 0
#   - added: servers-expected-domain, path-params-casing, schema-names-casing, schema-properties-casing, error-schema-defined, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-doordash-prefix:
    description: API title should start with "DoorDash".
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^DoorDash
  info-description-required:
    description: A meaningful info.description is required (min 40 chars).
    severity: warn
    given: $.info
    then:
      field: description
      function: defined
  info-description-length:
    description: info.description should be substantive.
    severity: warn
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 40
  info-version-required:
    description: info.version is required.
    severity: error
    given: $.info
    then:
      field: version
      function: defined
  info-contact-required:
    description: info.contact should be present.
    severity: info
    given: $.info
    then:
      field: contact
      function: defined
  openapi-version-3-1:
    description: DoorDash specs target OpenAPI 3.1.0.
    severity: warn
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.1\.
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: $
    then:
      field: servers
      function: defined
  servers-https-only:
    description: Server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  server-description-required:
    description: Each server should have a description.
    severity: info
    given: $.servers[*]
    then:
      field: description
      function: defined
  path-no-trailing-slash:
    description: Paths must not end with a trailing slash.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: .+/$
  path-segments-snake-case:
    description: Static path segments should be snake_case (lowercase letters, digits, underscores).
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(/([a-z0-9_]+|\{[a-z0-9_]+\}))+$
  path-no-query-string:
    description: Path keys must not contain query strings.
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \?
  operation-operationId-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: defined
  operation-operationId-camel-case:
    description: operationId should be camelCase with a verb prefix.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^(get|list|create|update|delete|cancel|accept|send|check)[A-Za-z0-9]*$
  operation-summary-required:
    description: Every operation must have a summary.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: defined
  operation-summary-doordash-prefix:
    description: Operation summaries should start with "DoorDash".
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^DoorDash '
  operation-description-required:
    description: Every operation must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: defined
  operation-tags-required:
    description: Every operation must be tagged.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-microcks-extension:
    description: Each operation should declare an x-microcks-operation block for mock compatibility.
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: defined
  global-tags-defined:
    description: A global tags array should be defined.
    severity: info
    given: $
    then:
      field: tags
      function: defined
  tag-description-required:
    description: Each global tag should have a description.
    severity: info
    given: $.tags[*]
    then:
      field: description
      function: defined
  tag-name-title-case:
    description: Tag names should be Title Case (e.g. "Deliveries", "Item Management").
    severity: warn
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]*( [A-Z][A-Za-z0-9]*)*$
  parameter-description-required:
    description: Parameters must have a description.
    severity: warn
    given: $.paths[*][*].parameters[*]
    then:
      field: description
      function: defined
  parameter-name-snake-case:
    description: Parameter names should be snake_case.
    severity: warn
    given: $.paths[*][*].parameters[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_]*$
  parameter-schema-typed:
    description: Each parameter must declare a schema with a type.
    severity: warn
    given: $.paths[*][*].parameters[*].schema
    then:
      field: type
      function: defined
  request-body-json:
    description: Request bodies should offer application/json content.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: defined
  response-success-defined:
    description: Each operation must define at least one 2xx response.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  response-auth-defined:
    description: Operations should document a 401 unauthorized response.
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: defined
  response-description-required:
    description: Every response must have a description.
    severity: warn
    given: $.paths[*][*].responses[*]
    then:
      field: description
      function: defined
  schema-property-snake-case:
    description: Schema property names should be snake_case.
    severity: warn
    given: $.components.schemas[*].properties[*]~
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_]*$
  schema-property-typed:
    description: Schema properties should declare a type or $ref.
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - type
          - required:
            - $ref
          - required:
            - allOf
          - required:
            - oneOf
          - required:
            - anyOf
  security-global-defined:
    description: A global security requirement should be declared.
    severity: warn
    given: $
    then:
      field: security
      function: defined
  security-scheme-bearer-jwt:
    description: DoorDash APIs authenticate with a Bearer JWT security scheme.
    severity: warn
    given: $.components.securitySchemes[*]
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          properties:
            type:
              const: http
            scheme:
              const: bearer
  security-scheme-described:
    description: Security schemes should be described.
    severity: info
    given: $.components.securitySchemes[*]
    then:
      field: description
      function: defined
  get-no-request-body:
    description: GET operations must not declare a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: undefined
  delete-no-request-body:
    description: DELETE operations should not declare a request body.
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: undefined
  servers-expected-domain:
    description: Server URLs should be on the doordash.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: doordash\.com
  path-params-casing:
    description: Path parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: snake
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (Error) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Error
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/doordash-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.