Facebook · API Governance Rules

Facebook API Rules

Spectral linting rules defining API design standards and conventions for Facebook.

33 Rules error 13 warn 15 info 5
Generated by API Evangelist Written by API Evangelist tooling for Facebook's APIs. It is a starting point, not a ruleset Facebook publishes or enforces.
View Rules File View on GitHub

Rule Categories

delete examples get info no openapi operation pagination parameter paths query response schema security servers

Rules

error
info-title-required
Info title must be present.
$.info
warn
info-title-prefix
Info title should start with Facebook.
$.info.title
error
info-description-required
Info description must be present.
$.info
error
info-version-required
Info version must be present.
$.info
warn
info-contact-required
Contact information should be provided.
$.info
warn
openapi-version
OpenAPI version should be 3.0.x.
$
error
servers-defined
Servers array must be defined.
$
warn
servers-https
Server URLs should use HTTPS.
$.servers[*].url
error
paths-no-trailing-slash
Paths should not have trailing slashes.
$.paths
error
operation-operationid-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-prefix
Operation summaries should start with Facebook.
$.paths[*][get,post,put,patch,delete].summary
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
warn
operation-tags-required
Every operation must have tags.
$.paths[*][get,post,put,patch,delete]
warn
operation-operationid-camelcase
OperationId should be camelCase.
$.paths[*][get,post,put,patch,delete].operationId
warn
parameter-description-required
Every parameter must have a description.
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameter-snake-case
Parameter names should use snake_case or kebab-case.
$.paths[*][get,post,put,patch,delete].parameters[*].name
error
response-success-required
Operations must have a success response (2xx).
$.paths[*][get,post,put,patch,delete].responses
warn
response-description-required
Every response must have a description.
$.paths[*][get,post,put,patch,delete].responses[*]
info
schema-properties-snake-case
Schema property names should use snake_case.
$.components.schemas[*].properties
warn
schema-description-required
Top-level schemas should have descriptions.
$.components.schemas[*]
error
schema-type-required
Schemas must have a type defined.
$.components.schemas[*]
error
security-defined
Global security must be defined.
$
error
security-schemes-defined
Security schemes must be defined in components.
$.components
info
security-bearer-scheme
Bearer authentication should be used.
$.components.securitySchemes[*]
error
get-no-request-body
GET operations should not have a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not have a request body.
$.paths[*].delete
error
no-empty-descriptions
Descriptions must not be empty strings.
$..description
info
examples-encouraged
Schema properties should include example values.
$.components.schemas[*].properties[*]
info
pagination-cursor-pattern
Pagination should use cursor-based pagination with before/after.
$.components.schemas.Paging
warn
servers-expected-domain
Server URLs should be on the facebook.com domain.
$.servers[*].url
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# facebook — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 5/6 servers on facebook.com
#   - path-params-casing: kebab @ 100% (n=45)
#   - query-params-casing: snake @ 100% (n=19)
#   - operationid-casing: camel @ 100% (n=47)
#   - schema-names-casing: pascal @ 100% (n=55)
#   - schema-properties-casing: snake @ 100% (n=219)
#   - security: global (root) — NOT emitting operation-security-required
#   - pagination params observed: ['limit']
#   - merge: kept 30 existing, added 3 measured, upgraded 0
#   - added: servers-expected-domain, query-params-casing, schema-names-casing
extends:
  - spectral:oas
rules:
  info-title-required:
    description: Info title must be present.
    given: $.info
    severity: error
    then:
      field: title
      function: truthy
  info-title-prefix:
    description: Info title should start with Facebook.
    given: $.info.title
    severity: warn
    then:
      function: pattern
      functionOptions:
        match: '^Facebook '
  info-description-required:
    description: Info description must be present.
    given: $.info
    severity: error
    then:
      field: description
      function: truthy
  info-version-required:
    description: Info version must be present.
    given: $.info
    severity: error
    then:
      field: version
      function: truthy
  info-contact-required:
    description: Contact information should be provided.
    given: $.info
    severity: warn
    then:
      field: contact
      function: truthy
  openapi-version:
    description: OpenAPI version should be 3.0.x.
    given: $
    severity: warn
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.0\.
  servers-defined:
    description: Servers array must be defined.
    given: $
    severity: error
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs should use HTTPS.
    given: $.servers[*].url
    severity: warn
    then:
      function: pattern
      functionOptions:
        match: ^https://
  paths-no-trailing-slash:
    description: Paths should not have trailing slashes.
    given: $.paths
    severity: error
    then:
      field: '@key'
      function: pattern
      functionOptions:
        notMatch: /$
  operation-operationid-required:
    description: Every operation must have an operationId.
    given: $.paths[*][get,post,put,patch,delete]
    severity: error
    then:
      field: operationId
      function: truthy
  operation-summary-required:
    description: Every operation must have a summary.
    given: $.paths[*][get,post,put,patch,delete]
    severity: error
    then:
      field: summary
      function: truthy
  operation-summary-prefix:
    description: Operation summaries should start with Facebook.
    given: $.paths[*][get,post,put,patch,delete].summary
    severity: warn
    then:
      function: pattern
      functionOptions:
        match: '^Facebook '
  operation-description-required:
    description: Every operation must have a description.
    given: $.paths[*][get,post,put,patch,delete]
    severity: warn
    then:
      field: description
      function: truthy
  operation-tags-required:
    description: Every operation must have tags.
    given: $.paths[*][get,post,put,patch,delete]
    severity: warn
    then:
      field: tags
      function: truthy
  operation-operationid-camelcase:
    description: OperationId should be camelCase.
    given: $.paths[*][get,post,put,patch,delete].operationId
    severity: warn
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  parameter-description-required:
    description: Every parameter must have a description.
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    severity: warn
    then:
      field: description
      function: truthy
  parameter-snake-case:
    description: Parameter names should use snake_case or kebab-case.
    given: $.paths[*][get,post,put,patch,delete].parameters[*].name
    severity: info
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_\-]*$
  response-success-required:
    description: Operations must have a success response (2xx).
    given: $.paths[*][get,post,put,patch,delete].responses
    severity: error
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '204'
  response-description-required:
    description: Every response must have a description.
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    severity: warn
    then:
      field: description
      function: truthy
  schema-properties-snake-case:
    description: Schema property names should use snake_case.
    given: $.components.schemas[*].properties
    severity: info
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_]*$
  schema-description-required:
    description: Top-level schemas should have descriptions.
    given: $.components.schemas[*]
    severity: warn
    then:
      field: description
      function: truthy
  schema-type-required:
    description: Schemas must have a type defined.
    given: $.components.schemas[*]
    severity: error
    then:
      field: type
      function: truthy
  security-defined:
    description: Global security must be defined.
    given: $
    severity: error
    then:
      field: security
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components.
    given: $.components
    severity: error
    then:
      field: securitySchemes
      function: truthy
  security-bearer-scheme:
    description: Bearer authentication should be used.
    given: $.components.securitySchemes[*]
    severity: info
    then:
      field: scheme
      function: pattern
      functionOptions:
        match: ^bearer$
  get-no-request-body:
    description: GET operations should not have a request body.
    given: $.paths[*].get
    severity: error
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not have a request body.
    given: $.paths[*].delete
    severity: warn
    then:
      field: requestBody
      function: falsy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    given: $..description
    severity: error
    then:
      function: truthy
  examples-encouraged:
    description: Schema properties should include example values.
    given: $.components.schemas[*].properties[*]
    severity: info
    then:
      field: example
      function: truthy
  pagination-cursor-pattern:
    description: Pagination should use cursor-based pagination with before/after.
    given: $.components.schemas.Paging
    severity: info
    then:
      field: properties
      function: truthy
  servers-expected-domain:
    description: Server URLs should be on the facebook.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: facebook\.com
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/facebook-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.