Flipdish · API Governance Rules

Flipdish API Rules

Spectral linting rules defining API design standards and conventions for Flipdish.

37 Rules error 10 warn 20 info 7
Generated by API Evangelist Written by API Evangelist tooling for Flipdish's APIs. It is a starting point, not a ruleset Flipdish publishes or enforces.
View Rules File View on GitHub

Rule Categories

delete error get global info no openapi operation parameter paths query request response schema security servers tag tags

Rules

warn
info-title-flipdish-prefix
API title should start with 'Flipdish'.
$.info.title
warn
info-description-required
The info block must have a description.
$.info
error
info-version-required
The info block must declare a version.
$.info
warn
info-contact-email-flipdish
Contact email must be help@flipdish.com (per Flipdish API Design Guide).
$.info.contact.email
error
openapi-version-3
Specs must be OpenAPI 3.0.x.
$.openapi
error
servers-defined
A servers array must be defined.
$
error
servers-flipdish-production-only
Only Flipdish production domains (https://api.flipdish.co) are allowed as server URLs.
$.servers[*].url
warn
paths-no-trailing-slash
Paths should not end with a trailing slash.
$.paths
warn
paths-lower-camel-segments
Path segments should be lowerCamelCase (Flipdish convention), parameters in {braces}.
$.paths
error
operation-summary-required
Every operation must have a summary (Flipdish API Design Guide).
$.paths[*][get,post,put,delete,patch]
info
operation-summary-flipdish-prefix
Operation summaries should begin with 'Flipdish'.
$.paths[*][get,post,put,delete,patch].summary
error
operation-description-required
Every operation must have a description (Flipdish API Design Guide).
$.paths[*][get,post,put,delete,patch]
error
operation-operationid-required
Every operation must declare an operationId.
$.paths[*][get,post,put,delete,patch]
info
operation-operationid-pascal-case
operationId uses PascalCase (Flipdish convention, e.g. GetAccountDetails).
$.paths[*][get,post,put,delete,patch].operationId
warn
operation-tags-required
Every operation must be tagged.
$.paths[*][get,post,put,delete,patch]
info
tag-description-required
Global tags should have descriptions.
$.tags[*]
info
tags-pascal-case
Tags use PascalCase resource names (Flipdish convention, e.g. Stores, MenuSections).
$.tags[*].name
warn
parameter-description-required
Parameters must have descriptions.
$.paths[*][*].parameters[*]
warn
parameter-schema-required
Parameters must declare a schema with a type.
$.paths[*][*].parameters[?(@.in)]
info
request-body-json
Request bodies should offer application/json content.
$.paths[*][post,put,patch].requestBody.content
error
response-approved-status-codes
Only Flipdish-approved status codes may be used.
$.paths[*][*].responses.*~
info
response-unauthorized-defined
Operations should document a 401 Unauthorized response.
$.paths[*][get,post,put,delete,patch].responses
warn
response-error-object
4xx/5xx JSON responses must include an 'error' object (Flipdish error format).
$.paths[*][*].responses[400,401,403,404,409,414,429,500].content[application/json].schema
warn
global-security-defined
A global security requirement must be defined (OAuth 2.0).
$
error
security-scheme-oauth2
The oauth2 security scheme must be defined in components.
$.components.securitySchemes
info
schema-properties-typed
Schema properties should declare a type, $ref, or composition keyword.
$.components.schemas[*].properties[*]
error
get-no-request-body
GET operations must not declare a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not declare a request body.
$.paths[*].delete
warn
servers-expected-domain
Server URLs should be on the flipdish.co domain.
$.servers[*].url
warn
query-params-casing
Query parameters should be camelCase (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
warn
schema-properties-casing
Schema properties should be PascalCase (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (FlipdishError) should be defined for error payloads.
$.components.schemas
warn
operation-documents-400
Operations should document a 400 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
operation-documents-403
Operations should document a 403 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
operation-documents-500
Operations should document a 500 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# flipdish — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 10/10 servers on flipdish.co
#   - path-params-casing: camel @ 97% (n=931)
#   - query-params-casing: camel @ 65% (n=439)
#   - operationid-casing: pascal @ 90% (n=591)
#   - schema-names-casing: pascal @ 75% (n=939)
#   - schema-properties-casing: pascal @ 100% (n=5997)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: FlipdishError
#   - operation-documents-400: 100% adherence
#   - operation-documents-401: 100% adherence
#   - operation-documents-403: 100% adherence
#   - operation-documents-500: 100% adherence
#   - pagination params observed: ['limit', 'page', 'pageSize']
#   - merge: kept 28 existing, added 9 measured, upgraded 0
#   - added: servers-expected-domain, query-params-casing, schema-names-casing, schema-properties-casing, error-schema-defined, operation-documents-400, operation-documents-403, operation-documents-500, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-flipdish-prefix:
    description: API title should start with 'Flipdish'.
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Flipdish
  info-description-required:
    description: The info block must have a description.
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: The info block must declare a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-email-flipdish:
    description: Contact email must be help@flipdish.com (per Flipdish API Design Guide).
    severity: warn
    given: $.info.contact.email
    then:
      function: pattern
      functionOptions:
        match: ^help@flipdish\.com$
  openapi-version-3:
    description: Specs must be OpenAPI 3.0.x.
    severity: error
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.0\.
  servers-defined:
    description: A servers array must be defined.
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-flipdish-production-only:
    description: Only Flipdish production domains (https://api.flipdish.co) are allowed as server URLs.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://api\.flipdish\.co($|/)
  paths-no-trailing-slash:
    description: Paths should not end with a trailing slash.
    severity: warn
    given: $.paths
    then:
      field: '@key'
      function: pattern
      functionOptions:
        notMatch: .+/$
  paths-lower-camel-segments:
    description: Path segments should be lowerCamelCase (Flipdish convention), parameters in {braces}.
    severity: warn
    given: $.paths
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: ^(/(\{[a-zA-Z0-9_]+\}|[a-z][a-zA-Z0-9.]*))+$
  operation-summary-required:
    description: Every operation must have a summary (Flipdish API Design Guide).
    severity: error
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: summary
      function: truthy
  operation-summary-flipdish-prefix:
    description: Operation summaries should begin with 'Flipdish'.
    severity: info
    given: $.paths[*][get,post,put,delete,patch].summary
    then:
      function: pattern
      functionOptions:
        match: ^Flipdish
  operation-description-required:
    description: Every operation must have a description (Flipdish API Design Guide).
    severity: error
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: description
      function: truthy
  operation-operationid-required:
    description: Every operation must declare an operationId.
    severity: error
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: operationId
      function: truthy
  operation-operationid-pascal-case:
    description: operationId uses PascalCase (Flipdish convention, e.g. GetAccountDetails).
    severity: info
    given: $.paths[*][get,post,put,delete,patch].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]+$
  operation-tags-required:
    description: Every operation must be tagged.
    severity: warn
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: tags
      function: truthy
  tag-description-required:
    description: Global tags should have descriptions.
    severity: info
    given: $.tags[*]
    then:
      field: description
      function: truthy
  tags-pascal-case:
    description: Tags use PascalCase resource names (Flipdish convention, e.g. Stores, MenuSections).
    severity: info
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]+$
  parameter-description-required:
    description: Parameters must have descriptions.
    severity: warn
    given: $.paths[*][*].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: Parameters must declare a schema with a type.
    severity: warn
    given: $.paths[*][*].parameters[?(@.in)]
    then:
      field: schema
      function: truthy
  request-body-json:
    description: Request bodies should offer application/json content.
    severity: info
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-approved-status-codes:
    description: Only Flipdish-approved status codes may be used.
    severity: error
    given: $.paths[*][*].responses.*~
    then:
      function: enumeration
      functionOptions:
        values:
        - '200'
        - '201'
        - '204'
        - '400'
        - '401'
        - '403'
        - '404'
        - '409'
        - '414'
        - '429'
        - '500'
        - default
  response-unauthorized-defined:
    description: Operations should document a 401 Unauthorized response.
    severity: info
    given: $.paths[*][get,post,put,delete,patch].responses
    then:
      field: '401'
      function: truthy
  response-error-object:
    description: 4xx/5xx JSON responses must include an 'error' object (Flipdish error format).
    severity: warn
    given: $.paths[*][*].responses[400,401,403,404,409,414,429,500].content[application/json].schema
    then:
      function: truthy
  global-security-defined:
    description: A global security requirement must be defined (OAuth 2.0).
    severity: warn
    given: $
    then:
      field: security
      function: truthy
  security-scheme-oauth2:
    description: The oauth2 security scheme must be defined in components.
    severity: error
    given: $.components.securitySchemes
    then:
      field: oauth2
      function: truthy
  schema-properties-typed:
    description: Schema properties should declare a type, $ref, or composition keyword.
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - type
          - required:
            - $ref
          - required:
            - allOf
          - required:
            - oneOf
          - required:
            - anyOf
  get-no-request-body:
    description: GET operations must not declare a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not declare a request body.
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  servers-expected-domain:
    description: Server URLs should be on the flipdish.co domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: flipdish\.co
  query-params-casing:
    description: Query parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: camel
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]*$
  schema-properties-casing:
    description: Schema properties should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]*$
  error-schema-defined:
    description: A shared error schema (FlipdishError) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: FlipdishError
      function: truthy
  operation-documents-400:
    description: Operations should document a 400 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '400'
      function: truthy
  operation-documents-403:
    description: Operations should document a 403 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '403'
      function: truthy
  operation-documents-500:
    description: Operations should document a 500 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '500'
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/flipdish-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.