GitHub · API Governance Rules

GitHub API Rules

Spectral linting rules defining API design standards and conventions for GitHub.

20 Rules error 14 warn 3 info 3
Authorship not recorded No authorship marker is recorded for this file. It is not presented as the provider's; it was most likely written by an API Evangelist pass before outputs were stamped.
View Rules File View on GitHub

Rule Categories

get info no operation parameter paths response security servers tags

Rules

error
info-title-required
$.info
warn
info-title-format
$.info.title
error
info-description-required
$.info
error
info-version-required
$.info
error
servers-defined
$
error
servers-https-only
$.servers[*].url
error
paths-no-trailing-slash
$.paths
info
paths-kebab-case
Path segments should use kebab-case or snake_case.
$.paths
error
operation-description-required
$.paths[*][get,post,put,patch,delete]
error
operation-operationid-required
$.paths[*][get,post,put,patch,delete]
error
operation-operationid-unique
$
warn
operation-tags-required
$.paths[*][get,post,put,patch,delete]
info
tags-title-case
$.tags[*].name
error
parameter-description-required
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameter-snake-case
Parameter names should use snake_case (GitHub convention).
$.paths[*][get,post,put,patch,delete].parameters[*]
error
response-success-required
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
$.paths[*][get,post,put,patch,delete].responses[*]
warn
security-schemes-defined
$.components
error
get-no-request-body
$.paths[*].get
error
no-empty-descriptions
$..description

Spectral Ruleset

Raw ↑ 
rules:
  info-title-required:
    severity: error
    given: $.info
    then: {field: title, function: truthy}
  info-title-format:
    severity: warn
    given: $.info.title
    then: {function: pattern, functionOptions: {match: "^GitHub "}}
  info-description-required:
    severity: error
    given: $.info
    then: {field: description, function: truthy}
  info-version-required:
    severity: error
    given: $.info
    then: {field: version, function: truthy}
  servers-defined:
    severity: error
    given: $
    then: {field: servers, function: truthy}
  servers-https-only:
    severity: error
    given: $.servers[*].url
    then: {function: pattern, functionOptions: {match: "^https://"}}
  paths-no-trailing-slash:
    severity: error
    given: $.paths
    then: {field: "@key", function: pattern, functionOptions: {notMatch: "\\/$"}}
  paths-kebab-case:
    severity: info
    description: Path segments should use kebab-case or snake_case.
    given: $.paths
    then: {field: "@key", function: pattern, functionOptions: {notMatch: "\\/[a-z]+[A-Z]"}}
  operation-description-required:
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then: {field: description, function: truthy}
  operation-operationid-required:
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then: {field: operationId, function: truthy}
  operation-operationid-unique:
    severity: error
    given: $
    then: {function: oasOpId}
  operation-tags-required:
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then: {field: tags, function: truthy}
  tags-title-case:
    severity: info
    given: $.tags[*].name
    then: {function: pattern, functionOptions: {match: "^[A-Z][a-zA-Z0-9]*(\\s[A-Za-z0-9]+)*$"}}
  parameter-description-required:
    severity: error
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then: {field: description, function: truthy}
  parameter-snake-case:
    severity: info
    description: Parameter names should use snake_case (GitHub convention).
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then: {field: name, function: pattern, functionOptions: {match: "^[a-z][a-z0-9_]*$"}}
  response-success-required:
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then: {function: schema, functionOptions: {schema: {anyOf: [{required: ["200"]}, {required: ["201"]}, {required: ["204"]}]}}}
  response-description-required:
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then: {field: description, function: truthy}
  security-schemes-defined:
    severity: warn
    given: $.components
    then: {field: securitySchemes, function: truthy}
  get-no-request-body:
    severity: error
    given: $.paths[*].get
    then: {field: requestBody, function: falsy}
  no-empty-descriptions:
    severity: error
    given: "$..description"
    then: {function: truthy}

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/github-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.