grubhub · API Governance Rules

grubhub API Rules

Spectral linting rules defining API design standards and conventions for grubhub.

51 Rules error 8 warn 29 info 14
View Rules File View on GitHub

Rule Categories

delete error external get info no openapi operation parameter path paths query request response schema security servers tag tags

Rules

warn
info-title-grubhub-prefix
API title should start with "Grubhub".
$.info.title
warn
info-description-required
Info object must have a non-trivial description.
$.info
info
info-description-min-length
Info description should be reasonably descriptive.
$.info.description
error
info-version-required
API version must be defined.
$.info
info
info-contact-required
A contact object should be present.
$.info
info
info-terms-of-service
Terms of service should be linked.
$.info
warn
openapi-version-3-1
Grubhub specs use OpenAPI 3.1.0.
$.openapi
error
servers-defined
At least one server must be defined.
$.servers
error
servers-https-only
Server URLs must use HTTPS.
$.servers[*].url
info
servers-description
Each server should have a description.
$.servers[*]
warn
paths-pos-v1-prefix
Grubhub partner paths are namespaced under /pos/v1/.
$.paths[*]~
warn
paths-no-trailing-slash
Paths must not end with a trailing slash.
$.paths[*]~
warn
paths-snake-case-params
Path templating uses snake_case parameter names.
$.paths[*]~
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-grubhub-prefix
Operation summaries should start with "Grubhub".
$.paths[*][get,post,put,patch,delete].summary
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,patch,delete]
error
operation-operationid-required
Every operation must have an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-operationid-camelcase
operationId must be camelCase.
$.paths[*][get,post,put,patch,delete].operationId
info
operation-operationid-verb-prefix
operationId should start with a recognized verb prefix.
$.paths[*][get,post,put,patch,delete].operationId
warn
operation-tags-required
Every operation must be tagged.
$.paths[*][get,post,put,patch,delete]
info
operation-microcks-extension
Operations should carry an x-microcks-operation extension for mock compatibility.
$.paths[*][get,post,put,patch,delete]
info
tags-global-defined
Global tags array should be defined.
$
info
tag-description-required
Each global tag should have a description.
$.tags[*]
warn
tag-title-case
Tag names use Title Case (each word capitalized).
$.tags[*].name
warn
parameter-description-required
Parameters must have a description.
$.paths[*][*].parameters[*]
warn
parameter-snake-case
Parameter names use snake_case.
$.paths[*][*].parameters[?(@.name)].name
warn
parameter-schema-typed
Parameters must declare a schema type.
$.paths[*][*].parameters[*].schema
warn
parameter-component-description
Shared parameter components must have a description.
$.components.parameters[*]
warn
request-body-json
Request bodies should offer application/json content.
$.paths[*][post,put,patch].requestBody.content
error
response-success-defined
Each operation must define a 2xx success response.
$.paths[*][get,post,put,patch,delete].responses
info
response-auth-failure-defined
Operations should document a 401 authentication-failure response.
$.paths[*][get,post,put,patch,delete].responses
warn
response-description-required
Each response must have a description.
$.paths[*][*].responses[*]
warn
schema-property-snake-case
Schema properties use snake_case.
$.components.schemas[*].properties[*]~
warn
schema-description-required
Top-level component schemas must have a description.
$.components.schemas[*]
warn
schema-property-typed
Schema properties must declare a type or $ref.
$.components.schemas[*].properties[*]
info
schema-error-envelope
The Error schema should expose error, message, and status fields.
$.components.schemas.Error.properties
warn
security-global-defined
A global security requirement should be declared.
$
error
security-schemes-defined
Security schemes must be defined under components.
$.components
info
security-scheme-description
Each security scheme should be described.
$.components.securitySchemes[*]
info
security-hmac-authorization-header
HMAC scheme should be carried in the Authorization header.
$.components.securitySchemes.hmacAuth
error
get-no-request-body
GET operations must not declare a request body.
$.paths[*].get
warn
delete-no-request-body
DELETE operations should not declare a request body.
$.paths[*].delete
info
external-docs-encouraged
Specs are encouraged to link external documentation.
$
info
operation-examples-encouraged
JSON responses are encouraged to provide examples for mocking.
$.paths[*][*].responses[*].content.application/json
warn
servers-expected-domain
Server URLs should be on the grubhub.com domain.
$.servers[*].url
warn
path-params-casing
Path parameters should be snake_case (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
warn
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
error-schema-defined
A shared error schema (Error) should be defined for error payloads.
$.components.schemas
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# grubhub — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 12/12 servers on grubhub.com
#   - path-params-casing: snake @ 100% (n=31)
#   - query-params-casing: snake @ 100% (n=6)
#   - operationid-casing: camel @ 100% (n=35)
#   - schema-names-casing: pascal @ 100% (n=51)
#   - schema-properties-casing: snake @ 100% (n=189)
#   - security: global (root) — NOT emitting operation-security-required
#   - error-schema-defined: Error
#   - operation-documents-401: 100% adherence
#   - merge: kept 44 existing, added 7 measured, upgraded 0
#   - added: servers-expected-domain, path-params-casing, query-params-casing, schema-names-casing, schema-properties-casing, error-schema-defined, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-grubhub-prefix:
    description: API title should start with "Grubhub".
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Grubhub
  info-description-required:
    description: Info object must have a non-trivial description.
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-description-min-length:
    description: Info description should be reasonably descriptive.
    severity: info
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 40
  info-version-required:
    description: API version must be defined.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-contact-required:
    description: A contact object should be present.
    severity: info
    given: $.info
    then:
      field: contact
      function: truthy
  info-terms-of-service:
    description: Terms of service should be linked.
    severity: info
    given: $.info
    then:
      field: termsOfService
      function: truthy
  openapi-version-3-1:
    description: Grubhub specs use OpenAPI 3.1.0.
    severity: warn
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.1\.
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: $.servers
    then:
      function: truthy
  servers-https-only:
    description: Server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-description:
    description: Each server should have a description.
    severity: info
    given: $.servers[*]
    then:
      field: description
      function: truthy
  paths-pos-v1-prefix:
    description: Grubhub partner paths are namespaced under /pos/v1/.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^/pos/v1/
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: .+/$
  paths-snake-case-params:
    description: Path templating uses snake_case parameter names.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \{[a-z]+[A-Z]
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-grubhub-prefix:
    description: Operation summaries should start with "Grubhub".
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: '^Grubhub '
  operation-description-required:
    description: Every operation must have a description.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-operationid-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-operationid-camelcase:
    description: operationId must be camelCase.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: casing
      functionOptions:
        type: camel
  operation-operationid-verb-prefix:
    description: operationId should start with a recognized verb prefix.
    severity: info
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^(get|list|create|update|delete|confirm|poll|ingest|retrieve|report|activate|deactivate|associate|cancel)
  operation-tags-required:
    description: Every operation must be tagged.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-microcks-extension:
    description: Operations should carry an x-microcks-operation extension for mock compatibility.
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy
  tags-global-defined:
    description: Global tags array should be defined.
    severity: info
    given: $
    then:
      field: tags
      function: truthy
  tag-description-required:
    description: Each global tag should have a description.
    severity: info
    given: $.tags[*]
    then:
      field: description
      function: truthy
  tag-title-case:
    description: Tag names use Title Case (each word capitalized).
    severity: warn
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z]*( [A-Z][A-Za-z]*)*$
  parameter-description-required:
    description: Parameters must have a description.
    severity: warn
    given: $.paths[*][*].parameters[*]
    then:
      field: description
      function: truthy
  parameter-snake-case:
    description: Parameter names use snake_case.
    severity: warn
    given: $.paths[*][*].parameters[?(@.name)].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_]*$
  parameter-schema-typed:
    description: Parameters must declare a schema type.
    severity: warn
    given: $.paths[*][*].parameters[*].schema
    then:
      field: type
      function: truthy
  parameter-component-description:
    description: Shared parameter components must have a description.
    severity: warn
    given: $.components.parameters[*]
    then:
      field: description
      function: truthy
  request-body-json:
    description: Request bodies should offer application/json content.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-success-defined:
    description: Each operation must define a 2xx success response.
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  response-auth-failure-defined:
    description: Operations should document a 401 authentication-failure response.
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  response-description-required:
    description: Each response must have a description.
    severity: warn
    given: $.paths[*][*].responses[*]
    then:
      field: description
      function: truthy
  schema-property-snake-case:
    description: Schema properties use snake_case.
    severity: warn
    given: $.components.schemas[*].properties[*]~
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9_]*$
  schema-description-required:
    description: Top-level component schemas must have a description.
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schema-property-typed:
    description: Schema properties must declare a type or $ref.
    severity: warn
    given: $.components.schemas[*].properties[*]
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - type
          - required:
            - $ref
          - required:
            - allOf
          - required:
            - oneOf
  schema-error-envelope:
    description: The Error schema should expose error, message, and status fields.
    severity: info
    given: $.components.schemas.Error.properties
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - error
          - message
          - status
  security-global-defined:
    description: A global security requirement should be declared.
    severity: warn
    given: $
    then:
      field: security
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined under components.
    severity: error
    given: $.components
    then:
      field: securitySchemes
      function: truthy
  security-scheme-description:
    description: Each security scheme should be described.
    severity: info
    given: $.components.securitySchemes[*]
    then:
      field: description
      function: truthy
  security-hmac-authorization-header:
    description: HMAC scheme should be carried in the Authorization header.
    severity: info
    given: $.components.securitySchemes.hmacAuth
    then:
      field: name
      function: pattern
      functionOptions:
        match: ^Authorization$
  get-no-request-body:
    description: GET operations must not declare a request body.
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  delete-no-request-body:
    description: DELETE operations should not declare a request body.
    severity: warn
    given: $.paths[*].delete
    then:
      field: requestBody
      function: falsy
  external-docs-encouraged:
    description: Specs are encouraged to link external documentation.
    severity: info
    given: $
    then:
      field: externalDocs
      function: truthy
  operation-examples-encouraged:
    description: JSON responses are encouraged to provide examples for mocking.
    severity: info
    given: $.paths[*][*].responses[*].content.application/json
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - example
          - required:
            - examples
  servers-expected-domain:
    description: Server URLs should be on the grubhub.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: grubhub\.com
  path-params-casing:
    description: Path parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: snake
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  error-schema-defined:
    description: A shared error schema (Error) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Error
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy