NatWest Group API Rules

# authorship: generated by API Evangelist tooling (derive-rules.py, 2026-11-01). x-method: generated
# Every rule below was MEASURED against NatWest Group's own contract before it was written; a rule is present only
# when the contract satisfies it at 80% or more. Severity: 100% -> error, >= 90% -> warn, else info.
# Provenance:
#   - operation-has-operationid: 100%
#   - operationid-casing-pascal: 100%
#   - operation-has-summary: 100%
#   - operation-has-tags: 100%
#   - operation-has-success-response: 100%
#   - operation-declares-4xx: 100%
#   - operation-declares-401-or-403: 100%
#   - operation-declares-429: 100%
#   - operation-secured: 100%
#   - path-segment-casing-kebab: 100%
#   - path-no-trailing-slash: 100%
#   - path-params-in-braces: 100%
#   - write-declares-request-body: 100%
#   - info-has-description: 100%
#   - info-has-contact-or-terms: 100%
#   - info-title-present: 100%
#   - info-title-min-length: 95%
#   - info-description-present: 100%
#   - info-description-min-length: 100%
#   - info-termsofservice-present: 100%
#   - info-termsofservice-https: 100%
#   - info-contact-present: 100%
#   - info-license-present: 100%
#   - info-version-present: 100%
#   - info-version-semver: 100%
#   - contact-name-present: 100%
#   - contact-email-present: 100%
#   - license-name-present: 100%
#   - license-url-present: 100%
#   - license-url-https: 100%
#   - server-url-present: 100%
#   - tag-name-present: 100%
#   - operation-tags-present: 100%
#   - operation-summary-present: 100%
#   - operation-summary-min-length: 97%
#   - operation-operationid-present: 100%
#   - operation-operationid-casing-pascal: 100%
#   - operation-parameters-present: 100%
#   - operation-responses-present: 100%
#   - operation-security-present: 100%
#   - requestbody-description-present: 100%
#   - requestbody-content-present: 100%
#   - requestbody-required-present: 100%
#   - schema-type-present: 100%
#   - schema-type-values: 99%
#   - schema-description-present: 85%
#   - schema-description-min-length: 99%
#   - schema-format-values: 100%
#   - securityscheme-type-present: 100%
#   - securityscheme-type-values: 100%
#   - securityscheme-description-present: 100%
#   - securityscheme-flows-present: 100%
#   - oauthflow-authorizationurl-https: 100%
#   - oauthflow-tokenurl-present: 100%
#   - oauthflow-tokenurl-https: 100%
#   - oauthflow-scopes-present: 100%
x-method: generated
x-generator: derive-rules.py
x-generated: '2026-11-01'
x-source:
- openapi/natwest-account-access-api-openapi.yml
- openapi/natwest-accounts-api-openapi.yml
- openapi/natwest-balances-api-openapi.yml
- openapi/natwest-beneficiaries-api-openapi.yml
- openapi/natwest-direct-debits-api-openapi.yml
x-self-check:
  status: checked
  rules: 56
  dropped: {}
extends:
- - spectral:oas
  - recommended
formats:
- oas3
rules:
  operation-has-operationid:
    description: 'Every operation declares an operationId (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
    x-pattern-key: Operation.operationId|present
  operationid-casing-pascal:
    description: 'operationIds are pascal case (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][a-zA-Z0-9]*$
    x-pattern-key: Operation.operationId|pattern:^[A-Z][a-zA-Z0-9]*$
  operation-has-summary:
    description: 'Every operation has a summary (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
    x-pattern-key: Operation.summary|present
  operation-has-tags:
    description: 'Every operation is tagged (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
    x-pattern-key: Operation.tags|present
  operation-has-success-response:
    description: 'Every operation declares a 2xx response (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          patternProperties:
            ^2\d\d$: {}
          minProperties: 1
    x-pattern-key: Operation.responses|schema:07e20b47
  operation-declares-4xx:
    description: 'Every operation declares at least one 4xx response (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          patternProperties:
            ^4\d\d$: {}
          minProperties: 1
    x-pattern-key: Operation.responses|schema:4aea4da4
  operation-declares-401-or-403:
    description: 'Every operation declares 401 or 403 (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '401'
          - required:
            - '403'
    x-pattern-key: Operation.responses|schema:f26ae517
  operation-declares-429:
    description: 'Every operation declares 429 (rate limited) (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '429'
      function: truthy
    x-pattern-key: Responses.{key}|present
  operation-secured:
    description: 'Every operation declares its own security requirement (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: security
      function: truthy
    x-pattern-key: Operation.security|present
  path-segment-casing-kebab:
    description: 'Path segments are kebab case (measured: 100% of this contract)'
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(/[a-z0-9]+(-[a-z0-9]+)*|/\{[^}]+\})+/?$
    x-pattern-key: Paths.{key}|pattern:^(/[a-z0-9]+(-[a-z0-9]+)*|/\{[^}]+\})+/?$
  path-no-trailing-slash:
    description: 'Paths carry no trailing slash (measured: 100% of this contract)'
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: ./$
    x-pattern-key: Paths.{key}|pattern:!./$
  path-params-in-braces:
    description: 'Path parameters use {braces}, not :colon (measured: 100% of this contract)'
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: ':'
    x-pattern-key: 'Paths.{key}|pattern:!:'
  write-declares-request-body:
    description: 'POST and PUT declare a request body (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][post,put]
    then:
      field: requestBody
      function: truthy
    x-pattern-key: Operation.requestBody|present
  info-has-description:
    description: 'The contract''s info block carries a description (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: description
      function: truthy
    x-pattern-key: Info.description|present
  info-has-contact-or-terms:
    description: 'The contract''s info block names a contact or terms of service (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      function: schema
      functionOptions:
        schema:
          anyOf:
          - required:
            - contact
          - required:
            - termsOfService
    x-pattern-key: OpenAPI.info|schema:093268bf
  info-title-present:
    description: 'Info declares title (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: title
      function: defined
    x-pattern-key: Info.title|present
  info-title-min-length:
    description: 'Info.title runs at least 38 characters (measured: 95% of this contract)'
    severity: warn
    given: $.info.title
    then:
      function: length
      functionOptions:
        min: 38
    x-pattern-key: Info.title|length
  info-description-present:
    description: 'Info declares description (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: description
      function: defined
    x-pattern-key: Info.description|present
  info-description-min-length:
    description: 'Info.description runs at least 48 characters (measured: 100% of this contract)'
    severity: error
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 48
    x-pattern-key: Info.description|length
  info-termsofservice-present:
    description: 'Info declares termsOfService (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: termsOfService
      function: defined
    x-pattern-key: Info.termsOfService|present
  info-termsofservice-https:
    description: 'Info.termsOfService is https (measured: 100% of this contract)'
    severity: error
    given: $.info.termsOfService
    then:
      function: pattern
      functionOptions:
        match: ^https://
    x-pattern-key: Info.termsOfService|pattern:^https://
  info-contact-present:
    description: 'Info declares contact (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: contact
      function: defined
    x-pattern-key: Info.contact|present
  info-license-present:
    description: 'Info declares license (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: license
      function: defined
    x-pattern-key: Info.license|present
  info-version-present:
    description: 'Info declares version (measured: 100% of this contract)'
    severity: error
    given: $.info
    then:
      field: version
      function: defined
    x-pattern-key: Info.version|present
  info-version-semver:
    description: 'info.version is numeric (measured: 100% of this contract)'
    severity: error
    given: $.info.version
    then:
      function: pattern
      functionOptions:
        match: ^v?\d+(\.\d+)*
    x-pattern-key: Info.version|pattern:^v?\d+(\.\d+)*
  contact-name-present:
    description: 'Contact declares name (measured: 100% of this contract)'
    severity: error
    given: $.info.contact
    then:
      field: name
      function: defined
    x-pattern-key: Contact.name|present
  contact-email-present:
    description: 'Contact declares email (measured: 100% of this contract)'
    severity: error
    given: $.info.contact
    then:
      field: email
      function: defined
    x-pattern-key: Contact.email|present
  license-name-present:
    description: 'License declares name (measured: 100% of this contract)'
    severity: error
    given: $.info.license
    then:
      field: name
      function: defined
    x-pattern-key: License.name|present
  license-url-present:
    description: 'License declares url (measured: 100% of this contract)'
    severity: error
    given: $.info.license
    then:
      field: url
      function: defined
    x-pattern-key: License.url|present
  license-url-https:
    description: 'License.url is https (measured: 100% of this contract)'
    severity: error
    given: $.info.license.url
    then:
      function: pattern
      functionOptions:
        match: ^https://
    x-pattern-key: License.url|pattern:^https://
  server-url-present:
    description: 'Server declares url (measured: 100% of this contract)'
    severity: error
    given: $.servers[*]
    then:
      field: url
      function: defined
    x-pattern-key: Server.url|present
  tag-name-present:
    description: 'Tag declares name (measured: 100% of this contract)'
    severity: error
    given: $.tags[*]
    then:
      field: name
      function: defined
    x-pattern-key: Tag.name|present
  operation-tags-present:
    description: 'Operation declares tags (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: tags
      function: defined
    x-pattern-key: Operation.tags|present
  operation-summary-present:
    description: 'Operation declares summary (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: summary
      function: defined
    x-pattern-key: Operation.summary|present
  operation-summary-min-length:
    description: 'Operation.summary runs at least 11 characters (measured: 97% of this contract)'
    severity: warn
    given: $.paths[*][get,put,post,delete,patch,options,head,trace].summary
    then:
      function: length
      functionOptions:
        min: 11
    x-pattern-key: Operation.summary|length
  operation-operationid-present:
    description: 'Operation declares operationId (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: operationId
      function: defined
    x-pattern-key: Operation.operationId|present
  operation-operationid-casing-pascal:
    description: 'Operation.operationId is pascal case (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z][a-zA-Z0-9]*$
    x-pattern-key: Operation.operationId|pattern:^[A-Z][a-zA-Z0-9]*$
  operation-parameters-present:
    description: 'Operation declares parameters (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: parameters
      function: defined
    x-pattern-key: Operation.parameters|present
  operation-responses-present:
    description: 'Operation declares responses (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: responses
      function: defined
    x-pattern-key: Operation.responses|present
  operation-security-present:
    description: 'Operation declares security (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace]
    then:
      field: security
      function: defined
    x-pattern-key: Operation.security|present
  requestbody-description-present:
    description: 'RequestBody declares description (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace].requestBody
    then:
      field: description
      function: defined
    x-pattern-key: RequestBody.description|present
  requestbody-content-present:
    description: 'RequestBody declares content (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace].requestBody
    then:
      field: content
      function: defined
    x-pattern-key: RequestBody.content|present
  requestbody-required-present:
    description: 'RequestBody declares required (measured: 100% of this contract)'
    severity: error
    given: $.paths[*][get,put,post,delete,patch,options,head,trace].requestBody
    then:
      field: required
      function: defined
    x-pattern-key: RequestBody.required|present
  schema-type-present:
    description: 'Schema declares type (measured: 100% of this contract)'
    severity: error
    given: $.components.schemas[*]
    then:
      field: type
      function: defined
    x-pattern-key: Schema.type|present
  schema-type-values:
    description: 'Schema.type is one of object, string (measured: 99% of this contract)'
    severity: warn
    given: $.components.schemas[*].type
    then:
      function: enumeration
      functionOptions:
        values:
        - object
        - string
    x-pattern-key: Schema.type|enum:object,string
  schema-description-present:
    description: 'Schema declares description (measured: 85% of this contract)'
    severity: info
    given: $.components.schemas[*]
    then:
      field: description
      function: defined
    x-pattern-key: Schema.description|present
  schema-description-min-length:
    description: 'Schema.description runs at least 29 characters (measured: 98% of this contract)'
    severity: warn
    given: $.components.schemas[*].description
    then:
      function: length
      functionOptions:
        min: 29
    x-pattern-key: Schema.description|length
  schema-format-values:
    description: 'Schema.format is one of date-time (measured: 100% of this contract)'
    severity: error
    given: $.components.schemas[*].format
    then:
      function: enumeration
      functionOptions:
        values:
        - date-time
    x-pattern-key: Schema.format|enum:date-time
  securityscheme-type-present:
    description: 'SecurityScheme declares type (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*]
    then:
      field: type
      function: defined
    x-pattern-key: SecurityScheme.type|present
  securityscheme-type-values:
    description: 'SecurityScheme.type is one of oauth2 (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*].type
    then:
      function: enumeration
      functionOptions:
        values:
        - oauth2
    x-pattern-key: SecurityScheme.type|enum:oauth2
  securityscheme-description-present:
    description: 'SecurityScheme declares description (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*]
    then:
      field: description
      function: defined
    x-pattern-key: SecurityScheme.description|present
  securityscheme-flows-present:
    description: 'SecurityScheme declares flows (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*]
    then:
      field: flows
      function: defined
    x-pattern-key: SecurityScheme.flows|present
  oauthflow-authorizationurl-https:
    description: 'OAuthFlow.authorizationUrl is https (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*].flows[*].authorizationUrl
    then:
      function: pattern
      functionOptions:
        match: ^https://
    x-pattern-key: OAuthFlow.authorizationUrl|pattern:^https://
  oauthflow-tokenurl-present:
    description: 'OAuthFlow declares tokenUrl (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*].flows[*]
    then:
      field: tokenUrl
      function: defined
    x-pattern-key: OAuthFlow.tokenUrl|present
  oauthflow-tokenurl-https:
    description: 'OAuthFlow.tokenUrl is https (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*].flows[*].tokenUrl
    then:
      function: pattern
      functionOptions:
        match: ^https://
    x-pattern-key: OAuthFlow.tokenUrl|pattern:^https://
  oauthflow-scopes-present:
    description: 'OAuthFlow declares scopes (measured: 100% of this contract)'
    severity: error
    given: $.components.securitySchemes[*].flows[*]
    then:
      field: scopes
      function: defined
    x-pattern-key: OAuthFlow.scopes|present