Queensland University of Technology API Rules

# This file was generated by API Evangelist for the qut profile on 2026-09-01. It was NOT published
# by Queensland University of Technology. The `method:` key states how the content was obtained and
# `source:` names the live URLs it was read from.
specification: API Evangelist Rules
specificationVersion: '0.1'
provider: Queensland University of Technology
providerId: qut
generated: '2026-09-01'
method: derived
source: >-
  Authored from the observed behaviour of QUT's three institution-operated surfaces, probed
  2026-09-01. These are governance rules an integrator or a reviewer can apply to QUT's contracts;
  they are API Evangelist's rules about QUT's surfaces, not rules QUT publishes.
description: >-
  A Spectral-shaped ruleset for the contracts in this repository. It encodes the three things that
  actually bite when integrating with QUT — an OAI-PMH endpoint that returns 200 on failure, an
  authorization server advertising retired grants, and a REST index whose entries are all 401 —
  plus the operator discipline this repository is built on.
formats: [oas3]
rules:
  qut-operator-declared:
    description: Every contract in this repository must declare info.x-operator, so no artifact can be silently credited to the institution.
    severity: error
    given: $.info
    then:
      field: x-operator
      function: truthy
  qut-operator-institution-only:
    description: >-
      Only an institution-operated contract belongs in this repository. A tenant, vendor, registry
      or federation relationship is recorded in apis.yml, never saved as a contract here.
    severity: error
    given: $.info.x-operator
    then:
      function: pattern
      functionOptions:
        match: '^institution$'
  qut-provenance-method-set:
    description: Every contract must state how we came to hold it — searched, generated, derived, probed or none. An unmarked artifact reads as though the institution published it.
    severity: error
    given: $.info
    then:
      field: x-method
      function: pattern
      functionOptions:
        match: '^(searched|generated|derived|probed|none)$'
  qut-provenance-source-set:
    description: Every derived or probed contract must name the live URL it was derived from.
    severity: error
    given: $.info
    then:
      field: x-source
      function: truthy
  qut-servers-absolute:
    description: >-
      servers[] must carry an absolute URL on a host whose operator has been settled. A relative or
      absent servers block is the `hostless` failure that let 36 Elsevier Pure contracts pass as
      Manchester's own.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: '^https://'
  qut-oai-pmh-error-in-200:
    description: >-
      Any operation on the OAI-PMH endpoint must document that a protocol error arrives as HTTP 200
      carrying an <error> element. A client that branches on status code alone will treat a
      badArgument as a successful harvest.
    severity: warn
    given: $.paths['/oai2'].get.description
    then:
      function: pattern
      functionOptions:
        match: 'error'
  qut-no-implicit-or-password-grant:
    description: >-
      QUT ESOE still advertises the implicit and password grants. Both are removed in OAuth 2.1 and
      discouraged by the OAuth Security BCP. Flagged as a warning against QUT's own contract, not
      suppressed.
    severity: warn
    given: $.components.schemas.TokenRequest.properties.grant_type.enum
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          not:
            contains:
              enum: [implicit, password]
  qut-pkce-s256-only:
    description: >-
      code_challenge_method should be restricted to S256. QUT advertises `plain`, which provides no
      protection against authorization-code interception.
    severity: warn
    given: $.paths..parameters[?(@.name=='code_challenge_method')].schema.enum
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          not:
            contains:
              const: plain
  qut-document-observed-401:
    description: >-
      Where a probe returned 401, the contract must document the 401 rather than only the 200 it
      never observed. Documenting an unreachable success is how a profile overstates a footprint.
    severity: warn
    given: $.paths[*][*].responses
    then:
      function: truthy