Restaurant Brands International · API Governance Rules

Restaurant Brands International API Rules

Spectral linting rules defining API design standards and conventions for Restaurant Brands International.

33 Rules error 6 warn 19 info 8
Generated by API Evangelist Written by API Evangelist tooling for Restaurant Brands International's APIs. It is a starting point, not a ruleset Restaurant Brands International publishes or enforces.
View Rules File View on GitHub

Rule Categories

error info no openapi operation parameter path paths query request response schema security servers tag

Rules

error
info-title-required
API must declare a title.
$.info
warn
info-description-required
API must have a description of at least 40 characters.
$.info
error
info-version-required
API must declare a version.
$.info
warn
info-version-semver
API version should be semantic (e.g. 1.0.0).
$.info.version
warn
openapi-version-31
RBI Partners specs are authored against OpenAPI 3.1.0.
$
error
servers-defined
At least one server must be defined.
$
error
servers-https
Server URLs must use HTTPS.
$.servers[*].url
info
servers-rbictg-host
Production/sandbox servers should resolve to an rbictg.com host.
$.servers[*].url
warn
paths-no-trailing-slash
Paths must not end with a trailing slash.
$.paths[*]~
info
paths-version-prefix
RBI Partners resources are served under an /api/v{n} server prefix; path keys stay version-relative.
$.paths[*]~
error
operation-operationId-required
Every operation must declare an operationId.
$.paths[*][get,post,put,patch,delete]
warn
operation-operationId-camel
operationId must be camelCase (e.g. priceOrder, getStores).
$.paths[*][get,post,put,patch,delete].operationId
warn
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-title-case
Operation summaries should be Title Case (first letter uppercase).
$.paths[*][get,post,put,patch,delete].summary
warn
operation-tags-required
Every operation must be tagged for grouping.
$.paths[*][get,post,put,patch,delete]
info
tag-name-defined
Tags used on operations should be declared in the global tags array.
$.tags[*]
warn
parameter-description-required
Parameters should be described.
$.paths[*][*].parameters[*]
info
parameter-region-header
Region context is conveyed via the x-region header on the loyalty middleware surface.
$..parameters[?(@.in=='header')].name
warn
request-body-json
Request bodies should offer application/json content.
$.paths[*][post,put,patch].requestBody.content
warn
response-2xx-required
Every operation must define at least one success (2xx) response.
$.paths[*][get,post,put,patch,delete].responses
info
response-error-coverage
Operations should document error responses (400/401/404).
$.paths[*][get,post,put,patch,delete].responses
error
security-scheme-defined
A security scheme must be defined; RBI Partners uses bearer JWT.
$.components.securitySchemes
info
security-bearer-jwt
HTTP bearer schemes should declare the JWT bearerFormat.
$.components.securitySchemes[?(@.scheme=='bearer')]
info
schema-type-defined
Component schemas should declare a type.
$.components.schemas[*]
warn
no-empty-descriptions
Descriptions, when present, must not be empty.
$..description
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
operation-security-required
Every operation should declare its security requirements.
$.paths[*][get,post,put,patch,delete]
warn
error-schema-defined
A shared error schema (Error) should be defined for error payloads.
$.components.schemas
warn
operation-documents-403
Operations should document a 403 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
operation-documents-404
Operations should document a 404 response (documented on 83% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# restaurant-brands — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 4/4 servers on rbictg.com
#   - path-params-casing: camel @ 100% (n=8)
#   - query-params-casing: snake @ 100% (n=4)
#   - operationid-casing: camel @ 92% (n=12)
#   - schema-names-casing: pascal @ 98% (n=108)
#   - schema-properties-casing: snake @ 57% (n=316)
#   - operation-security-required: 12/12 ops declare per-op security
#   - error-schema-defined: Error
#   - operation-documents-403: 100% adherence
#   - operation-documents-404: 83% adherence
#   - pagination params observed: ['cursor', 'limit']
#   - merge: kept 25 existing, added 8 measured, upgraded 0
#   - added: path-params-casing, query-params-casing, schema-names-casing, schema-properties-casing, operation-security-required, error-schema-defined, operation-documents-403, operation-documents-404
extends:
  - spectral:oas
rules:
  info-title-required:
    description: API must declare a title.
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-description-required:
    description: API must have a description of at least 40 characters.
    severity: warn
    given: $.info
    then:
      field: description
      function: length
      functionOptions:
        min: 40
  info-version-required:
    description: API must declare a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  info-version-semver:
    description: API version should be semantic (e.g. 1.0.0).
    severity: warn
    given: $.info.version
    then:
      function: pattern
      functionOptions:
        match: ^[0-9]+\.[0-9]+\.[0-9]+$
  openapi-version-31:
    description: RBI Partners specs are authored against OpenAPI 3.1.0.
    severity: warn
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.1\.
  servers-defined:
    description: At least one server must be defined.
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-rbictg-host:
    description: Production/sandbox servers should resolve to an rbictg.com host.
    severity: info
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: rbictg\.com
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: .+/$
  paths-version-prefix:
    description: RBI Partners resources are served under an /api/v{n} server prefix; path keys stay version-relative.
    severity: info
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: ^/api/v[0-9]
  operation-operationId-required:
    description: Every operation must declare an operationId.
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-operationId-camel:
    description: operationId must be camelCase (e.g. priceOrder, getStores).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-summary-required:
    description: Every operation must have a summary.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-title-case:
    description: Operation summaries should be Title Case (first letter uppercase).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: ^[A-Z]
  operation-tags-required:
    description: Every operation must be tagged for grouping.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  tag-name-defined:
    description: Tags used on operations should be declared in the global tags array.
    severity: info
    given: $.tags[*]
    then:
      field: name
      function: truthy
  parameter-description-required:
    description: Parameters should be described.
    severity: warn
    given: $.paths[*][*].parameters[*]
    then:
      field: description
      function: truthy
  parameter-region-header:
    description: Region context is conveyed via the x-region header on the loyalty middleware surface.
    severity: info
    given: $..parameters[?(@.in=='header')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-z0-9-]*$
  request-body-json:
    description: Request bodies should offer application/json content.
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-2xx-required:
    description: Every operation must define at least one success (2xx) response.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
  response-error-coverage:
    description: Operations should document error responses (400/401/404).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
  security-scheme-defined:
    description: A security scheme must be defined; RBI Partners uses bearer JWT.
    severity: error
    given: $.components.securitySchemes
    then:
      function: truthy
  security-bearer-jwt:
    description: HTTP bearer schemes should declare the JWT bearerFormat.
    severity: info
    given: $.components.securitySchemes[?(@.scheme=='bearer')]
    then:
      field: bearerFormat
      function: truthy
  schema-type-defined:
    description: Component schemas should declare a type.
    severity: info
    given: $.components.schemas[*]
    then:
      function: schema
      functionOptions:
        schema:
          type: object
  no-empty-descriptions:
    description: Descriptions, when present, must not be empty.
    severity: warn
    given: $..description
    then:
      function: truthy
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: camel
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: pattern
      functionOptions:
        match: ^[A-Z][A-Za-z0-9]*$
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  operation-security-required:
    description: Every operation should declare its security requirements.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: security
      function: truthy
  error-schema-defined:
    description: A shared error schema (Error) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: Error
      function: truthy
  operation-documents-403:
    description: Operations should document a 403 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '403'
      function: truthy
  operation-documents-404:
    description: Operations should document a 404 response (documented on 83% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '404'
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/restaurant-brands-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.