Toast · API Governance Rules

Toast API Rules

Spectral linting rules defining API design standards and conventions for Toast.

39 Rules error 9 warn 12 info 18
View Rules File View on GitHub

Rule Categories

delete error examples get info no operation parameter path paths query response schema security servers toast

Rules

error
info-title-required
Info object must have a title
$.info
warn
info-title-toast-prefix
API title should start with 'Toast'
$.info.title
warn
info-description-required
Info object must have a description
$.info
error
info-version-required
Info object must have a version
$.info
error
servers-defined
Servers array must be defined
$
error
servers-https
Server URLs must use HTTPS
$.servers[*].url
warn
paths-no-trailing-slash
Paths must not end with a trailing slash
$.paths[*]~
info
paths-guid-parameters
Path parameters for identifiers should use 'guid' naming
$.paths[*]~
error
operation-summary-required
Every operation must have a summary
$.paths[*][get,post,put,patch,delete]
info
operation-summary-toast-prefix
Operation summaries should start with 'Toast'
$.paths[*][get,post,put,patch,delete].summary
error
operation-operationid-required
Every operation must have an operationId
$.paths[*][get,post,put,patch,delete]
warn
operation-operationid-camel-case
OperationId should use camelCase
$.paths[*][get,post,put,patch,delete].operationId
warn
operation-tags-required
Every operation must have at least one tag
$.paths[*][get,post,put,patch,delete]
info
operation-description-required
Operations should have a description
$.paths[*][get,post,put,patch,delete]
warn
parameter-description-required
All parameters must have a description
$.paths[*][get,post,put,patch,delete][parameters][*]
info
parameter-restaurant-guid-header
Restaurant GUID should be passed as a header named Toast-Restaurant-External-ID
$.paths[*][get,post,put,patch,delete][parameters][*][?(@.name=='restaurantGuid')]
error
response-success-required
Operations must define at least one 2xx response
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
All response objects must have a description
$.paths[*][get,post,put,patch,delete].responses[*]
info
response-401-defined
Secured operations should define a 401 Unauthorized response
$.paths[*][get,post,put,patch,delete].responses
info
response-404-on-get-by-id
GET by ID operations should define a 404 Not Found response
$.paths[*~*Guid*][get].responses
info
schema-property-camel-case
Schema property names should use camelCase
$.definitions[*].properties[*]~
info
schema-description-required
Top-level schemas should have a description
$.definitions[*]
info
schema-guid-property-format
Properties named 'guid' should have format uuid
$.definitions[*].properties[?(@property === 'guid')]
info
security-defined
Security should be defined at the API level
$
error
get-no-request-body
GET operations must not have a request body
$.paths[*].get
info
delete-returns-no-content
DELETE operations should return 204 No Content
$.paths[*].delete.responses
info
toast-restaurant-guid-required
Most Toast APIs require Toast-Restaurant-External-ID header
$.paths[*][get,post,put,patch].parameters
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description
info
examples-encouraged
Schema properties should have example values
$.definitions[*].properties[*]
info
schema-property-camel-case-oas3
Schema property names should use camelCase (OpenAPI 3)
$.components.schemas[*].properties[*]~
info
schema-description-required-oas3
Top-level schemas should have a description (OpenAPI 3)
$.components.schemas[*]
info
examples-encouraged-oas3
Schema properties should have example values (OpenAPI 3)
$.components.schemas[*].properties[*]
info
security-schemes-oas3
Security schemes should be defined (OpenAPI 3)
$.components
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
warn
query-params-casing
Query parameters should be camelCase (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
operation-security-required
Every operation should declare its security requirements.
$.paths[*][get,post,put,patch,delete]
warn
error-schema-defined
A shared error schema (ErrorMessage) should be defined for error payloads.
$.components.schemas

Spectral Ruleset

Raw ↑ 
# toast-tab — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - path-params-casing: camel @ 94% (n=33)
#   - query-params-casing: camel @ 94% (n=32)
#   - operationid-casing: camel @ 100% (n=46)
#   - schema-names-casing: pascal @ 100% (n=3)
#   - schema-properties-casing: snake @ 50% (n=18)
#   - operation-security-required: 45/46 ops declare per-op security
#   - error-schema-defined: ErrorMessage
#   - pagination params observed: ['page', 'pageSize', 'pageToken']
#   - merge: kept 33 existing, added 7 measured, upgraded 0
#   - added: path-params-casing, query-params-casing, schema-names-casing, schema-properties-casing, operation-security-required, error-schema-defined, no-empty-descriptions
extends:
  - spectral:oas
rules:
  info-title-required:
    description: Info object must have a title
    severity: error
    given: $.info
    then:
      field: title
      function: truthy
  info-title-toast-prefix:
    description: API title should start with 'Toast'
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Toast
  info-description-required:
    description: Info object must have a description
    severity: warn
    given: $.info
    then:
      field: description
      function: truthy
  info-version-required:
    description: Info object must have a version
    severity: error
    given: $.info
    then:
      field: version
      function: truthy
  servers-defined:
    description: Servers array must be defined
    severity: error
    given: $
    then:
      field: servers
      function: truthy
  servers-https:
    description: Server URLs must use HTTPS
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: /$
  paths-guid-parameters:
    description: Path parameters for identifiers should use 'guid' naming
    severity: info
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \{id\}
  operation-summary-required:
    description: Every operation must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-toast-prefix:
    description: Operation summaries should start with 'Toast'
    severity: info
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: ^Toast
  operation-operationid-required:
    description: Every operation must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-operationid-camel-case:
    description: OperationId should use camelCase
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-tags-required:
    description: Every operation must have at least one tag
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-description-required:
    description: Operations should have a description
    severity: info
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  parameter-description-required:
    description: All parameters must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete][parameters][*]
    then:
      field: description
      function: truthy
  parameter-restaurant-guid-header:
    description: Restaurant GUID should be passed as a header named Toast-Restaurant-External-ID
    severity: info
    given: $.paths[*][get,post,put,patch,delete][parameters][*][?(@.name=='restaurantGuid')]
    then:
      field: in
      function: enumeration
      functionOptions:
        values:
        - header
  response-success-required:
    description: Operations must define at least one 2xx response
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
  response-description-required:
    description: All response objects must have a description
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  response-401-defined:
    description: Secured operations should define a 401 Unauthorized response
    severity: info
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '401'
  response-404-on-get-by-id:
    description: GET by ID operations should define a 404 Not Found response
    severity: info
    given: $.paths[*~*Guid*][get].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '404'
  schema-property-camel-case:
    description: Schema property names should use camelCase
    severity: info
    given: $.definitions[*].properties[*]~
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  schema-description-required:
    description: Top-level schemas should have a description
    severity: info
    given: $.definitions[*]
    then:
      field: description
      function: truthy
  schema-guid-property-format:
    description: Properties named 'guid' should have format uuid
    severity: info
    given: $.definitions[*].properties[?(@property === 'guid')]
    then:
      field: format
      function: enumeration
      functionOptions:
        values:
        - uuid
  security-defined:
    description: Security should be defined at the API level
    given: $
    severity: info
    then:
      field: securityDefinitions
      function: truthy
  get-no-request-body:
    description: GET operations must not have a request body
    severity: error
    given: $.paths[*].get
    then:
      field: body
      function: falsy
  delete-returns-no-content:
    description: DELETE operations should return 204 No Content
    severity: info
    given: $.paths[*].delete.responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          required:
          - '204'
  toast-restaurant-guid-required:
    description: Most Toast APIs require Toast-Restaurant-External-ID header
    severity: info
    given: $.paths[*][get,post,put,patch].parameters
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            type: object
            properties:
              name:
                enum:
                - Toast-Restaurant-External-ID
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy
  examples-encouraged:
    description: Schema properties should have example values
    severity: info
    given: $.definitions[*].properties[*]
    then:
      field: example
      function: truthy
  schema-property-camel-case-oas3:
    description: Schema property names should use camelCase (OpenAPI 3)
    severity: info
    given: $.components.schemas[*].properties[*]~
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  schema-description-required-oas3:
    description: Top-level schemas should have a description (OpenAPI 3)
    severity: info
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  examples-encouraged-oas3:
    description: Schema properties should have example values (OpenAPI 3)
    severity: info
    given: $.components.schemas[*].properties[*]
    then:
      field: example
      function: truthy
  security-schemes-oas3:
    description: Security schemes should be defined (OpenAPI 3)
    severity: info
    given: $.components
    then:
      field: securitySchemes
      function: truthy
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][A-Za-z0-9]*$
  query-params-casing:
    description: Query parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: camel
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  operation-security-required:
    description: Every operation should declare its security requirements.
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: security
      function: truthy
  error-schema-defined:
    description: A shared error schema (ErrorMessage) should be defined for error payloads.
    severity: warn
    given: $.components.schemas
    then:
      field: ErrorMessage
      function: truthy