Umami · API Governance Rules

Umami API Rules

Spectral linting rules defining API design standards and conventions for Umami.

37 Rules error 13 warn 15 info 9
Generated by API Evangelist Written by API Evangelist tooling for Umami's APIs. It is a starting point, not a ruleset Umami publishes or enforces.
View Rules File View on GitHub

Rule Categories

analytics get info no openapi operation parameter path paths query request response schema security servers

Rules

error
info-title-umami-prefix
API title must start with "Umami"
$.info.title
error
info-description-required
API info must have a description with at least 50 characters
$.info.description
error
info-version-required
API info must include a version
$.info.version
warn
info-contact-url
API contact should include URL pointing to umami.is
$.info.contact.url
error
openapi-version-3
OpenAPI version must be 3.0.x
$.openapi
error
servers-required
At least one server must be defined
$.servers
info
servers-umami-domain
Server URL should use umami.is domain or localhost for self-hosted
$.servers[*].url
info
paths-api-prefix
All paths should start with /api/
$.paths[*]~
warn
paths-no-trailing-slash
Paths must not have a trailing slash
$.paths[*]~
info
paths-kebab-case
Path segments should use kebab-case
$.paths[*]~
error
operation-operationId-required
Every operation must have an operationId
$.paths[*][get,post,put,patch,delete]
error
operation-summary-required
Every operation must have a summary
$.paths[*][get,post,put,patch,delete]
warn
operation-summary-umami-prefix
Operation summary must start with "Umami"
$.paths[*][get,post,put,patch,delete].summary
warn
operation-description-required
Every operation must have a description
$.paths[*][get,post,put,patch,delete]
error
operation-tags-required
Every operation must have at least one tag
$.paths[*][get,post,put,patch,delete]
warn
operation-operationId-camelCase
OperationId must use camelCase
$.paths[*][get,post,put,patch,delete].operationId
warn
parameter-description-required
Every parameter must have a description
$.paths[*][get,post,put,patch,delete].parameters[*]
info
parameter-camelCase
Query parameter names should use camelCase
$.paths[*][get,post,put,patch,delete].parameters[?(@.in == 'query')].name
info
parameter-timestamps-ms
Timestamp parameters should indicate millisecond precision in their names or descriptions
$.paths[*][get].parameters[?(@.name == 'startAt' || @.name == 'endAt')]
warn
request-body-json
Request body should include application/json content type
$.paths[*][post,put,patch].requestBody.content
error
response-success-required
Every operation must define at least one 2xx response
$.paths[*][get,post,put,patch,delete].responses
warn
response-401-required
Operations should define a 401 Unauthorized response
$.paths[*][get,post,put,patch,delete].responses
error
response-description-required
Every response must have a description
$.paths[*][get,post,put,patch,delete].responses[*]
warn
schema-description-required
Top-level schemas should have descriptions
$.components.schemas[*]
warn
schema-property-type
Schema properties should have types defined
$.components.schemas[*].properties[*]
info
schema-uuid-format
ID fields should use format uuid
$.components.schemas[*].properties[?(@.description =~ /identifier/i)].format
error
security-schemes-defined
Security schemes must be defined in components
$.components.securitySchemes
warn
security-global-required
Global security should be defined
$.security
error
get-no-request-body
GET operations must not have a request body
$.paths[*].get
info
analytics-timestamps-required
Analytics operations should accept startAt and endAt timestamp parameters
$.paths[*][get].parameters[*].name
error
no-empty-descriptions
Descriptions must not be empty strings
$..description
warn
servers-https-only
Server URLs must use HTTPS.
$.servers[*].url
warn
servers-expected-domain
Server URLs should be on the umami.is domain.
$.servers[*].url
warn
path-params-casing
Path parameters should be camelCase (the dominant convention in this API).
$.paths[*].parameters[?(@.in=='path')].name
info
query-params-casing
Query parameters should be camelCase (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
warn
schema-names-casing
Component schema names should be PascalCase (the dominant convention in this API).
$.components.schemas
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# umami — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 50% of servers already https (warn)
#   - servers-expected-domain: 1/1 servers on umami.is
#   - path-params-casing: camel @ 100% (n=15)
#   - query-params-casing: camel @ 59% (n=29)
#   - operationid-casing: camel @ 96% (n=23)
#   - schema-names-casing: pascal @ 100% (n=19)
#   - schema-properties-casing: snake @ 68% (n=80)
#   - security: global (root) — NOT emitting operation-security-required
#   - operation-documents-401: 100% adherence
#   - pagination params observed: ['limit', 'page', 'pageSize']
#   - merge: kept 31 existing, added 6 measured, upgraded 0
#   - added: servers-https-only, servers-expected-domain, path-params-casing, query-params-casing, schema-names-casing, schema-properties-casing
extends:
  - spectral:oas
rules:
  info-title-umami-prefix:
    description: API title must start with "Umami"
    severity: error
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^Umami
  info-description-required:
    description: API info must have a description with at least 50 characters
    severity: error
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 50
  info-version-required:
    description: API info must include a version
    severity: error
    given: $.info.version
    then:
      function: truthy
  info-contact-url:
    description: API contact should include URL pointing to umami.is
    severity: warn
    given: $.info.contact.url
    then:
      function: truthy
  openapi-version-3:
    description: OpenAPI version must be 3.0.x
    severity: error
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.0\.
  servers-required:
    description: At least one server must be defined
    severity: error
    given: $.servers
    then:
      function: length
      functionOptions:
        min: 1
  servers-umami-domain:
    description: Server URL should use umami.is domain or localhost for self-hosted
    severity: info
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: (umami\.is|localhost)
  paths-api-prefix:
    description: All paths should start with /api/
    severity: info
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^/api/
  paths-no-trailing-slash:
    description: Paths must not have a trailing slash
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: \/$
  paths-kebab-case:
    description: Path segments should use kebab-case
    severity: info
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: _[a-z]
  operation-operationId-required:
    description: Every operation must have an operationId
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy
  operation-summary-required:
    description: Every operation must have a summary
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: summary
      function: truthy
  operation-summary-umami-prefix:
    description: Operation summary must start with "Umami"
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: ^Umami
  operation-description-required:
    description: Every operation must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: description
      function: truthy
  operation-tags-required:
    description: Every operation must have at least one tag
    severity: error
    given: $.paths[*][get,post,put,patch,delete]
    then:
      field: tags
      function: truthy
  operation-operationId-camelCase:
    description: OperationId must use camelCase
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  parameter-description-required:
    description: Every parameter must have a description
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].parameters[*]
    then:
      field: description
      function: truthy
  parameter-camelCase:
    description: Query parameter names should use camelCase
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in == 'query')].name
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  parameter-timestamps-ms:
    description: Timestamp parameters should indicate millisecond precision in their names or descriptions
    severity: info
    given: $.paths[*][get].parameters[?(@.name == 'startAt' || @.name == 'endAt')]
    then:
      field: description
      function: truthy
  request-body-json:
    description: Request body should include application/json content type
    severity: warn
    given: $.paths[*][post,put,patch].requestBody.content
    then:
      field: application/json
      function: truthy
  response-success-required:
    description: Every operation must define at least one 2xx response
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - '200'
          - required:
            - '201'
          - required:
            - '202'
          - required:
            - '204'
  response-401-required:
    description: Operations should define a 401 Unauthorized response
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '401'
      function: truthy
  response-description-required:
    description: Every response must have a description
    severity: error
    given: $.paths[*][get,post,put,patch,delete].responses[*]
    then:
      field: description
      function: truthy
  schema-description-required:
    description: Top-level schemas should have descriptions
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  schema-property-type:
    description: Schema properties should have types defined
    severity: warn
    given: $.components.schemas[*].properties[*]
    then:
      field: type
      function: truthy
  schema-uuid-format:
    description: ID fields should use format uuid
    severity: info
    given: $.components.schemas[*].properties[?(@.description =~ /identifier/i)].format
    then:
      function: pattern
      functionOptions:
        match: uuid
  security-schemes-defined:
    description: Security schemes must be defined in components
    severity: error
    given: $.components.securitySchemes
    then:
      function: truthy
  security-global-required:
    description: Global security should be defined
    severity: warn
    given: $.security
    then:
      function: truthy
  get-no-request-body:
    description: GET operations must not have a request body
    severity: error
    given: $.paths[*].get
    then:
      field: requestBody
      function: falsy
  analytics-timestamps-required:
    description: Analytics operations should accept startAt and endAt timestamp parameters
    severity: info
    given: $.paths[*][get].parameters[*].name
    then:
      function: pattern
      functionOptions:
        notMatch: ^(start_at|end_at|start_time|end_time)$
  no-empty-descriptions:
    description: Descriptions must not be empty strings
    severity: error
    given: $..description
    then:
      function: pattern
      functionOptions:
        match: .+
  servers-https-only:
    description: Server URLs must use HTTPS.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-expected-domain:
    description: Server URLs should be on the umami.is domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: umami\.is
  path-params-casing:
    description: Path parameters should be camelCase (the dominant convention in this API).
    severity: warn
    given: $.paths[*].parameters[?(@.in=='path')].name
    then:
      function: casing
      functionOptions:
        type: camel
  query-params-casing:
    description: Query parameters should be camelCase (the dominant convention in this API).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: camel
  schema-names-casing:
    description: Component schema names should be PascalCase (the dominant convention in this API).
    severity: warn
    given: $.components.schemas
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: pascal
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/umami-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.