UnitedHealth Group · API Governance Rules

UnitedHealth Group API Rules

Spectral linting rules defining API design standards and conventions for UnitedHealth Group.

30 Rules error 13 warn 13 info 4
Generated by API Evangelist Written by API Evangelist tooling for UnitedHealth Group's APIs. It is a starting point, not a ruleset UnitedHealth Group publishes or enforces.
View Rules File View on GitHub

Rule Categories

fhir get info microcks no openapi operation parameter paths query response schema security servers

Rules

error
info-title-required
API title must be present.
$.info.title
warn
info-title-unitedhealth-prefix
UnitedHealth Group API titles should start with "UnitedHealth Group".
$.info.title
warn
info-description-required
API description must be present and meaningful.
$.info.description
error
info-version-required
API version must be specified.
$.info.version
warn
openapi-version
APIs should use OpenAPI 3.x.
$.openapi
error
servers-required
Servers array must be defined.
$.servers
error
servers-https-only
All server URLs must use HTTPS.
$.servers[*].url
warn
servers-uhc-domain
UnitedHealth Group API servers should use uhc.com domain.
$.servers[*].url
warn
paths-kebab-case
Path segments should use kebab-case.
$.paths[*]~
error
paths-no-trailing-slash
Paths must not end with a trailing slash.
$.paths[*]~
error
operation-summary-required
Every operation must have a summary.
$.paths[*][get,post,put,delete,patch]
info
operation-summary-prefix
Operation summaries should start with UnitedHealth Group.
$.paths[*][get,post,put,delete,patch].summary
warn
operation-description-required
Every operation must have a description.
$.paths[*][get,post,put,delete,patch]
error
operation-id-required
Every operation must have an operationId.
$.paths[*][get,post,put,delete,patch]
warn
operation-id-camel-case
OperationIds should use camelCase.
$.paths[*][get,post,put,delete,patch].operationId
error
operation-tags-required
Every operation must have at least one tag.
$.paths[*][get,post,put,delete,patch].tags
warn
parameter-description-required
Every parameter must have a description.
$.paths[*][get,post,put,delete,patch].parameters[*]
error
parameter-schema-required
Every parameter must have a schema.
$.paths[*][get,post,put,delete,patch].parameters[*]
error
response-success-required
Every operation must define at least one 2xx response.
$.paths[*][get,post,put,delete,patch].responses
warn
response-401-required
All operations should define a 401 Unauthorized response.
$.paths[*][get,post,put,delete,patch].responses
error
response-description-required
Every response must have a description.
$.paths[*][get,post,put,delete,patch].responses[*]
warn
schema-description-required
Top-level schemas should have a description.
$.components.schemas[*]
error
security-schemes-defined
Security schemes must be defined in components.
$.components.securitySchemes
error
get-no-request-body
GET operations must not have a request body.
$.paths[*].get.requestBody
warn
fhir-content-type
FHIR APIs should use application/fhir+json content type.
$.paths[*][get,post].responses[*].content
info
microcks-operation-present
Operations should include x-microcks-operation for mock compatibility.
$.paths[*][get,post,put,delete,patch]
info
query-params-casing
Query parameters should be snake_case (the dominant convention in this API).
$.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
info
schema-properties-casing
Schema properties should be snake_case (the dominant convention in this API).
$.components.schemas[*].properties
warn
operation-documents-429
Operations should document a 429 response (documented on 100% of this API's operations).
$.paths[*][get,post,put,patch,delete].responses
warn
no-empty-descriptions
Descriptions must not be empty strings.
$..description

Spectral Ruleset

Raw ↑ 
# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
x-method: generated
# unitedhealth — Spectral ruleset (strengthened)
# Plain Spectral. Existing hand-authored rules preserved; measured rules added
# from this provider's own OpenAPI conventions by strengthen_ruleset.py,
# then self-validated against the spec.
#
# Provenance:
#   - servers-https-only: 100% of servers already https (error)
#   - servers-expected-domain: 1/1 servers on uhc.com
#   - query-params-casing: snake @ 50% (n=24)
#   - operationid-casing: camel @ 100% (n=7)
#   - schema-properties-casing: snake @ 82% (n=17)
#   - security: global (root) — NOT emitting operation-security-required
#   - operation-documents-401: 100% adherence
#   - operation-documents-429: 100% adherence
#   - merge: kept 26 existing, added 4 measured, upgraded 0
#   - added: query-params-casing, schema-properties-casing, operation-documents-429, no-empty-descriptions
extends:
- spectral:oas
rules:
  info-title-required:
    description: API title must be present.
    severity: error
    given: $.info.title
    then:
      function: truthy
  info-title-unitedhealth-prefix:
    description: UnitedHealth Group API titles should start with "UnitedHealth Group".
    severity: warn
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: ^UnitedHealth Group
  info-description-required:
    description: API description must be present and meaningful.
    severity: warn
    given: $.info.description
    then:
      function: length
      functionOptions:
        min: 50
  info-version-required:
    description: API version must be specified.
    severity: error
    given: $.info.version
    then:
      function: truthy
  openapi-version:
    description: APIs should use OpenAPI 3.x.
    severity: warn
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: ^3\.
  servers-required:
    description: Servers array must be defined.
    severity: error
    given: $.servers
    then:
      function: truthy
  servers-https-only:
    description: All server URLs must use HTTPS.
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: ^https://
  servers-uhc-domain:
    description: UnitedHealth Group API servers should use uhc.com domain.
    severity: warn
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: uhc\.com
  paths-kebab-case:
    description: Path segments should use kebab-case.
    severity: warn
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        match: ^(/[a-zA-Z0-9-{}./]+)+$
  paths-no-trailing-slash:
    description: Paths must not end with a trailing slash.
    severity: error
    given: $.paths[*]~
    then:
      function: pattern
      functionOptions:
        notMatch: /$
  operation-summary-required:
    description: Every operation must have a summary.
    severity: error
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: summary
      function: truthy
  operation-summary-prefix:
    description: Operation summaries should start with UnitedHealth Group.
    severity: info
    given: $.paths[*][get,post,put,delete,patch].summary
    then:
      function: pattern
      functionOptions:
        match: ^UnitedHealth Group
  operation-description-required:
    description: Every operation must have a description.
    severity: warn
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: description
      function: truthy
  operation-id-required:
    description: Every operation must have an operationId.
    severity: error
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: operationId
      function: truthy
  operation-id-camel-case:
    description: OperationIds should use camelCase.
    severity: warn
    given: $.paths[*][get,post,put,delete,patch].operationId
    then:
      function: pattern
      functionOptions:
        match: ^[a-z][a-zA-Z0-9]*$
  operation-tags-required:
    description: Every operation must have at least one tag.
    severity: error
    given: $.paths[*][get,post,put,delete,patch].tags
    then:
      function: truthy
  parameter-description-required:
    description: Every parameter must have a description.
    severity: warn
    given: $.paths[*][get,post,put,delete,patch].parameters[*]
    then:
      field: description
      function: truthy
  parameter-schema-required:
    description: Every parameter must have a schema.
    severity: error
    given: $.paths[*][get,post,put,delete,patch].parameters[*]
    then:
      field: schema
      function: truthy
  response-success-required:
    description: Every operation must define at least one 2xx response.
    severity: error
    given: $.paths[*][get,post,put,delete,patch].responses
    then:
      function: truthy
  response-401-required:
    description: All operations should define a 401 Unauthorized response.
    severity: warn
    given: $.paths[*][get,post,put,delete,patch].responses
    then:
      field: '401'
      function: truthy
  response-description-required:
    description: Every response must have a description.
    severity: error
    given: $.paths[*][get,post,put,delete,patch].responses[*]
    then:
      field: description
      function: truthy
  schema-description-required:
    description: Top-level schemas should have a description.
    severity: warn
    given: $.components.schemas[*]
    then:
      field: description
      function: truthy
  security-schemes-defined:
    description: Security schemes must be defined in components.
    severity: error
    given: $.components.securitySchemes
    then:
      function: truthy
  get-no-request-body:
    description: GET operations must not have a request body.
    severity: error
    given: $.paths[*].get.requestBody
    then:
      function: falsy
  fhir-content-type:
    description: FHIR APIs should use application/fhir+json content type.
    severity: warn
    given: $.paths[*][get,post].responses[*].content
    then:
      function: truthy
  microcks-operation-present:
    description: Operations should include x-microcks-operation for mock compatibility.
    severity: info
    given: $.paths[*][get,post,put,delete,patch]
    then:
      field: x-microcks-operation
      function: truthy
  query-params-casing:
    description: Query parameters should be snake_case (the dominant convention in this API).
    severity: info
    given: $.paths[*][get,post,put,patch,delete].parameters[?(@.in=='query')]
    then:
      field: name
      function: casing
      functionOptions:
        type: snake
  schema-properties-casing:
    description: Schema properties should be snake_case (the dominant convention in this API).
    severity: info
    given: $.components.schemas[*].properties
    then:
      field: '@key'
      function: casing
      functionOptions:
        type: snake
  operation-documents-429:
    description: Operations should document a 429 response (documented on 100% of this API's operations).
    severity: warn
    given: $.paths[*][get,post,put,patch,delete].responses
    then:
      field: '429'
      function: truthy
  no-empty-descriptions:
    description: Descriptions must not be empty strings.
    severity: warn
    given: $..description
    then:
      function: truthy

Work with this as data

Every ruleset here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for spectral rules

4 MCP tools reach this
  • find_rulesBrowse and filter every ruleset in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This ruleset 
curl "https://apis.io/api/v1/rules/unitedhealth-spectral-rules"
All spectral rules 
curl "https://apis.io/api/v1/rules?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.