.spectral.yml

extends:
  - - 'spectral:oas'
    - all
rules:
  required-unauthorized-response:
    description: 'If this operation has a security scheme the 401 Unauthorized response is probably needed. Careful for false positives!'
    given: '$.paths.*[*].responses'
    recommended: true
    severity: error
    then:
      field: '401'
      function: truthy
  required-forbidden-response:
    description: 'If this operation has a security scheme the 403 Forbidden response is probably needed. Careful for false positives!'
    given: '$.paths.*[*].responses'
    recommended: true
    severity: error
    then:
      field: '403'
      function: truthy
  required-not-found-response:
    description: 'This operation needs to have a 404 response. Careful for false positives!'
    given: "$.paths.*[?( @property === 'get' || @property === 'put' || @property === 'delete')].responses"
    recommended: true
    severity: error
    then:
      field: '404'
      function: truthy
  required-bad-request-response:
    description: 'This POST operation needs to have a 400 response. Careful for false positives!'
    given: "$.paths.*[?( @property === 'post' )].responses"
    recommended: true
    severity: error
    then:
      field: '400'
      function: truthy
  summary-approved-verbs:
    description: 'Operation `summary` should use a standard verb (Create, Read, Update, Delete) at the beginning.'
    given: "$.paths.*[?( @property === 'get' || @property === 'put' || @property === 'post' || @property === 'delete' || @property === 'options' || @property === 'head' || @property === 'patch' || @property === 'trace' )]"
    recommended: true
    type: style
    then:
      field: summary
      function: pattern
      functionOptions:
        match: '^(Create|Read|Update|Delete)'
    tags:
      - operation
    severity: error
  operation-summary-formatted:
    description: Operation `summary` should start with upper case and end with a dot.
    given: "$.paths.*[?( @property === 'get' || @property === 'put' || @property === 'post' || @property === 'delete' || @property === 'options' || @property === 'head' || @property === 'patch' || @property === 'trace' )]"
    recommended: true
    type: style
    then:
      field: summary
      function: pattern
      functionOptions:
        match: "^[A-Z].*\\.$"
    tags:
      - operation
    severity: error
  operation-description-formatted:
    description: Operation `description` should start with upper case and end with a dot.
    given: "$.paths.*[?( @property === 'get' || @property === 'put' || @property === 'post' || @property === 'delete' || @property === 'options' || @property === 'head' || @property === 'patch' || @property === 'trace' )]"
    recommended: true
    type: style
    then:
      field: description
      function: pattern
      functionOptions:
        match: "^[A-Z].*\\.$"
    tags:
      - operation
    severity: error
  semver:
    description: Require 3-part Semantic Versions as the spec versions
    severity: error
    recommended: true
    message: 'Specs should follow semantic versioning. {{value}} is not a valid version.'
    given: $.info.version
    then:
      function: pattern
      functionOptions:
        match: '^([0-9]+.[0-9]+.[0-9]+)$'
  oas3-operation-security-defined: error
  oas3-parameter-description: error
  oas3-server-not-example.com: error
  oas3-server-trailing-slash: error
  openapi-tags: error
  openapi-tags-alphabetical: error
  operation-2xx-response: error
  operation-default-response: error
  operation-description: error
  operation-operationId: error
  operation-operationId-valid-in-url: error
  operation-parameters: error
  operation-singular-tag: error
  operation-tag-defined: error
  operation-tags: error
  path-declarations-must-exist: error
  path-keys-no-trailing-slash: error
  path-not-include-query: error
  path-params: error
  tag-description: error
  oas2-unused-definition: error
except:
  'api/openapi.yaml#/paths/~1organizations/get/responses':
    - required-forbidden-response
    - required-not-found-response
  'api/openapi.yaml#/paths/~1users/get/responses':
    - required-not-found-response
  'api/openapi.yaml#/paths/~1user~1anonymous/post/responses':
    - required-bad-request-response
    - required-forbidden-response
  'api/openapi.yaml#/paths/~1user~1login/post/responses':
    - required-bad-request-response
    - required-forbidden-response
  'api/openapi.yaml#/paths/~1user~1password~1recovery/post/responses':
    - required-bad-request-response
    - required-unauthorized-response
    - required-forbidden-response
  'api/openapi.yaml#/paths/~1version/get/responses':
    - required-unauthorized-response
    - required-forbidden-response
    - required-not-found-response