documentationUrl: https://spec.openlint.org/
functions:
- baloise-validate-tracing
- trimble-does-spec-contains-valid-http-verbs
- trimble-is-valid-spec
- trimble-valid-url-checker
functionsDir: ./functions
rules:
  openapi-component-require-security-schemes:
    description: The API contract MUST include a 'securitySchemes' subsection under the 'components' section.
    message: '{{description}}: {{error}}'
    severity: info
    given: $.components
    then:
      field: securitySchemes
      function: truthy
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-component-require-security-schemes
  openapi-document-owasp-api9-server:
    formats:
    - oas3
    description: The API should declare its servers so all hosts and environments are inventoried — undocumented or stray
      non-production hosts are a common inventory-management risk (OWASP API9).
    message: API should declare its servers (host/environment inventory).
    given: $
    severity: info
    then:
      field: servers
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-owasp-api9-server
  openapi-document-owasp-api9-server-oas2:
    formats:
    - oas2
    description: The API should declare its host so all hosts and environments are inventoried — undocumented or stray non-production
      hosts are a common inventory-management risk (OWASP API9).
    message: API should declare its host (host/environment inventory).
    given: $
    severity: info
    then:
      field: host
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-owasp-api9-server-oas2
  openapi-document-require-component-section:
    description: The API contract MUST include a 'components' section.
    message: '{{description}}: {{error}}'
    severity: info
    given: $
    then:
      field: components
      function: truthy
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-component-section
  openapi-document-require-jsonschemadialect:
    description: openapi document should declare a `jsonSchemaDialect` property.
    message: Missing `jsonSchemaDialect`.
    given: $
    severity: info
    then:
      field: jsonSchemaDialect
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-jsonschemadialect
  openapi-document-require-openapi:
    formats:
    - oas3
    description: openapi document should declare a `openapi` property.
    message: Missing `openapi`.
    given: $
    severity: info
    then:
      field: openapi
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-openapi
  openapi-document-require-swagger:
    formats:
    - oas2
    description: swagger document should declare a `swagger` property.
    message: Missing `swagger`.
    given: $
    severity: info
    then:
      field: swagger
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-swagger
  openapi-document-require-path:
    description: openapi document should declare a `paths` property.
    message: Missing `paths`.
    given: $
    severity: info
    then:
      field: paths
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-path
  openapi-document-require-webhooks:
    formats:
    - oas3
    description: openapi document should declare a `webhooks` property.
    message: Missing `webhooks`.
    given: $
    severity: info
    then:
      field: webhooks
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-document-require-webhooks
  openapi-document-spec-must-not-be-empty:
    description: Spec should not be empty.
    message: '{{error}}'
    severity: info
    given: $
    then:
      function: trimble-is-valid-spec
    documentationUrl: https://apicommons.org/rules/#openapi-document-spec-must-not-be-empty
  openapi-info-license-require-name:
    description: The license object should include a name property identifying the license type, such as Apache 2.0, MIT,
      or a proprietary license.
    message: Info License MUST Have Name
    severity: info
    given: $.info.license
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-info-license-require-name
  openapi-info-license-require-url:
    description: The license object should include a URL linking to the full license text so API consumers can review the
      terms.
    message: Info License MUST Have URL
    severity: info
    given: $.info.license
    then:
      field: url
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-info-license-require-url
  openapi-info-microcks-extension-valid:
    description: x-microcks extension must be valid.
    message: x-microcks extension must be valid
    severity: info
    given: $.info.x-microcks
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          properties:
            labels:
              type: object
              additionalProperties:
                type: string
          required:
          - labels
          additionalProperties: false
    formats:
    - oas3
    - aas2
    - aas3
    documentationUrl: https://apicommons.org/rules/#openapi-info-microcks-extension-valid
  openapi-info-owasp-api9-document-version:
    description: The API should declare a version in info.version so every published version is inventoried and retired versions
      can be tracked (OWASP API9 — improper inventory management).
    message: API should declare info.version for inventory management.
    given: $.info
    severity: info
    then:
      field: version
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-info-owasp-api9-document-version
  openapi-info-require-api-identifier:
    description: The `#/info/x-api-id` field can be used to associate an identifier to an API. This is useful to track an
      API even when its `#/info/title` changes.
    message: 'API must have an unique identifier in x-api-id in #/info/x-api-id.'
    severity: info
    given: $
    then:
      field: info.x-api-id
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-info-require-api-identifier
  openapi-info-require-license:
    description: Having a license defined in the info object clarifies the terms under which the API can be used. Analysis
      shows only 44.4% of APIs define a license, but it is essential for API governance and compliance.
    message: Info MUST Have License
    severity: info
    given: $.info
    then:
      field: license
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-info-require-license
  openapi-info-require-openapi-version-3x:
    formats:
    - oas3
    description: APIs should use OpenAPI 3.x specification. Analysis of 773 API specs shows 97% use OpenAPI 3.x, with 86%
      on 3.1.0, making it the dominant standard for modern API definitions.
    message: OpenAPI MUST Be Version 3.x
    severity: info
    given: $
    then:
      field: openapi
      function: pattern
      functionOptions:
        match: ^3\.
    documentationUrl: https://apicommons.org/rules/#openapi-info-require-openapi-version-3x
  openapi-info-require-openapi-version-3x-oas2:
    formats:
    - oas2
    description: 'Swagger 2.0 documents should declare `swagger: "2.0"` as their specification version.'
    message: Swagger MUST Be Version 2.0
    severity: info
    given: $
    then:
      field: swagger
      function: pattern
      functionOptions:
        match: ^2\.
    documentationUrl: https://apicommons.org/rules/#openapi-info-require-openapi-version-3x-oas2
  openapi-info-require-terms-of-service:
    description: API MUST reference the URL of the Terms of Service in `#/info/termsOfService`.
    message: 'API MUST reference the URL of the Terms of Service  in #/info/termsOfService.'
    severity: info
    given: $
    then:
      field: info.termsOfService
      function: truthy
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-info-require-terms-of-service
  openapi-operation-deprecated-require-description:
    description: Deprecated operations should have a description explaining the deprecation and the migration path / successor.
    message: Deprecated operation should describe the deprecation and successor.
    given: $.paths[*][?(@ && @.deprecated == true)]
    severity: info
    then:
      field: description
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-operation-deprecated-require-description
  openapi-operation-microcks-extension-valid:
    description: x-microcks-operation extension must be valid.
    message: x-microcks-operation extension must be valid
    severity: info
    given:
    - $.paths.*.*.x-microcks-operation
    - $.channels.*.[publish,subscribe].x-microcks-operation
    - $.operations.*.x-microcks-operation
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          properties:
            delay:
              type: number
              format: int32
            frequency:
              type: number
              format: int32
            dispatcher:
              type: string
            dispatcherRules:
              type: string
            parameterConstraints:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                  in:
                    type: string
                    enum:
                    - path
                    - query
                    - header
                  required:
                    type: boolean
                  recopy:
                    type: boolean
                  mustMatchRegexp:
                    type: string
                required:
                - name
                - in
          additionalProperties: false
    formats:
    - oas3
    - aas2
    - aas3
    documentationUrl: https://apicommons.org/rules/#openapi-operation-microcks-extension-valid
  openapi-operation-ref-resource-file:
    description: Endpoint must a $ref to a file in resources/.
    message: '{{description}}; {{value}} incorrect'
    severity: info
    given: $.paths.*.$ref
    then:
      function: pattern
      functionOptions:
        match: ^resources/.*yml$
    documentationUrl: https://apicommons.org/rules/#openapi-operation-ref-resource-file
  openapi-operation-require-security:
    description: Check operation security is defined.
    message: Check operation security is defined.
    severity: info
    given: $.paths.*.*
    then:
      field: security
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-operation-require-security
  openapi-operation-require-security-2:
    description: Each API operation should have a security definition referencing the central security scheme express for
      an OpenAPI.
    message: Operations MUST Have a Security Definition
    severity: info
    given: $.paths.*[get,post,patch,put,delete]
    then:
      field: security
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-operation-require-security-2
  openapi-operation-use-ref:
    description: Endpoint must be a $ref.
    message: '{{description}}; {{property}} incorrect'
    severity: info
    given: $.paths.*.*
    then:
      field: $ref
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-operation-use-ref
  openapi-parameter-no-api-keys-in-query:
    description: Query parameters MUST not contain sensitive information, like API tokens or keys.
    message: Query parameters MUST not contain sensitive information, like API tokens or keys.
    severity: info
    given: $.paths.*.*.parameters[?(@.in=='query')].name
    then:
      function: pattern
      functionOptions:
        notMatch: apiKey|token
    documentationUrl: https://apicommons.org/rules/#openapi-parameter-no-api-keys-in-query
  openapi-parameter-no-forbidden-http-header:
    description: 'OAS do not allow using the following HTTP headers in a specification file: Authorization, Content-Type and
      Accept. You MUST use the associate functionalities provided by OAS, instead.'
    message: '{{error}} in {{path}} {{value}}'
    severity: info
    given:
    - $..parameters[?(@.in == 'header')].name
    - $.[responses][*].headers.*~
    then:
      function: pattern
      functionOptions:
        notMatch: /^(accept|content-type|authorization)$/i
    documentationUrl: https://apicommons.org/rules/#openapi-parameter-no-forbidden-http-header
  openapi-path-no-environment-names-in:
    description: API paths MUST NOT indicate environment names.
    message: API paths MUST NOT indicate environment names.
    severity: info
    given: $.paths.*~
    then:
      function: pattern
      functionOptions:
        notMatch: /prod/|/preprod/|/dev/|/test/|/integration/|/stage/
    documentationUrl: https://apicommons.org/rules/#openapi-path-no-environment-names-in
  openapi-path-require-tracing-header:
    description: MUST use b3 or w3c tracing [233a].
    message: Header X-B3-Traceid, X-B3-Spanid or traceparent (w3c) missing
    severity: info
    given: $.paths.*
    then:
      function: baloise-validate-tracing
    documentationUrl: https://apicommons.org/rules/#openapi-path-require-tracing-header
  openapi-path-require-valid-http-verb:
    description: All APIs MUST have a valid http verb.
    message: '{{error}}'
    severity: info
    given: $.paths.*
    then:
      field: '@key'
      function: trimble-does-spec-contains-valid-http-verbs
    documentationUrl: https://apicommons.org/rules/#openapi-path-require-valid-http-verb
  openapi-response-deprecated-operation-deprecation-header:
    description: Deprecated operations should document a Deprecation response header (RFC 9745) signalling that the resource
      is deprecated.
    message: Deprecated operation should document a Deprecation header.
    given: $.paths[*][?(@ && @.deprecated == true)].responses[*].headers
    severity: info
    then:
      field: Deprecation
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-response-deprecated-operation-deprecation-header
  openapi-response-deprecated-operation-sunset-header:
    description: Deprecated operations should document a Sunset response header (RFC 8594) telling clients when the operation
      will be removed.
    message: Deprecated operation should document a Sunset header.
    given: $.paths[*][?(@ && @.deprecated == true)].responses[*].headers
    severity: info
    then:
      field: Sunset
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-response-deprecated-operation-sunset-header
  openapi-response-no-operational-header-in-spec:
    description: Access-Control-*, Content-Type, and Accept Headers SHOULD NOT be specified explicitly in a spec as it an
      operational concern.
    message: Access-Control-*, Content-Type, and Accept Headers SHOULD NOT be specified explicitly in a spec as it an operational
      concern.
    severity: info
    given: $.paths[*][*].responses[*].headers
    then:
      function: pattern
      functionOptions:
        notMatch: ^(Access-Control-.*|Content-Type|Accept)$
    documentationUrl: https://apicommons.org/rules/#openapi-response-no-operational-header-in-spec
  openapi-response-no-sensitive-data-in-header:
    description: Headers MUST NOT contain sensitive data.
    message: Headers MUST NOT contain sensitive data.
    severity: info
    given: $.paths[*][*].responses[*].headers.*~
    then:
      function: pattern
      functionOptions:
        notMatch: ^(SPS-Token|SPS-Password|SPS-Identity|Password)$
    documentationUrl: https://apicommons.org/rules/#openapi-response-no-sensitive-data-in-header
  openapi-schema-require-info-object:
    description: Having an info object provides much of the metadata needed for the collection of APIs described in an OpenAPI.
    message: Info Object MUST Exist
    severity: info
    given: $
    then:
      field: info
      function: truthy
    documentationUrl: https://apicommons.org/rules/#openapi-schema-require-info-object
  openapi-security-oauth-flow-require-scopes:
    formats:
    - oas3
    description: OAuth2 flows should define scopes so authorization is granular and least-privilege rather than all-or-nothing.
    message: OAuth2 flow should define at least one scope.
    given: $.components.securitySchemes[?(@ && @.type == 'oauth2')].flows[*]
    severity: info
    then:
      field: scopes
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
    documentationUrl: https://apicommons.org/rules/#openapi-security-oauth-flow-require-scopes
  openapi-security-oauth-flow-require-scopes-oas2:
    formats:
    - oas2
    description: OAuth2 security definitions should define scopes so authorization is granular and least-privilege rather
      than all-or-nothing. In Swagger 2.0 scopes are declared directly on the oauth2 security definition.
    message: OAuth2 security definition should define at least one scope.
    given: $.securityDefinitions[?(@ && @.type == 'oauth2')]
    severity: info
    then:
      field: scopes
      function: schema
      functionOptions:
        schema:
          type: object
          minProperties: 1
    documentationUrl: https://apicommons.org/rules/#openapi-security-oauth-flow-require-scopes-oas2
  openapi-security-require-root:
    description: The API contract MUST include a 'security' section at the root level.
    message: '{{description}}: {{error}}'
    severity: info
    given: $
    then:
      field: security
      function: truthy
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-security-require-root
  openapi-security-require-root-scheme:
    description: Security field MUST be present at the root of the spec with at least one item (ie. HTTPBearer, Token, APIKey,
      etc.).
    message: Security field MUST be present at the root of the spec with at least one item (ie.
    severity: info
    given: $
    then:
      field: security
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1
    documentationUrl: https://apicommons.org/rules/#openapi-security-require-root-scheme
  openapi-server-on-approved-domain:
    description: APIs SHOULD be accessible under api.spscommerce.com.
    message: APIs SHOULD be accessible under api.spscommerce.com.
    severity: info
    given: $.servers..url
    then:
      function: pattern
      functionOptions:
        match: api.spscommerce.com|api.sps-internal.com|localhost
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-server-on-approved-domain
  openapi-server-url-meet-standards:
    formats:
    - oas3
    description: API URLs should meet the Trimble API Standards.
    message: '{{error}}'
    severity: info
    given: $.servers
    then:
      function: trimble-valid-url-checker
    documentationUrl: https://apicommons.org/rules/#openapi-server-url-meet-standards
  openapi-agentic-access-acting-escalation:
    description: Any acting operation should declare an escalation policy — even 'none' by explicit decision — so runtime
      approval behavior is never left implicit.
    message: Acting operation should declare escalation.human-in-the-loop (may be 'none' by decision).
    severity: info
    given: $.paths[*][get,post,put,patch,delete,options,head,trace].x-agentic-access
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          if:
            properties:
              action-class:
                const: acting
            required:
            - action-class
          then:
            required:
            - escalation
            properties:
              escalation:
                type: object
                required:
                - human-in-the-loop
    documentationUrl: https://apicommons.org/rules/#openapi-agentic-access-acting-escalation
  apis-json-api-property-require-linting-rules:
    description: This property ensures that an API has governance rules applied, usually as part of a central set of governance
      rules, defined by policy, or stages of the API lifecycle.
    message: Has Linting Rules
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-rules|OpenApiRules)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-api-property-require-linting-rules
  apis-json-api-property-require-road-map:
    description: This property ensures there is a reference to the road map for an API or for the entire API operations within
      domain, line of business, or teams.
    message: Has a Road Map
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-road-map|road-map|Roadmap|Road Map|RoadMap)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-api-property-require-road-map
  apis-json-api-property-require-team:
    description: This property ensures that there is a reference to the team behind an API, providing a reference to business
      and engineering stakeholders.
    message: Has a Team Defined
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(team|teams|Team|Teams)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-api-property-require-team
  apis-json-api-property-require-terms-of-service:
    description: This property ensures that an API has a reference to a terms of service, covering the legal side of using
      an API.
    message: Has an API Terms of Service
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-terms-of-service|terms-of-service|Terms of Service|TOS|TermsOfService)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-api-property-require-terms-of-service
  apis-json-api-property-require-vocabulary:
    description: This property ensures that there is a centralized vocabulary in use for guiding the creation and usage of
      tags, path segments, and other metadata associated with an APIs.
    message: Has Vocabulary
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(vocabulary|vocabularies|Vocabulary|Vocabularies)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-api-property-require-vocabulary
  apis-json-api-require-aid:
    description: Every API should have a unique identifier, known as an AID (API Identifier). The APIs.json file, contract,
      or collection contains its own AID, which the API uses as part of its reference. Additionally, the API applies a slugified
      version of its name, resulting in a unique, human-readable identifier for the API.
    message: APIs MUST have an aid property.
    severity: info
    given: $.apis.*
    then:
      field: aid
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-api-require-aid
  apis-json-document-include-business-impact-canvas:
    description: This ensures that an API has had the APIOps Business Impact Canvas applied to the API, requiring that the
      canvas is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Business Impact Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsBusinessImpactCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-business-impact-canvas
  apis-json-document-include-business-model-canvas:
    description: This ensures that an API has had the APIOps Business Model Canvas applied to the API, requiring that the
      canvas is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Business Model Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsBusinessModelCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-business-model-canvas
  apis-json-document-include-capacity-canvas:
    description: This ensures that an API has had the APIOps Capacity Canvas applied to the API, requiring that the canvas
      is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Capacity Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsCapacityCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-capacity-canvas
  apis-json-document-include-customer-journey-canvas:
    description: This ensures that an API has had the APIOps Customer Journey Canvas applied to the API, requiring that the
      canvas is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Customer Journey Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsCustomerJourneyCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-customer-journey-canvas
  apis-json-document-include-domain-canvas:
    description: This ensures that an API has had the APIOps Domain Canvas applied to the API, requiring that the canvas is
      present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Domain Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsDomainCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-domain-canvas
  apis-json-document-include-event-canvas:
    description: This ensures that an API has had the APIOps Event Canvas applied to the API, requiring that the canvas is
      present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Event Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsEventCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-event-canvas
  apis-json-document-include-locations-canvas:
    description: This ensures that an API has had the APIOps Locations Canvas applied to the API, requiring that the canvas
      is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Locations Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsLocationsCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-locations-canvas
  apis-json-document-include-rest-canvas:
    description: This ensures that an API has had the APIOps Locations Canvas applied to the API, requiring that the canvas
      is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Locations Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsRestCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-rest-canvas
  apis-json-document-include-value-proposition-canvas:
    description: This ensures that an API has had the APIOps Value Proposition Canvas applied to the API, requiring that the
      canvas is present in the repository and registered in the APIs.json index for the API, helping with discovery and governance.
    message: Has APIOps Cycles Value Proposition Canvas
    severity: info
    given:
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIOpsValuePropositionCanvas)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-document-include-value-proposition-canvas
  apis-json-document-require-access:
    description: apis-json document should declare a `access` property.
    message: Missing `access`.
    given: $
    severity: info
    then:
      field: access
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-access
  apis-json-document-require-aid:
    description: apis-json document should declare a `aid` property.
    message: Missing `aid`.
    given: $
    severity: info
    then:
      field: aid
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-aid
  apis-json-document-require-apis:
    description: apis-json document should declare a `apis` property.
    message: Missing `apis`.
    given: $
    severity: info
    then:
      field: apis
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-apis
  apis-json-document-require-common:
    description: apis-json document should declare a `common` property.
    message: Missing `common`.
    given: $
    severity: info
    then:
      field: common
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-common
  apis-json-document-require-created:
    description: apis-json document should declare a `created` property.
    message: Missing `created`.
    given: $
    severity: info
    then:
      field: created
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-created
  apis-json-document-require-description:
    description: apis-json document should declare a `description` property.
    message: Missing `description`.
    given: $
    severity: info
    then:
      field: description
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-description
  apis-json-document-require-image:
    description: apis-json document should declare a `image` property.
    message: Missing `image`.
    given: $
    severity: info
    then:
      field: image
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-image
  apis-json-document-require-include:
    description: apis-json document should declare a `include` property.
    message: Missing `include`.
    given: $
    severity: info
    then:
      field: include
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-include
  apis-json-document-require-kind:
    description: apis-json document should declare a `kind` property.
    message: Missing `kind`.
    given: $
    severity: info
    then:
      field: kind
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-kind
  apis-json-document-require-maintainer:
    description: apis-json document should declare a `maintainers` property.
    message: Missing `maintainers`.
    given: $
    severity: info
    then:
      field: maintainers
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-maintainer
  apis-json-document-require-modified:
    description: apis-json document should declare a `modified` property.
    message: Missing `modified`.
    given: $
    severity: info
    then:
      field: modified
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-modified
  apis-json-document-require-name:
    description: apis-json document should declare a `name` property.
    message: Missing `name`.
    given: $
    severity: info
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-name
  apis-json-document-require-network:
    description: apis-json document should declare a `network` property.
    message: Missing `network`.
    given: $
    severity: info
    then:
      field: network
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-network
  apis-json-document-require-overlays:
    description: apis-json document should declare a `overlays` property.
    message: Missing `overlays`.
    given: $
    severity: info
    then:
      field: overlays
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-overlays
  apis-json-document-require-position:
    description: apis-json document should declare a `position` property.
    message: Missing `position`.
    given: $
    severity: info
    then:
      field: position
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-position
  apis-json-document-require-prompts:
    description: apis-json document should declare a `prompts` property.
    message: Missing `prompts`.
    given: $
    severity: info
    then:
      field: prompts
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-prompts
  apis-json-document-require-rating:
    description: apis-json document should declare a `rating` property.
    message: Missing `rating`.
    given: $
    severity: info
    then:
      field: rating
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-rating
  apis-json-document-require-rules:
    description: apis-json document should declare a `rules` property.
    message: Missing `rules`.
    given: $
    severity: info
    then:
      field: rules
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-rules
  apis-json-document-require-specificationversion:
    description: apis-json document should declare a `specificationVersion` property.
    message: Missing `specificationVersion`.
    given: $
    severity: info
    then:
      field: specificationVersion
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-specificationversion
  apis-json-document-require-tag:
    description: apis-json document should declare a `tags` property.
    message: Missing `tags`.
    given: $
    severity: info
    then:
      field: tags
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-tag
  apis-json-document-require-type:
    description: apis-json document should declare a `type` property.
    message: Missing `type`.
    given: $
    severity: info
    then:
      field: type
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-type
  apis-json-document-require-url:
    description: apis-json document should declare a `url` property.
    message: Missing `url`.
    given: $
    severity: info
    then:
      field: url
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-url
  apis-json-document-require-visibility:
    description: apis-json document should declare a `visibility` property.
    message: Missing `visibility`.
    given: $
    severity: info
    then:
      field: visibility
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-visibility
  apis-json-document-require-workflow:
    description: apis-json document should declare a `workflows` property.
    message: Missing `workflows`.
    given: $
    severity: info
    then:
      field: workflows
      function: truthy
    documentationUrl: https://apicommons.org/rules/#apis-json-document-require-workflow
  apis-json-schema-include-api-lifecycle:
    description: This property makes sure there is an API lifecycle schema defining all of the stages of a lifecycle and which
      policies get applied at each stage of the API lifecycle.
    message: Has an API Lifecycle
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(lifecycle|Lifecycle)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-api-lifecycle
  apis-json-schema-include-business-validator:
    description: This property ensures that there is a link to the validator for the APIs.
    message: Has APIs.json (Business) Validator
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(OperationalValidation)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-business-validator
  apis-json-schema-include-deprecation-policy:
    description: This property ensures that an API has a deprecation policy shared as part of the contract, communicating
      what the lifespan of APIs are, each individual version, as well as communication around the deprecation of APIs.
    message: Has Deprecation Policy
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-deprecation-policy|deprecation-policy|Deprecation|Deprecation Policy|DeprecationPolicy)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-deprecation-policy
  apis-json-schema-include-gateway-reference:
    description: This property ensures that there is a reference to the gateway for an API, referencing where you can manage
      the configuration for each API.
    message: Has Staging Gateway for API
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(gateway|Gateway)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-gateway-reference
  apis-json-schema-include-github-action:
    description: This property ensures that a GitHub Actions CI/CD pipeline is available for an API, providing a link to the
      pipeline YAML artifact, which can be used to automate and govern the API as part of the build process.
    message: Has a GitHub Action
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(github-actions|GitHubActions)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-github-action
  apis-json-schema-include-governance-policies:
    description: This property ensures there is a governance policies reference as part of an API contract, usually a common
      property pointing to a centralized set of policies that get applied.
    message: Has API Governance Policies
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-policies|Policies)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-governance-policies
  apis-json-schema-include-interface-license:
    description: This property ensures that an API Commons interface license exists for an API, providing a machine-readable
      reference for an API, as well as data, backend, and front-end code.
    message: Has Interface License
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-license|License|license|InterfaceLicense)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-interface-license
  apis-json-schema-include-openapi-governance-rules:
    description: This property ensures that an OpenAPI has support governance rules, that can be applied during design time
      via editors, development time via IDE, and run-time via CI/CD pipelines.
    message: Has API Rules
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-rules|ApiRules)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-openapi-governance-rules
  apis-json-schema-include-openapi-validator:
    description: This property ensures that there is a link to the validator for the OpenAPI technical contract, allowing
      anyone to see the details of governance being applied.
    message: Has OpenAPI (Technical) Validator
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(APIValidation)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-openapi-validator
  apis-json-schema-include-operational-rules:
    description: This property ensures that an API has operational level rules for APIs.
    message: Has Operational Rules
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(operational-rules|OperationalRules)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-operational-rules
  apis-json-schema-include-privacy-policy:
    description: This property provides a link to the privacy policy for an API, providing the legal details of how privacy
      is approached for each API.
    message: Has an API Privacy Policy
    severity: info
    given:
    - $.apis.*.properties.*
    - $.common.*
    then:
    - field: type
      function: pattern
      functionOptions:
        notMatch: \b(api-privacy-policy|privacy-policy|Privacy|Privacy Policy|PrivacyPolicy)\b
    documentationUrl: https://apicommons.org/rules/#apis-json-schema-include-privacy-policy
  asyncapi-document-require-asyncapi:
    description: asyncapi document should declare a `asyncapi` property.
    message: Missing `asyncapi`.
    given: $
    severity: info
    then:
      field: asyncapi
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-asyncapi
  asyncapi-document-require-channel:
    description: asyncapi document should declare a `channels` property.
    message: Missing `channels`.
    given: $
    severity: info
    then:
      field: channels
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-channel
  asyncapi-document-require-component:
    description: asyncapi document should declare a `components` property.
    message: Missing `components`.
    given: $
    severity: info
    then:
      field: components
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-component
  asyncapi-document-require-defaultcontenttype:
    description: asyncapi document should declare a `defaultContentType` property.
    message: Missing `defaultContentType`.
    given: $
    severity: info
    then:
      field: defaultContentType
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-defaultcontenttype
  asyncapi-document-require-id:
    description: asyncapi document should declare a `id` property.
    message: Missing `id`.
    given: $
    severity: info
    then:
      field: id
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-id
  asyncapi-document-require-info:
    description: asyncapi document should declare a `info` property.
    message: Missing `info`.
    given: $
    severity: info
    then:
      field: info
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-info
  asyncapi-document-require-operation:
    description: asyncapi document should declare a `operations` property.
    message: Missing `operations`.
    given: $
    severity: info
    then:
      field: operations
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-operation
  asyncapi-document-require-server:
    description: asyncapi document should declare a `servers` property.
    message: Missing `servers`.
    given: $
    severity: info
    then:
      field: servers
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-document-require-server
  arazzo-document-require-arazzo:
    description: arazzo document should declare a `arazzo` property.
    message: Missing `arazzo`.
    given: $
    severity: info
    then:
      field: arazzo
      function: truthy
    documentationUrl: https://apicommons.org/rules/#arazzo-document-require-arazzo
  arazzo-document-require-component:
    description: arazzo document should declare a `components` property.
    message: Missing `components`.
    given: $
    severity: info
    then:
      field: components
      function: truthy
    documentationUrl: https://apicommons.org/rules/#arazzo-document-require-component
  arazzo-document-require-info:
    description: arazzo document should declare a `info` property.
    message: Missing `info`.
    given: $
    severity: info
    then:
      field: info
      function: truthy
    documentationUrl: https://apicommons.org/rules/#arazzo-document-require-info
  arazzo-document-require-sourcedescriptions:
    description: arazzo document should declare a `sourceDescriptions` property.
    message: Missing `sourceDescriptions`.
    given: $
    severity: info
    then:
      field: sourceDescriptions
      function: truthy
    documentationUrl: https://apicommons.org/rules/#arazzo-document-require-sourcedescriptions
  arazzo-document-require-workflow:
    description: arazzo document should declare a `workflows` property.
    message: Missing `workflows`.
    given: $
    severity: info
    then:
      field: workflows
      function: truthy
    documentationUrl: https://apicommons.org/rules/#arazzo-document-require-workflow
  plans-document-require-currency:
    description: The `currency` property should be present.
    message: currency should be present
    severity: info
    given: $
    then:
      field: currency
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-document-require-currency
  plans-document-require-description:
    description: The `description` property should be present.
    message: description should be present
    severity: info
    given: $
    then:
      field: description
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-document-require-description
  plans-document-require-name:
    description: The `name` property should be present.
    message: name should be present
    severity: info
    given: $
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-document-require-name
  plans-document-require-plan:
    description: The `plans` property should be present.
    message: plans should be present
    severity: info
    given: $
    then:
      field: plans
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-document-require-plan
  plans-plan-require-limit:
    description: The `limits` property of each plan should be present.
    message: limits should be present
    severity: info
    given: $.plans[*]
    then:
      field: limits
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-plan-require-limit
  plans-plan-require-name:
    description: The `name` property of each plan should be present.
    message: name should be present
    severity: info
    given: $.plans[*]
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-plan-require-name
  plans-plan-require-price:
    description: The `price` property of each plan should be present.
    message: price should be present
    severity: info
    given: $.plans[*]
    then:
      field: price
      function: truthy
    documentationUrl: https://apicommons.org/rules/#plans-plan-require-price
  rate-limits-document-require-description:
    description: The `description` property should be present.
    message: description should be present
    severity: info
    given: $
    then:
      field: description
      function: truthy
    documentationUrl: https://apicommons.org/rules/#rate-limits-document-require-description
  rate-limits-document-require-name:
    description: The `name` property should be present.
    message: name should be present
    severity: info
    given: $
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#rate-limits-document-require-name
  rate-limits-limit-require-max:
    description: The `max` property of each limit should be present.
    message: max should be present
    severity: info
    given: $.limits[*]
    then:
      field: max
      function: truthy
    documentationUrl: https://apicommons.org/rules/#rate-limits-limit-require-max
  rate-limits-limit-require-scope:
    description: The `scope` property of each limit should be present.
    message: scope should be present
    severity: info
    given: $.limits[*]
    then:
      field: scope
      function: truthy
    documentationUrl: https://apicommons.org/rules/#rate-limits-limit-require-scope
  rate-limits-limit-require-window:
    description: The `window` property of each limit should be present.
    message: window should be present
    severity: info
    given: $.limits[*]
    then:
      field: window
      function: truthy
    documentationUrl: https://apicommons.org/rules/#rate-limits-limit-require-window
  finops-cost-finops-require-monthly:
    description: The `monthly` property of each cost should be present.
    message: monthly should be present
    severity: info
    given: $.costs[*]
    then:
      field: monthly
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-cost-finops-require-monthly
  finops-cost-finops-require-service:
    description: The `service` property of each cost should be present.
    message: service should be present
    severity: info
    given: $.costs[*]
    then:
      field: service
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-cost-finops-require-service
  finops-document-finops-require-budget:
    description: The `budget` property should be present.
    message: budget should be present
    severity: info
    given: $
    then:
      field: budget
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-budget
  finops-document-finops-require-cost:
    description: The `costs` property should be present.
    message: costs should be present
    severity: info
    given: $
    then:
      field: costs
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-cost
  finops-document-finops-require-currency:
    description: The `currency` property should be present.
    message: currency should be present
    severity: info
    given: $
    then:
      field: currency
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-currency
  finops-document-finops-require-description:
    description: The `description` property should be present.
    message: description should be present
    severity: info
    given: $
    then:
      field: description
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-description
  finops-document-finops-require-name:
    description: The `name` property should be present.
    message: name should be present
    severity: info
    given: $
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-name
  finops-document-finops-require-period:
    description: A FinOps artifact should declare a period (e.g. monthly, annual) for the budget and costs.
    message: FinOps should declare a period.
    given: $
    severity: info
    then:
      field: period
      function: truthy
    documentationUrl: https://apicommons.org/rules/#finops-document-finops-require-period
  agent-skill-skill-require-allowed-tools:
    description: agent-skill document should declare a `allowed-tools` property.
    message: Missing `allowed-tools`.
    given: $.frontmatter
    severity: info
    then:
      field: allowed-tools
      function: truthy
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-require-allowed-tools
  agent-skill-skill-require-metadata:
    description: agent-skill document should declare a `metadata` property.
    message: Missing `metadata`.
    given: $.frontmatter
    severity: info
    then:
      field: metadata
      function: truthy
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-require-metadata
  agent-skill-skill-require-version:
    description: agent-skill document should declare a `version` property.
    message: Missing `version`.
    given: $.frontmatter
    severity: info
    then:
      field: version
      function: truthy
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-require-version
  agent-skill-skill-allowed-tools-array:
    description: If a skill declares allowed-tools, it must be an array of tool names so its capability surface is explicit
      and auditable.
    message: allowed-tools must be an array of tool names.
    severity: info
    given: $.frontmatter['allowed-tools']
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          items:
            type: string
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-allowed-tools-array
  agent-skill-skill-license:
    description: A skill should declare a license so consumers know the terms under which they can reuse and redistribute
      it.
    message: A skill should declare a license.
    severity: info
    given: $.frontmatter
    then:
      field: license
      function: truthy
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-license
  agent-skill-skill-name:
    description: A skill must declare a name in its frontmatter — it identifies the skill to agents and tooling.
    message: A skill must declare a name.
    severity: info
    given: $.frontmatter
    then:
      field: name
      function: truthy
    documentationUrl: https://apicommons.org/rules/#agent-skill-skill-name