experience-security.html

Authentication, authorization, and the OWASP API Security Top 10 as machine checks.

68 rules experience: security 61 inlined · 7 from the engine

Run this ruleset

Lint any matching artifact against this ruleset with the Spotlight CLI:

npm i -g @spotlight-rules/spotlight-cli
spotlight lint api.yaml \
  --ruleset https://apicommons.org/assets/rulesets/experience-security.spotlight.yaml

Or load it into the browser validator, post it to the HTTP API, or wire it into a CI gate. 7 of these rules are the engine's built-ins (they come with spotlight:*); the other 61 are inlined in the file below.

Ruleset definition

Download YAML 

Loading…

Rules in this ruleset (68)

Skill Allowed Tools Array Agent Skill
API Baseurl HTTPS APIs.json
API Property Require Security Page APIs.json
API Property URL HTTPS APIs.json
Document APIs JSON URL HTTPS APIs.json
Schema Include Authentication Page APIs.json
Arazzo No Script Tags In Markdown Arazzo engine
Asyncapi 3 Operation Security AsyncAPI engine
Asyncapi Operation Security AsyncAPI engine
Asyncapi Server Security AsyncAPI engine
Agentic Access Consequence Requirements OpenAPI
Agentic Access Contract Declared OpenAPI
Agentic Access Delegation Token Exchange OpenAPI
Agentic Access OAuth Protected OpenAPI
Agentic Access Safety Critical Human In The Loop OpenAPI
Component Require Security Schemes OpenAPI
Document OWASP API9 Server OpenAPI
Info Description No Eval Tag OpenAPI
Info Description No Script Tag OpenAPI
Info OWASP API9 Document Version OpenAPI
No Eval In Markdown OpenAPI engine
No Script Tags In Markdown OpenAPI engine
OAS3 Operation Security Defined OpenAPI engine
Operation Get Require Security OpenAPI
Operation Require Security OpenAPI
Operation Require Security 2 OpenAPI
Operation Security Use Defined Scheme OpenAPI
Parameter Avoid Integer ID OpenAPI
Parameter No API Keys In Query OpenAPI
Parameter OWASP API1 No Numeric IDs OpenAPI
Path No Technology Leak In OpenAPI
Response CORS Allow Origin No Wildcard OpenAPI
Response Delete Define 401 OpenAPI
Response Get Define 401 OpenAPI
Response No Sensitive Data In Header OpenAPI
Response OWASP API3 Define Error Validation OpenAPI
Response OWASP API8 Define Error 401 OpenAPI
Response OWASP API8 Define Error 500 OpenAPI
Response Post Define 401 OpenAPI
Response Put Define 401 OpenAPI
Response Success Require Ratelimit Header OpenAPI
Schema Array Require Min Max Items OpenAPI
Schema Number Require Min Max OpenAPI
Schema Object Constrain Additional Property OpenAPI
Schema Object Disallow Additional Property OpenAPI
Schema Object Set Additional Property OpenAPI
Schema OWASP API4 Integer Format OpenAPI
Schema String Require Max Length OpenAPI
Schema String Require Pattern Or Format OpenAPI
Schema Write Operation Require Security OpenAPI
Security Bearer Scheme Require Bearer Format OpenAPI
Security JWT Scheme Require Description OpenAPI
Security No HTTP Basic Auth OpenAPI
Security OAuth Disallow Insecure Flows OpenAPI
Security OAuth Endpoints Require HTTPS OpenAPI
Security OAuth Flow Require Scopes OpenAPI
Security OAuth Scheme Require Description OpenAPI
Security OpenID-Connect Require URL OpenAPI
Security OpenID-Connect URL HTTPS OpenAPI
Security OWASP API2 Auth Insecure Schemes OpenAPI
Security OWASP API2 No API Keys In URL OpenAPI
Security Require Root OpenAPI
Security Require Root Scheme OpenAPI
Security Scheme Require Description OpenAPI
Server Must Use HTTPS OpenAPI
Server Require HTTPS OpenAPI
Server Require HTTPS 2 OpenAPI
Server URL Require HTTPS OpenAPI

← All experience rulesets