7digital · API Governance Rules

7digital API Rules

Spectral linting rules defining API design standards and conventions for 7digital.

36 Rules error 17 warn 15 info 4
View Rules File View on GitHub

Rule Categories

delete global info no oauth openapi operation parameter path post request response schema servers tag

Rules

error
info-title-prefix
API title must begin with "7digital" (the provider brand).
$.info.title
error
info-description-required
API info MUST include a non-trivial description (>= 60 chars).
$.info
error
info-version-required
API info MUST include a version.
$.info
warn
info-contact-required
API info SHOULD declare a contact (Client Success).
$.info
warn
info-license-required
API info SHOULD declare a license (commercial agreement).
$.info
error
openapi-version-pinned
OpenAPI must be 3.0.x.
$.openapi
error
servers-required
At least one server MUST be defined.
$
error
servers-https-only
Server URLs MUST use https (TLS).
$.servers[*].url
info
servers-7digital-host
Production servers SHOULD live under api.7digital.com.
$.servers[*].url
error
path-no-trailing-slash
Paths MUST NOT end with a trailing slash.
$.paths.*~
warn
path-camel-case-segments
Path segments use camelCase (e.g. `unlimitedStreaming`) per the existing 7digital convention.
$.paths.*~
error
operation-id-required
Every operation MUST declare an operationId.
$.paths.*[get,post,put,patch,delete]
error
operation-id-camel-case
operationId MUST be camelCase.
$.paths.*[get,post,put,patch,delete].operationId
warn
operation-id-verb-prefix
operationId SHOULD start with a known verb prefix.
$.paths.*[get,post,put,patch,delete].operationId
error
operation-summary-required
Every operation MUST declare a summary.
$.paths.*[get,post,put,patch,delete]
error
operation-summary-prefix
Operation summaries MUST begin with "7digital ".
$.paths.*[get,post,put,patch,delete].summary
warn
operation-description-required
Every operation MUST declare a description.
$.paths.*[get,post,put,patch,delete]
error
operation-tags-required
Every operation MUST be tagged.
$.paths.*[get,post,put,patch,delete]
info
operation-microcks-extension
Operations SHOULD declare x-microcks-operation for mock-server compatibility.
$.paths.*[get,post,put,patch,delete]
warn
global-tags-defined
Global tags array SHOULD be defined with descriptions.
$
warn
tag-description-required
Each global tag MUST have a description.
$.tags[*]
info
tag-title-case
Global tag names use Title Case (e.g. "Interactive Radio").
$.tags[*].name
warn
parameter-description-required
Each parameter MUST have a description.
$..parameters[*]
error
parameter-schema-required
Each parameter MUST have a schema.type.
$..parameters[*]
warn
parameter-camel-case
Parameter names use camelCase (e.g. `pageSize`, `releaseId`).
$..parameters[*].name
warn
request-body-content-type
Request bodies SHOULD use application/json or application/x-www-form-urlencoded (OAuth signing).
$.paths.*[post,put,patch,delete].requestBody.content
error
response-success-required
Each operation MUST declare at least one 2xx response.
$.paths.*[get,post,put,patch,delete].responses
warn
response-description-required
Every response MUST have a description.
$.paths.*[get,post,put,patch,delete].responses.*
info
response-error-401
Operations SHOULD declare a 401 response (authentication failure).
$.paths.*[get,post,put,patch,delete].responses
warn
schema-property-camel-case
Schema properties use camelCase (e.g. `releaseId`, `previewUrl`).
$.components.schemas..properties.*~
warn
schema-type-required
Schemas MUST declare a type or composition keyword.
$.components.schemas.*
error
global-security-required
A global security requirement MUST be defined (OAuth 1.0).
$
error
oauth-security-scheme-defined
Security schemes MUST include an OAuth 1.0 scheme.
$.components.securitySchemes
error
no-get-request-body
GET operations MUST NOT declare a request body.
$.paths.*.get
warn
post-put-patch-request-body
POST, PUT, and PATCH operations SHOULD declare a request body.
$.paths.*[post,put,patch]
warn
delete-no-request-body
DELETE operations MUST NOT declare a request body.
$.paths.*.delete

Spectral Ruleset

Raw ↑ 
# 7digital Spectral Ruleset
# Generated for api-evangelist/7digital — enforces the conventions observed
# across the 7digital classic API (v1.2) and the modern MassiveMusic Streaming
# Platform API.

extends:
  - spectral:oas

rules:
  # ── INFO / METADATA ─────────────────────────────────────────────────────
  info-title-prefix:
    description: API title must begin with "7digital" (the provider brand).
    severity: error
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: "^7digital"

  info-description-required:
    description: API info MUST include a non-trivial description (>= 60 chars).
    severity: error
    given: $.info
    then:
      field: description
      function: length
      functionOptions:
        min: 60

  info-version-required:
    description: API info MUST include a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy

  info-contact-required:
    description: API info SHOULD declare a contact (Client Success).
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy

  info-license-required:
    description: API info SHOULD declare a license (commercial agreement).
    severity: warn
    given: $.info
    then:
      field: license
      function: truthy

  # ── OPENAPI VERSION + SERVERS ──────────────────────────────────────────
  openapi-version-pinned:
    description: OpenAPI must be 3.0.x.
    severity: error
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: "^3\\.0\\."

  servers-required:
    description: At least one server MUST be defined.
    severity: error
    given: $
    then:
      field: servers
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  servers-https-only:
    description: Server URLs MUST use https (TLS).
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: "^https://"

  servers-7digital-host:
    description: Production servers SHOULD live under api.7digital.com.
    severity: info
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: "api\\.7digital\\.com"

  # ── PATHS ──────────────────────────────────────────────────────────────
  path-no-trailing-slash:
    description: Paths MUST NOT end with a trailing slash.
    severity: error
    given: $.paths.*~
    then:
      function: pattern
      functionOptions:
        notMatch: "/$"

  path-camel-case-segments:
    description: Path segments use camelCase (e.g. `unlimitedStreaming`) per the existing 7digital convention.
    severity: warn
    given: $.paths.*~
    then:
      function: pattern
      functionOptions:
        match: "^(/[a-zA-Z][a-zA-Z0-9-]*(\\{[a-zA-Z][a-zA-Z0-9]*\\})?)+$"

  # ── OPERATIONS ─────────────────────────────────────────────────────────
  operation-id-required:
    description: Every operation MUST declare an operationId.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy

  operation-id-camel-case:
    description: operationId MUST be camelCase.
    severity: error
    given: $.paths.*[get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  operation-id-verb-prefix:
    description: operationId SHOULD start with a known verb prefix.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: "^(get|list|find|search|browse|create|update|delete|remove|add|apply|complete|signup|authenticate|stream|download|transfer|report|post|put|deliver|select|register|resolve|match|credit|authorize|authorise)[A-Z]"

  operation-summary-required:
    description: Every operation MUST declare a summary.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: summary
      function: truthy

  operation-summary-prefix:
    description: Operation summaries MUST begin with "7digital ".
    severity: error
    given: $.paths.*[get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: "^7digital "

  operation-description-required:
    description: Every operation MUST declare a description.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: description
      function: truthy

  operation-tags-required:
    description: Every operation MUST be tagged.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: tags
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  operation-microcks-extension:
    description: Operations SHOULD declare x-microcks-operation for mock-server compatibility.
    severity: info
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy

  # ── TAGS ───────────────────────────────────────────────────────────────
  global-tags-defined:
    description: Global tags array SHOULD be defined with descriptions.
    severity: warn
    given: $
    then:
      field: tags
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  tag-description-required:
    description: Each global tag MUST have a description.
    severity: warn
    given: $.tags[*]
    then:
      field: description
      function: truthy

  tag-title-case:
    description: Global tag names use Title Case (e.g. "Interactive Radio").
    severity: info
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: "^[A-Z][A-Za-z0-9]*( [A-Z][A-Za-z0-9]*)*$"

  # ── PARAMETERS ─────────────────────────────────────────────────────────
  parameter-description-required:
    description: Each parameter MUST have a description.
    severity: warn
    given: $..parameters[*]
    then:
      field: description
      function: truthy

  parameter-schema-required:
    description: Each parameter MUST have a schema.type.
    severity: error
    given: $..parameters[*]
    then:
      field: schema
      function: truthy

  parameter-camel-case:
    description: Parameter names use camelCase (e.g. `pageSize`, `releaseId`).
    severity: warn
    given: $..parameters[*].name
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  # ── REQUEST BODIES ─────────────────────────────────────────────────────
  request-body-content-type:
    description: Request bodies SHOULD use application/json or application/x-www-form-urlencoded (OAuth signing).
    severity: warn
    given: $.paths.*[post,put,patch,delete].requestBody.content
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["application/json"]
            - required: ["application/x-www-form-urlencoded"]

  # ── RESPONSES ──────────────────────────────────────────────────────────
  response-success-required:
    description: Each operation MUST declare at least one 2xx response.
    severity: error
    given: $.paths.*[get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["200"]
            - required: ["201"]
            - required: ["202"]
            - required: ["204"]

  response-description-required:
    description: Every response MUST have a description.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete].responses.*
    then:
      field: description
      function: truthy

  response-error-401:
    description: Operations SHOULD declare a 401 response (authentication failure).
    severity: info
    given: $.paths.*[get,post,put,patch,delete].responses
    then:
      field: "401"
      function: truthy

  # ── SCHEMAS ────────────────────────────────────────────────────────────
  schema-property-camel-case:
    description: Schema properties use camelCase (e.g. `releaseId`, `previewUrl`).
    severity: warn
    given: $.components.schemas..properties.*~
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  schema-type-required:
    description: Schemas MUST declare a type or composition keyword.
    severity: warn
    given: $.components.schemas.*
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["type"]
            - required: ["allOf"]
            - required: ["oneOf"]
            - required: ["anyOf"]
            - required: ["$ref"]

  # ── SECURITY ───────────────────────────────────────────────────────────
  global-security-required:
    description: A global security requirement MUST be defined (OAuth 1.0).
    severity: error
    given: $
    then:
      field: security
      function: truthy

  oauth-security-scheme-defined:
    description: Security schemes MUST include an OAuth 1.0 scheme.
    severity: error
    given: $.components.securitySchemes
    then:
      field: oauth1
      function: truthy

  # ── HTTP METHOD CONVENTIONS ────────────────────────────────────────────
  no-get-request-body:
    description: GET operations MUST NOT declare a request body.
    severity: error
    given: $.paths.*.get
    then:
      field: requestBody
      function: falsy

  post-put-patch-request-body:
    description: POST, PUT, and PATCH operations SHOULD declare a request body.
    severity: warn
    given: $.paths.*[post,put,patch]
    then:
      field: requestBody
      function: truthy

  delete-no-request-body:
    description: DELETE operations MUST NOT declare a request body.
    severity: warn
    given: $.paths.*.delete
    then:
      field: requestBody
      function: falsy