Medplum · API Governance Rules

Medplum API Rules

Spectral linting rules defining API design standards and conventions for Medplum.

5 Rules warn 4 info 1
View Rules File View on GitHub

Rule Categories

fhir medplum no operation

Rules

warn
operation-summary
Operations should have a Title Case summary.
$.paths[*][get,put,post,delete,patch]
warn
medplum-bearer-security
Medplum FHIR REST API operations must require bearer-token security.
$.components.securitySchemes
warn
medplum-resource-path
Medplum FHIR R4 paths must start with /fhir/R4/{resourceType}.
$.paths
warn
no-trailing-slash
Paths must not end with a trailing slash.
$.paths
info
fhir-r4-schema-ref
Request and response bodies should reference R4 component schemas.
$.paths[*][get,post,put,patch].responses.200.content.application/fhir+json.schema

Spectral Ruleset

Raw ↑ 
extends:
  - spectral:oas

rules:
  # All operations should declare a summary
  operation-summary:
    description: Operations should have a Title Case summary.
    severity: warn
    given: $.paths[*][get,put,post,delete,patch]
    then:
      - field: summary
        function: truthy

  # Medplum FHIR REST uses bearer tokens
  medplum-bearer-security:
    description: Medplum FHIR REST API operations must require bearer-token security.
    severity: warn
    given: $.components.securitySchemes
    then:
      function: truthy

  # Path-template segments must use resourceType / id naming
  medplum-resource-path:
    description: Medplum FHIR R4 paths must start with /fhir/R4/{resourceType}.
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        match: '^/fhir/R4/.*'

  # Avoid trailing slashes on paths
  no-trailing-slash:
    description: Paths must not end with a trailing slash.
    severity: warn
    given: $.paths
    then:
      function: pattern
      functionOptions:
        notMatch: '.+/$'

  # Operations should reference standard FHIR R4 schemas
  fhir-r4-schema-ref:
    description: Request and response bodies should reference R4 component schemas.
    severity: info
    given: $.paths[*][get,post,put,patch].responses.200.content.application/fhir+json.schema
    then:
      field: '$ref'
      function: truthy