Linter rulesOpenAPI linter rules
OpenAPI linter rules
Rulesets
Rules
| Rule | What it checks | Since |
|---|---|---|
audience-defined | This rule checks whether an OpenAPI schema defines its target audience. | 0.0.1 |
contact-defined | This rule checks whether the contact object is present in an OpenAPI schema. | 0.0.1 |
id-defined | This rule checks whether the #/info/x-id attribute is present in an OpenAPI schema and if it's a valid UUID. | 0.0.1 |
info-defined | This rule checks whether the info object is present in an OpenAPI schema and if it contains the summary, description, and version fields. | 0.0.1 |
json-api/content-type | This rule ensures that every request and response in an OpenAPI schema provides the application/vnd.api+json media type. | 0.0.1 |
json-api/resource-type-unique | This rule ensures that all resource schemas in a JSON:API have unique resource IDs. | 0.0.1 |
json-api/schema-validation | This rule ensures that request and response documents in a JSON:API conform to the JSON:API specification. | 0.0.1 |
json-schema-validation | Validates OpenAPI 3.0 schema against JSON meta-schema. | 0.5.0 |
license-defined | This rule checks whether the licensing information is present in an OpenAPI schema. | 0.0.1 |
no-content-response-defined | This rule ensures that responses for HTTP status 204 do not define their response bodies. | 0.0.1 |
openapi-json-schema-validation | This rule validates an OpenAPI specification against the OpenAPI 3.x JSON schema. | 0.0.1 |
operation-description-defined | This rule checks each operation's description in an OpenAPI schema and warns if the description is empty. | 0.0.1 |
operation-document-not-primitive | Check operation responses and warn if they are defined as primitive values. | 0.0.1 |
operation-id-defined | This rule checks each operation defined in an OpenAPI schema and warns if operation IDs are missing or empty. | 0.0.1 |
operation-id-unique | This rule checks whether operations defined in an OpenAPI schema have unique IDs. | 0.0.1 |
operation-rate-limiting-defined | Warn if operation does not define rate limiting headers. | 0.0.1 |
operation-security-defined | Warn if OpenAPI operation does not have any sequrity requirements. | 0.0.1 |
operation-success-response | This rule warns when an operation in an OpenAPI schema does not define any success response, i.e., those corresponding to 2xx or 3xx codes. | 0.0.1 |
operation-tags-defined | This rule checks each operations' tags in an OpenAPI schema and warns if any of them are empty lists. | 0.0.1 |
parameter-description-defined | This rule checks every parameter defined in an OpenAPI schema and warns when a its description is empty or missing. | 0.0.1 |
parameter-naming | This rule checks all parameters in an OpenAPI schema and warns if they do not adhere to the specified naming convention. | 0.0.1 |
parameters-unique | Check parameters of operations and path items and warn if they have duplicate parameters. | 0.0.1 |
patch-request-body-partial | This rule checks that PATCH request bodies do not require properties. | 0.9.0 |
path-parameters-defined | This rule ensures that for all parameter placeholders defined in path item URLs, there are path parameters defined in corresponding path items or their operations. | 0.0.1 |
path-parameters-on-items | This rule ensures that all path parameters are defined on path item levels, and not on the operation level. | 0.0.1 |
paths-max-count | This rule ensures that an API does not define too many path items. | 0.0.1 |
paths-max-depth | This rule ensures that path item URLs do not contain too many segments. | 0.0.1 |
paths-sorted | This rule checks URLs of path items defined in an OpenAPI schema, and warns if they are not placed in alphabetical order. | 0.0.1 |
paths-unique | This rule checks whether URLs of path items are unique. | 0.0.1 |
paths-well-formed | This rule checks whether URLs of path items are well-formed. | 0.0.1 |
privacy/no-credentials-in-url | This rule reports passwords, tokens, API keys and other credentials passed in path or query parameters, and API keys that a security scheme sends in the query string. | 0.11.0 |
privacy/no-personal-data-in-url | This rule reports personal data, such as e-mail addresses, names, dates of birth, phone numbers and national identification numbers, passed in path or query parameters. | 0.11.0 |
safe-markdown | This rule ensures that markdown strings (mostly descriptions) do not contain unsafe operations like script tags or eval() constructs. | 0.0.1 |
schema-conditional-effective | This rule checks that if, then and else in schemas have an effect. | 0.9.0 |
schema-constraints | This rule ensures that schema objects define constraints restricting the size of the underlying data. | 0.0.1 |
schema-datetime-suffix | This rule ensures that names of schema properties that represent date-times end with specified suffix. | 0.0.1 |
schema-discriminator-defined | This rule ensures that whenever a schema object defines a oneOf clause, it also defines a discriminator property. | 0.0.1 |
schema-enum-naming | This rule ensures that all string values defined in enum or const properties of schema objects adhere to a predefined naming convention. | 0.0.1 |
schema-enum-no-duplicates | This rule ensures that schema objects do not have duplicate values in their enum or const properties. | 0.0.1 |
schema-enum-types | This rule checks schema objects and warns if allowed schema values (from enum and const properties) are consistent with schema types (i.e. their type property). | 0.0.1 |
schema-example-defined | This rule ensures that all non-trivial schemas have at least one example defined. | 0.0.1 |
schema-format-defined | This rule ensures that every schema object that is a string or a number has its format defined. | 0.0.1 |
schema-format-deprecated | This rule reports the formats which the OpenAPI format registry marks as deprecated, and names what replaces them. | 0.10.0 |
schema-format-type-mismatch | This rule checks all schema objects and warns if any of them have their type and format properties contradicting each other. | 0.0.1 |
schema-format-unknown | This rule reports a format which is neither in the OpenAPI format registry nor declared in openapi.custom_formats of the configuration file. | 0.10.0 |
schema-keyword-support | This rule reports schema keywords that the tools consuming the document are unlikely to support, and suggests the rewrite where one exists. | 0.11.0 |
schema-no-additional-properties | This rule ensures that schema objects of type "object" explicitly forbid additional properties. | 0.0.1 |
schema-no-contradictions | This rule reports schemas with contradicting constraints, which reject every value or some of the properties they describe. | 0.9.0 |
schema-no-optional-nullable-properties | This rule disallows schema properties that are both optional and nullable. | 0.0.1 |
schema-oneof-no-overlap | This rule reports oneOf branches that a single value can match. | 0.9.0 |
schema-property-naming | This rule checks all schema objects and warns if any of them define properties whose names do not adhere to the specified naming convention. | 0.0.1 |
schema-required-properties-defined | This rule checks that every name listed in required is defined in properties. | 0.9.0 |
server-urls | This rule warns if a server defined by an OpenAPI schema uses HTTP protocol while not being from localhost, or uses upper-case letters. | 0.0.1 |
servers-defined | This rule warns if an OpenAPI schema does not define any server. | 0.0.1 |
spell-check | This rule checks the spelling of the texts written for humans: titles, summaries and descriptions. | 0.0.1 |
standard-media-types | This rule checks whether requests and responses use only standard media types. | 0.0.1 |
standard-response-codes | This rule checks whether operations define responses for standard HTTP codes only, as described in RFC 9110. | 0.0.1 |
standard-response-errors | This rule ensures that bodies for "error" responses are adhere to the same convention. | 0.0.1 |
tag-description-defined | This rule checks whether each tag defined in an OpenAPI schema has a meaningful description. | 0.0.1 |
tags-sorted | This rule checks whether tags defined in an OpenAPI schema are sorted alphabetically according to their names. | 0.0.1 |
tags-unique | This rule checks for schemas that define multiple tags with the same name, considering tag names as case-insensitive. | 0.0.1 |
unambiguous-response-codes | This rule checks for operations that define responses for both a generic code (like 2XX) and a specific code in the same range (like 204). | 0.0.1 |
unused-request-body | This rule checks for operations that normally cannot have a request body (i.e., GET, TRACE, or HEAD), but still define one. | 0.0.1 |
unused-shared-component | This rule checks whether all components defined in an OpenAPI schema are used. | 0.0.1 |