API Genie for telecom

CAMARA's rules, without the Spectral setup

A CAMARA API repository lints in CI with Spectral, a Node toolchain and a ruleset fetched from another repository. With API Genie, two keys in apigenie.yaml run CAMARA's own rules.The camara ruleset and the bundle key come with API Genie 0.12.0, not released yet.

Set up a CAMARA repository Install API Genie

The programmes, and what runs for each

CAMARAThe Linux Foundation project that defines network APIs for operators. camara is the 41 rules and 14 functions of its .spectral-r4.yaml, for Commonalities r4, shipped with API Genie.
GSMA Open GatewayGSMA's programme through which operators expose CAMARA APIs to developers. Its APIs are defined in CAMARA, so camara checks the versions written for Commonalities r4.
TM Forum Open APIsTM Forum's telecom business APIs, published as Swagger 2.0 and OpenAPI documents. API Genie lints, diffs and mocks them, and generates code from them (Swagger 2.0 since 0.12.0), as for any other. It has no TM Forum ruleset.

A CAMARA repository, linted

CAMARA's Quality on Demand API references ../common/CAMARA_common.yaml, and bundle: true brings the common files in before the rules run. The API passes every camara-* rule; the 5 warnings come from the OWASP rules CAMARA's file turns on, and are reported in the common files, at their lines.

version: "1.0"
commands:
  lint:
    extends: [camara]
    bundle: true

$ apigenie lint code/API_definitions/quality-on-demand.yaml
/home/me/QualityOnDemand/code/common/CAMARA_common.yaml
  135:9  warning  Schema of type string should specify a format, pattern, enum, or const.  owasp:api4:2023-string-restricted
  139:9  warning  Schema of type string should specify a format, pattern, enum, or const.  owasp:api4:2023-string-restricted
  182:5  warning  Schema of type string should specify a format, pattern, enum, or const.  owasp:api4:2023-string-restricted
/home/me/QualityOnDemand/code/common/CAMARA_event_common.yaml
  52:9  warning  Schema of type string should specify a format, pattern, enum, or const.  owasp:api4:2023-string-restricted
  58:9  warning  Schema of type string should specify a format, pattern, enum, or const.  owasp:api4:2023-string-restricted

  5 issues (0 errors, 5 warnings)

Spectral's findings on Quality on Demand, line for line

On the 2 API files of camaraproject/QualityOnDemand 6e21c48 (5 November 2026), Spectral 6.17.0 with .spectral-r4.yaml from camaraproject/tooling e481489, and API Genie at bce7edb63 (before 0.12.0) with extends: [camara] and bundle: true, report the same 5 warnings at the same lines, and both exit with 0. API Genie prints a common file's warnings under each API that references it, so the 2 files show them twice, and its columns start at the key, where Spectral's start after it. recommended adds API Genie's own checks: 141 issues, 64 of them errors, on quality-on-demand.yaml.

What it covers

CAMARA's rule idscamara-properties-descriptions stays camara-properties-descriptions, so a team's notes and CAMARA's documentation still apply, and rules changes any of them.
OWASP rules, as CAMARA sets themcamara extends the owasp ruleset: 32 rules for 8 of the 10 OWASP API Security Top 10 risks. CAMARA's settings apply as upstream: 15 rules off, 4 made warnings, the 401 rule made an error.
The common filesbundle: true follows the references to CAMARA_common.yaml and the other common files on every run except under --fix.
In pull requestsThe GitHub Action runs apigenie lint with your apigenie.yaml, shows the issues as annotations on the pull request's files, and fails the step on an error.
Reports for CI--formatter sarif for code scanning, and JUnit, checkstyle and JSON for the rest.
Breaking changesapigenie diff --bundle rates what a new version of a CAMARA API, its common files included, does to its clients.

What it doesn't do

Spectral's part onlyAPI Genie replaces the Spectral step of CAMARA's validation. Its Python checks, yamllint and Gherkin lint aren't in API Genie.
Spectral's OAS rules don't runThe spectral:oas rules that CAMARA's file extends don't run, and nothing reports that they're skipped; only operation-success-response turns on API Genie's rule of that id. recommended has API Genie's counterparts of about two thirds of them, mapped in Migrate from Spectral.
Fixed severitiescamara uses the severities of CAMARA's file. CAMARA's Python validator sets them by the API's release status; API Genie doesn't, so an error here may not block a CAMARA release, and the other way round.
Pinned to one tooling commitcamara is CAMARA's file as of 4 November 2026, for Commonalities r4. For a newer file, or one for an earlier Commonalities release, copy it with its lint_function folder into the repository and name its path in extends.
The command line onlyThe ruleset's JavaScript functions run in the CLI and the GitHub Action. In the editor and the VS Code extension, extends: [camara] is an Unknown ruleset camara error, and the default rules apply.

Step by step

Lint CAMARA APIs: Check the APIs of a CAMARA repository with CAMARA's own rules, locally and in every pull request, without a copy of its ruleset or a Node toolchain.

Keep CAMARA's rules, drop the Spectral setup

The rules are CAMARA's, ids and all, and ship with API Genie, so the Node setup and the ruleset fetch go. CAMARA's Python checks, yamllint and Gherkin lint stay as they are.

Set up a CAMARA repository Install API Genie