operation-summary
Require every OpenAPI operation to have a non-empty summary.
01-no-link-location
Prevent Location and Link headers on 201 responses.
04-no-content-type
Prevent Content-Type headers on bodyless 204 responses.
xx-no-link-location
Require Location headers on redirect responses other than 304.
accept-response-content-type-conflict
Align finite Accept header values with response media types.
content-language-response
Require Content-Language when successful body responses declare headers.
content-type-response
Require Content-Type on successful responses with bodies.
content-type-header-declared
Prevent explicit Content-Type header declarations in OpenAPI operations.
content-type-header-overrides-media-type
Detect disagreement between Content-Type headers and content-map media types.
define-429-response
Require every path operation to document a schema-backed 429 response.
define-500-response
Require every path operation to document a schema-backed 500 response.
define-validation-error-response
Require an operation to document a validation-error response.
error-response-media-type
Require problem+json among documented error response media types.
get-request-body-disallowed
Prevent request bodies on GET operations.
header-required-for-content-type-response
Require Content-Type on every response with a body except 204.
health-endpoint
Require summary and detailed health-check endpoints.
health-endpoint-media-type
Use application/health+json for health endpoint success responses.
invalid-operation-status
Restrict response keys to numeric status codes or default.
not-error-json-response
Prevent problem-detail media types on successful responses.
operation-4xx-problem-details-rfc7807
Give 4xx responses an inline RFC 7807-style problem schema.
path-no-duplicate-slash
Prevent consecutive slashes in API paths.
path-percent-encoded
Keep reserved characters percent-encoded in path parameters.
query-percent-encoded
Keep reserved characters percent-encoded in query parameters.
rate-limit-headers
Require a recognized rate-limit header set on 2xx and 4xx responses.
request-body-defined
Require requestBody on POST, PUT, and PATCH operations.
request-body-required
Prevent explicitly optional request bodies on POST, PUT, and PATCH.
request-mime-type
Restrict request media types to a configured allowlist.
response-mime-type
Restrict response media types to a configured allowlist.
response-body-not-allowed
Prevent content on HTTP responses that cannot carry a body.
response-code-in-range
Restrict operation responses to the approved HTTP status-code list.
response-contains-header
Require configured headers on selected response codes.
response-contains-property
Require configured top-level properties on selected response schemas.
retry-after-for-429
Require Retry-After on documented 429 responses.
spec-no-invalid-encoding-combinations
Prevent legacy and sequential encoding fields from being combined.
uri-names
Prevent literal URI path segments from starting with digits.
no-ambiguous-paths
Prevent path templates from matching the same URL shape.
no-http-verbs-in-paths
Keep HTTP method names out of resource paths.
no-identical-paths
Prevent paths that differ only by parameter names.
no-path-trailing-slash
Prevent trailing slashes on non-root API paths.
operation-2xx-response
Require at least one successful response on each operation.
operation-4xx-response
Require at least one client-error response on each operation.
operation-description
Require a nonblank description on every operation.
operation-operationId
Require a nonblank operationId on regular operations.
operation-operationId-unique
Require operationId values to be unique across the document.
operation-operationId-url-safe
Restrict operationId values to URL-safe characters.
operation-singular-tag
Limit each operation to one tag.
operation-tag-defined
Require operation tags and declare them at document level.
path-declaration-must-exist
Require at least one path and nonempty path-parameter declarations.
path-http-verbs-order
Keep operations under each path in a consistent method order.
path-not-include-query
Keep query strings out of OpenAPI path keys.
path-parameters-defined
Keep path templates and path-parameter declarations synchronized.
path-segment-plural
Use plural names for literal resource path segments.
paths-kebab-case
Restrict literal path segments to lowercase kebab-safe characters.