Governance

Lint an API artifact — OpenAPI, AsyncAPI, Arazzo, JSON Schema, APIs.json, MCP, an agent SKILL.md and more (format auto-detected) — with the OpenLint engine against the curated rule catalog. Pass your own ruleset, or a named profile (OWASP, Problem Details, FHIR, API Authorization). Paid callers with an org ruleset get it by default; ruleset in the response says which ran.

How much of an API description the ruleset actually inspects — coverage by section, dead rules, and each rule reach.

Suppress sanctioned violations and surface expired, stale, and expiring waivers — the effective failing set your build should gate on.

Turn Spectral findings into a self-contained HTML governance report. Pass ?format=sarif for SARIF 2.1.0 output (Pro).

Re-verify a tamper-evident API governance certificate against the API it attests to. Consumer-facing trust check.

Inventory the PII, secret, and sensitive fields an OpenAPI exposes — across parameters and request/response schemas. Uses the same classifiers as Context Gate.

Compare two OpenAPI versions and classify every change as breaking, non-breaking, or an addition — at path, operation, parameter, request-body, and response granularity.

Roll up a 0-100 maturity score with a letter grade across dimensions — design/style (lint), governance coverage, documentation completeness, and (from an apis.json) discoverability, agent-readiness, and operations.

Report every deprecated operation and whether it announces a sunset (x-sunset date or a Sunset/Deprecation response header), plus deprecated schema fields — the honest migration picture.

Generate an example request and success-response payload for every operation from its OpenAPI schema (author example/default/enum first, else synthesized by type/format).

Generate runnable curl / JavaScript (fetch) / Python (requests) samples for every operation, with path params filled in and a realistic request body.

Browse the curated best-of-breed rule catalog the validator runs — every rule with its id, format, title, severity, tags, given, and reference. Optionally filter by artifact format.

The registry of adoptable, provenanced governance rulesets — national, industry, security, and company rulesets you can extend by reference instead of running the linter defaults. Also lists profiles: the curated rulesets validate runs by name.

Issue a tamper-evident certificate attesting an API description passed a named ruleset at a profile threshold. A SHA-256 fingerprint lets anyone re-verify it.

Turn a Spectral ruleset into an AGENTS.md governance block, a system-prompt instruction set, a per-rule remediation prompt pack, and a compact rule digest.

Score a repository Spectral governance pipeline against an 8-point maturity rubric and get a prioritized punch-list. Supply files inline, or a public repo (owner/name) to fetch.

From an OpenAPI, forge an MCP server design, per-operation tools, Agent Skills, an enriched OpenAPI (x-mcp / x-agent-skills), a server.json, and apis.json properties.

Choose which operations and fields your API exposes to agents; emit a governed Tyk OpenAPI, an MCP tool manifest, and a Spectral ruleset with PII/secret checks. Defaults to the whole surface when no selection is supplied.

Apply an OpenAPI Overlay (spec 1.0.0) to a document — each action resolves a target JSONPath and deep-merges update or removes the match. Returns the transformed OpenAPI plus a per-action report.

Check that a ruleset is valid before it is run or stored: invalid JSONPath in given (parsed with nimma, the engine's own parser), unknown functions the engine would otherwise skip silently, undefined #aliases, a missing then, and anything the OpenLint engine rejects. Catalog metadata OpenLint refuses on a rule (title, prompt, x-* …) is set aside and listed in stripped; the engine-ready ruleset is returned when anything was stripped.

Evaluate a JSONPath — a rule's given — against a document and return what it matches: pointer, path and a value preview per match. Pass field to see whether that field is present on each match, the way then.field reads it. paths evaluates several at once.

Run a ruleset against fixture documents with expectations. Each case is { name, document, expect }: expect is a list of rule codes that must fire, a { code: count } map for exact counts, or [] for "must lint clean"; optional forbid lists codes that must not fire. Reports pass/fail per case and rule-logic coverage: rules no case asserts on, and rules no fixture triggers. Up to 50 cases.

Explain why a rule did or did not fire on a document, step by step: whether the document matches the rule's formats, what each given matched (aliases resolved, including the built-ins' #OperationObject and friends), what then checks, and a one-line verdict. The rule is looked up in the ruleset you pass, then the curated catalog, then OpenLint's built-in rulesets.

One rule by id — description, severity, given/then, tags, reference — and its remediation prompt: what to change when it fires. An unknown id returns 404 with the closest rule ids in detail.suggestions. Also available as POST { rule } for clients that only POST.

The same as GET, with { rule } in the body.

Identify a document — OpenAPI (and Swagger 2.0 vs 3.x), AsyncAPI, Arazzo, JSON Schema, APIs.json, MCP, JSON-LD, plans, rate limits, an agent SKILL.md, an Overlay, or a ruleset — with its version, how many catalog rules apply, the built-in ruleset, and the named profiles that apply.

Lint an agent SKILL.md — Markdown with YAML frontmatter — against the API Commons skill rules (name, description, structure, metadata). validate does the same when it detects a skill.

Generate human-readable Markdown documentation for a ruleset: each rule's severity, formats, description, message, what it applies to, the check, how to fix it, and its reference — grouped by topic. Pass ruleset, or profile for one of the curated profiles.

Adopt a ruleset on a legacy API without a wall of red. With no baseline, snapshot today's violations into a baseline file (JSON and YAML). With a baseline, reconcile a new lint against it: only NEW violations fail; fixed ones are counted so the baseline can shrink; budget adds a warning ceiling and per-rule no-increase. Lints document with your ruleset, your org ruleset, or the catalog — or pass violations from your own linter.

A central baseline ruleset plus the domains that adopt it — each rule inherited, overridden (with a reason), waived, deferred, or grown locally — computed into divergence per rule, drift per domain, contested rules, and local rules worth promoting to the center.

For a code-first API: identify the generator that produced the spec (with confidence and evidence), and split findings into the ones to fix with annotations in code — grouped by concern, with the fix for that generator — and the ones to fix in spec authoring. Lints with OpenLint's built-in OAS rules unless you pass a ruleset or violations.

Propose an OpenAPI Overlay that fixes the lint errors — or the rules you name, plus warnings with include_warnings — using each rule's remediation guidance; then apply it, re-lint, and diff. Returns the overlay to review, the fixed document, what was resolved, what now fires more often (introduced), and any breaking change. OpenAPI only; up to 150 KB. Model-backed.

Turn a prose API style guide into an owned, grounded ruleset: one rule per checkable statement, following the API Commons rule-id convention, each validated (drafts that fail are listed in rejected), with the statements no rule can check listed in unchecked. Test the result with /governance/test-ruleset before gating on it. Up to 40 KB. Model-backed.

Your org default ruleset. Once set, validate, coverage, scorecard, estate, baseline, codefirst and fix use it for any call that passes no ruleset (pass use_org_ruleset: false to opt out for one call). The ruleset is validated before it is stored. POST { action: "get" | "set" | "delete" } does the same for POST-only clients.

Your org default ruleset. Once set, validate, coverage, scorecard, estate, baseline, codefirst and fix use it for any call that passes no ruleset (pass use_org_ruleset: false to opt out for one call). The ruleset is validated before it is stored. POST { action: "get" | "set" | "delete" } does the same for POST-only clients.

Your org default ruleset. Once set, validate, coverage, scorecard, estate, baseline, codefirst and fix use it for any call that passes no ruleset (pass use_org_ruleset: false to opt out for one call). The ruleset is validated before it is stored. POST { action: "get" | "set" | "delete" } does the same for POST-only clients.

Your org default ruleset. Once set, validate, coverage, scorecard, estate, baseline, codefirst and fix use it for any call that passes no ruleset (pass use_org_ruleset: false to opt out for one call). The ruleset is validated before it is stored. POST { action: "get" | "set" | "delete" } does the same for POST-only clients.

Run the core governance checks — lint, coverage, scorecard, PII and secret classification — across a whole set of APIs and roll them up: per-API score, grade, errors and sensitive fields, estate aggregates (average score, grade distribution, APIs with PII or secrets, strongest and weakest), and a worst-first list of what needs attention. Pass your own ruleset (or set an org ruleset): a score against rules you never adopted means little. detail: true adds per-API dimensions.