Governance & Discovery
Free vs Pro
The line is drawn by capability, not by rate limit alone. Everything you need to check an API is free. Everything that produces an owned artifact, certifies, audits a repository, or rolls up across many APIs is Pro.
Free — keyless
- Validate — lint OpenAPI, AsyncAPI, Arazzo, JSON Schema, APIs.json, MCP, agent skills and more with OpenLint against the 776-rule curated catalog, your own ruleset, or a named profile (OWASP, Problem Details, FHIR, API Authorization).
- Coverage — how much of a description your governance actually inspects.
- Waivers — reconcile a waivers file against lint output.
- Report (HTML) — a self-contained HTML governance report.
- Verify — re-verify a governance certificate (consumer-facing trust check).
- Classify — inventory the PII / secret / sensitive fields an OpenAPI exposes.
- Diff — breaking-change detection between two OpenAPI versions.
- Scorecard — a composite API maturity score + letter grade.
- Onboarding — validate an API Onboarding Descriptor (AID) + completeness.
- Deprecation — deprecation / sunset posture across operations.
- Rules / Rulesets — browse the catalog, the Ruleset Commons registry, and the profiles.
- Rule authoring — validate a ruleset, see what a JSONPath matches, test rules against fixtures, explain why a rule did or didn't fire, and look up a rule's remediation.
- Detect format · Lint skill · Ruleset docs — identify a document, lint an agent SKILL.md, and generate Markdown docs for a ruleset.
Limits: 5 req/s, 1,000 requests/day, one document per call, 256 KB body.
Pro — $29/mo
Everything in Free, plus the artifact-generating and estate-wide capabilities:
- Certify — issue tamper-evident governance certificates.
- Agent export — AGENTS.md, system prompts, remediation packs, and digests from a ruleset.
- Pipeline audit — score a repository's Spectral CI maturity and get a punch-list.
- Toolsmith — forge MCP tools and Agent Skills per operation.
- Context gate — emit a governed Tyk + MCP + ruleset agent surface.
- Overlay — apply an OpenAPI Overlay (deprecation, governance, migration choreography).
- Mock — generate example request/response payloads per operation.
- Snippets — runnable curl / JavaScript / Python samples per operation.
- Agent descriptor — generate an API's
llms.txt+AGENTS.mdconsumption contract. - Reusability — reuse and duplication scores across a set of APIs.
- Experience — the API → MCP → Agent-Skill coverage model and flow map.
- Estate — run the core checks across a whole set of APIs and roll them up, worst first.
- Baseline — snapshot today's violations, then fail only on new ones.
- Federate — a central baseline and the domains that adopt it, as divergence and drift.
- Code-first — which generator made the spec, and which findings to fix in code.
- Fix — a reviewable OpenAPI Overlay that fixes the findings, proven by a re-lint.
- Style guide → ruleset — turn prose rules into an owned, validated ruleset.
- Org ruleset — store your ruleset once; every call that passes none uses it.
- SARIF output on the report endpoint (for GitHub code scanning).
- Bulk input — multi-API arrays in one call.
Limits: 10 req/s, 5,000 requests/day. Team ($149/mo) raises this to 25 req/s and 25,000/day with multiple keys.
The 402 contract
A free caller hitting a Pro endpoint (or asking for SARIF) gets a clean, machine-readable
402:
Code
Last modified on