{
  "$schema": "https://rulesets.apicommons.org/rulesets.schema.json",
  "name": "API Governance Ruleset Registry",
  "description": "A curated, machine-readable registry of adoptable, provenanced API-governance rulesets — national, industry, security, company, and community rulesets you can adopt by reference instead of running the linter's defaults. Maintained by API Commons. PRs welcome.",
  "version": "1.0.0",
  "url": "https://rulesets.apicommons.org/rulesets.json",
  "source": "https://github.com/api-commons/ruleset-commons",
  "categories": {
    "national": "Owned and maintained by a national or sub-national government as public policy.",
    "industry": "Encodes a cross-vendor industry standard or specification (e.g. JSON:API, a sector API standard).",
    "security": "Focused on API security posture — OWASP API Security Top 10 and related hardening rules.",
    "company": "A single company's public API standards, published as an adoptable ruleset.",
    "community": "Maintained by an individual or open community as a shared, reusable ruleset.",
    "vendor-default": "The linter or tool's own built-in default. Config, not a standard — carries no naming, ownership, or domain rules."
  },
  "rulesets": [
    {
      "id": "italia-api-oas-checker",
      "name": "Italian API OAS Checker",
      "publisher": "Team Digitale / AgID (Government of Italy)",
      "category": "national",
      "description": "The Italian government's official Spectral ruleset enforcing the Modello di Interoperabilità (ModI) and the national API design guidelines against OpenAPI definitions. The reference example of a governed national ruleset adopted by reference.",
      "provenance": {
        "owner": "Dipartimento per la trasformazione digitale, Presidency of the Council of Ministers (Italy)",
        "url": "https://github.com/italia/api-oas-checker"
      },
      "sourceUrl": "https://github.com/italia/api-oas-checker",
      "adoptVia": {
        "method": "extends",
        "value": "https://italia.github.io/api-oas-checker/spectral.yml",
        "note": "Reference the hosted ruleset directly from your .spectral.yml `extends`. A pinned release is also published at https://github.com/italia/api-oas-checker-rules/releases."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "The exemplar for this registry: pulled remotely in the wild by teamdigitale/* and italia/* pipelines (e.g. teamdigitale/dati-semantic-backend, italia/spid-cie-oidc-schemas) rather than copied. A real owned, versioned, government-maintained standard."
    },
    {
      "id": "nl-adr-ruleset",
      "name": "NL API Design Rules (ADR)",
      "publisher": "Dutch Government — developer.overheid.nl / NL API Strategie",
      "category": "national",
      "description": "The machine-readable Spectral encoding of the Netherlands' API Design Rules (ADR), the national standard for government REST APIs, hosted for direct remote adoption.",
      "provenance": {
        "owner": "Logius / NL API Strategie working group (Kennisplatform APIs), Dutch central government",
        "url": "https://developer.overheid.nl/kennisbank/apis/"
      },
      "sourceUrl": "https://static.developer.overheid.nl/adr/ruleset.yaml",
      "adoptVia": {
        "method": "extends",
        "value": "https://static.developer.overheid.nl/adr/2.1/ruleset.yaml",
        "note": "Version-pin against a specific ADR release (e.g. /adr/2.1/); the unversioned /adr/ruleset.yaml tracks latest."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "A national government standard published specifically to be consumed remotely. Seen extended by Dutch public-sector pipelines (BRP-API, lvbag, VNG-Realisatie) in the research corpus."
    },
    {
      "id": "vng-haal-centraal-common",
      "name": "Haal Centraal Common (VNG)",
      "publisher": "VNG Realisatie (Association of Netherlands Municipalities)",
      "category": "national",
      "description": "Shared Spectral rules governing the Dutch municipal Haal Centraal API family, extended across the VNG-Realisatie and BRP-API repositories so every municipal-data API is linted against one common standard.",
      "provenance": {
        "owner": "VNG Realisatie, on behalf of Dutch municipalities",
        "url": "https://github.com/VNG-Realisatie/Haal-Centraal-common"
      },
      "sourceUrl": "https://github.com/VNG-Realisatie/Haal-Centraal-common",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/VNG-Realisatie/Haal-Centraal-common/master/.spectral.yml",
        "note": "Extended remotely by the individual Haal-Centraal API repos rather than duplicated in each."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "A sub-national / sector-of-government shared ruleset — a real-world hub-and-spoke example where many API repos consume one owned rule source."
    },
    {
      "id": "stoplight-owasp-ruleset",
      "name": "Spectral OWASP API Security",
      "publisher": "Stoplight (SmartBear) + community maintainers",
      "category": "security",
      "description": "A Spectral ruleset that encodes the OWASP API Security Top 10 as automated checks against OpenAPI definitions — auth, rate limiting, mass-assignment, error handling, and more.",
      "provenance": {
        "owner": "Stoplight / open-source maintainers (Andrew Farries, Roberto Polli et al.)",
        "url": "https://github.com/stoplightio/spectral-owasp-ruleset"
      },
      "sourceUrl": "https://github.com/stoplightio/spectral-owasp-ruleset",
      "adoptVia": {
        "method": "npm",
        "value": "@stoplight/spectral-owasp-ruleset",
        "note": "Install and `extends` it, or reference the built ruleset at https://raw.githubusercontent.com/stoplightio/spectral-owasp-ruleset/main/dist/ruleset.yaml"
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "The de-facto community security ruleset; a governed, versioned standard rather than a linter default."
    },
    {
      "id": "api-common-spectral-owasp",
      "name": "API Commons OWASP Ruleset",
      "publisher": "API Commons (API Evangelist)",
      "category": "security",
      "description": "The API Commons sibling security ruleset — a curated, governed OWASP API Security Top 10 Spectral ruleset published in the @api-common family alongside this registry.",
      "provenance": {
        "owner": "API Evangelist / API Commons (Kin Lane)",
        "url": "https://github.com/api-commons/spectral-owasp-ruleset"
      },
      "sourceUrl": "https://github.com/api-commons/spectral-owasp-ruleset",
      "adoptVia": {
        "method": "npm",
        "value": "@api-common/spectral-owasp-ruleset",
        "note": "Part of the API Commons tool family; being developed alongside ruleset-commons."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "In development. Listed here so the supply side of the API Commons stack is self-referential and discoverable."
    },
    {
      "id": "spectral-oas-default",
      "name": "Spectral built-in OAS ruleset (spectral:oas)",
      "publisher": "Stoplight (SmartBear)",
      "category": "vendor-default",
      "description": "Spectral's own bundled ruleset for OpenAPI 2/3 (and spectral:asyncapi for AsyncAPI). Structural and validity checks only.",
      "provenance": {
        "owner": "Stoplight — this is the linter's default config, not an organizational standard",
        "url": "https://github.com/stoplightio/spectral-rulesets"
      },
      "sourceUrl": "https://github.com/stoplightio/spectral-rulesets",
      "adoptVia": {
        "method": "copy",
        "value": "extends: [[spectral:oas, all]]",
        "note": "Built into Spectral; no install needed. `spectral:asyncapi` is the AsyncAPI equivalent."
      },
      "artifactTypes": ["openapi", "asyncapi"],
      "governed": false,
      "notes": "Config, not a standard. The research found 63% of 1,005 pipelines run exactly this kind of implicit default — it carries no naming, ownership, or domain rules. Listed here, honestly labeled, so teams see what they are actually running."
    },
    {
      "id": "redocly-recommended",
      "name": "Redocly recommended ruleset",
      "publisher": "Redocly",
      "category": "vendor-default",
      "description": "Redocly CLI's built-in `recommended` (and `minimal`) rule configuration for OpenAPI, applied via redocly.yaml.",
      "provenance": {
        "owner": "Redocly — a tool default, not an organizational standard",
        "url": "https://redocly.com/docs/cli/rules"
      },
      "sourceUrl": "https://github.com/Redocly/redocly-cli",
      "adoptVia": {
        "method": "copy",
        "value": "extends:\n  - recommended",
        "note": "Add to redocly.yaml. Redocly is a different linter from Spectral, but the same 'default vs owned standard' distinction applies."
      },
      "artifactTypes": ["openapi"],
      "governed": false,
      "notes": "Config, not a standard. Included to show the same default trap exists outside Spectral."
    },
    {
      "id": "vacuum-recommended",
      "name": "vacuum recommended ruleset",
      "publisher": "quobix (Dave Shanley)",
      "category": "vendor-default",
      "description": "vacuum's built-in recommended rules — a fast, Spectral-compatible OpenAPI linter's default configuration.",
      "provenance": {
        "owner": "quobix / vacuum project — a tool default, not an organizational standard",
        "url": "https://quobix.com/vacuum/rules/"
      },
      "sourceUrl": "https://github.com/daveshanley/vacuum",
      "adoptVia": {
        "method": "copy",
        "value": "# vacuum lint uses recommended rules by default\nvacuum lint openapi.yaml",
        "note": "vacuum consumes Spectral-format rulesets, so any governed ruleset in this registry can replace the default."
      },
      "artifactTypes": ["openapi"],
      "governed": false,
      "notes": "Config, not a standard. vacuum can consume the owned rulesets listed here — swap the default for one."
    },
    {
      "id": "baloise-spectral-ruleset",
      "name": "Baloise Spectral Ruleset",
      "publisher": "Baloise Group",
      "category": "company",
      "description": "Baloise's public Spectral ruleset implementing the Zalando RESTful API Guidelines as enforceable rules for the company's OpenAPI definitions.",
      "provenance": {
        "owner": "Baloise Group (baloise-incubator)",
        "url": "https://github.com/baloise-incubator/spectral-ruleset"
      },
      "sourceUrl": "https://github.com/baloise-incubator/spectral-ruleset",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/baloise-incubator/spectral-ruleset/main/zalando.yml",
        "note": "A company operationalizing an industry standard (Zalando) as a concrete, adoptable ruleset."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Good example of the standard-to-ruleset path: an industry guideline turned into a machine-readable, owned company ruleset."
    },
    {
      "id": "sailpoint-api-linter",
      "name": "SailPoint API Linter",
      "publisher": "SailPoint Technologies",
      "category": "company",
      "description": "SailPoint's open API linter — a root Spectral ruleset (plus product-specific rulesets) encoding SailPoint's REST API standards.",
      "provenance": {
        "owner": "SailPoint Technologies (sailpoint-oss)",
        "url": "https://github.com/sailpoint-oss/api-linter"
      },
      "sourceUrl": "https://github.com/sailpoint-oss/api-linter",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/sailpoint-oss/api-linter/main/root-ruleset.yaml",
        "note": "Additional path/schema rulesets live alongside the root ruleset in the same repo."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "A vendor publishing its own governed API standards as an adoptable ruleset."
    },
    {
      "id": "connectedcircuits-devops-api-linter",
      "name": "DevOps API Linter",
      "publisher": "Connected Circuits (community)",
      "category": "community",
      "description": "A shared, general-purpose Spectral ruleset for consistent REST API design (naming, versioning, responses) intended for DevOps CI pipelines.",
      "provenance": {
        "owner": "connectedcircuits (open-source maintainer)",
        "url": "https://github.com/connectedcircuits/devops-api-linter"
      },
      "sourceUrl": "https://github.com/connectedcircuits/devops-api-linter",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/connectedcircuits/devops-api-linter/main/rules.yaml",
        "note": "Reference the raw rules.yaml directly from your .spectral.yml `extends`."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "The single most-referenced remote ruleset in the 1,005-pipeline research corpus — 74 pipelines extend this one URL. Proof that a good shared ruleset gets adopted widely by reference."
    },
    {
      "id": "ignitia-spectral-validators",
      "name": "Ignitia Spectral Validators",
      "publisher": "Ignitia",
      "category": "company",
      "description": "Ignitia's shared Spectral ruleset, published so its API repositories lint against one common, remotely-referenced standard.",
      "provenance": {
        "owner": "Ignitia (ignitia-core)",
        "url": "https://github.com/ignitia-core/ignitia-tools-validators-spectral"
      },
      "sourceUrl": "https://github.com/ignitia-core/ignitia-tools-validators-spectral",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/ignitia-core/ignitia-tools-validators-spectral/master/spectral-ruleset.yaml",
        "note": "Consumed remotely by Ignitia's API pipelines."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Another real remote/shared ruleset observed in the corpus."
    },
    {
      "id": "spectral-jsonapi-ruleset",
      "name": "Spectral JSON:API Ruleset",
      "publisher": "jmlue42 (community)",
      "category": "industry",
      "description": "A Spectral ruleset validating OpenAPI definitions against the JSON:API specification — structure, member names, relationships, and content negotiation.",
      "provenance": {
        "owner": "jmlue42 (open-source maintainer)",
        "url": "https://github.com/jmlue42/spectral-jsonapi-ruleset"
      },
      "sourceUrl": "https://github.com/jmlue42/spectral-jsonapi-ruleset",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/jmlue42/spectral-jsonapi-ruleset/main/.spectral.yml",
        "note": "Encodes an industry media-type spec (JSON:API) as adoptable rules."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Represents the 'industry standard as ruleset' category — conformance to a cross-vendor spec rather than one org's house style."
    },
    {
      "id": "zalando-restful-api-guidelines",
      "name": "Zalando RESTful API Guidelines",
      "publisher": "Zalando SE",
      "category": "industry",
      "description": "Zalando's widely-cited RESTful API Guidelines — a de-facto industry reference for REST design that many organizations adopt or fork.",
      "provenance": {
        "owner": "Zalando SE",
        "url": "https://github.com/zalando/restful-api-guidelines"
      },
      "sourceUrl": "https://opensource.zalando.com/restful-api-guidelines/",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/baloise-incubator/spectral-ruleset/main/zalando.yml",
        "note": "The guidelines themselves are prose; the most complete machine-readable Spectral encoding is Baloise's zalando.yml. Zalando also maintains the Zally linter (github.com/zalando/zally)."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Illustrates the gap between a published standard (prose) and its adoptable machine-readable form (a ruleset). Cross-referenced with the Baloise entry."
    },
    {
      "id": "jaytech-spectral-ruleset",
      "name": "JayTech Spectral Ruleset",
      "publisher": "JayTech (community)",
      "category": "community",
      "description": "A hosted, remotely-adoptable Spectral ruleset for OpenAPI consistency, published at a stable URL for `extends`.",
      "provenance": {
        "owner": "JayTech (community maintainer)",
        "url": "https://jaytech.nl"
      },
      "sourceUrl": "https://spectral.jaytech.nl/spectral-ruleset.yaml",
      "adoptVia": {
        "method": "extends",
        "value": "https://spectral.jaytech.nl/spectral-ruleset.yaml",
        "note": "A community example of hosting a ruleset at a dedicated, stable domain for adoption by reference."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Observed extended remotely in the research corpus."
    },
    {
      "id": "stoplight-spectral-standard",
      "name": "Stoplight Spectral Standard",
      "publisher": "Stoplight (SmartBear)",
      "category": "community",
      "description": "Stoplight's opinionated 'standard' ruleset that layers naming and consistency conventions on top of the built-in spectral:oas structural checks.",
      "provenance": {
        "owner": "Stoplight (stoplightio)",
        "url": "https://github.com/stoplightio/spectral-standard"
      },
      "sourceUrl": "https://github.com/stoplightio/spectral-standard",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/stoplightio/spectral-standard/main/rulesets/.spectral.yaml",
        "note": "Goes beyond spectral:oas by adding style/consistency rules — closer to an owned standard than a bare default."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "The bridge between a vendor default and a governed standard: a named, versioned ruleset that adds design conventions."
    },
    {
      "id": "api-authorization-profile",
      "name": "API Authorization Profile",
      "publisher": "API Commons",
      "category": "security",
      "description": "A two-tier (normal/high) ruleset that lints an API's authorization posture against OAuth 2.1 (RFC 9700) and FAPI 2.0. Ships two rule files — one for OpenAPI, one for OAuth 2.0 Authorization Server metadata (RFC 8414) — covering client authentication (private_key_jwt/mTLS), DPoP sender-constraining, PAR, PKCE S256, response types, and signing algorithms. Generalized from Germany's federal API authorization security profiles.",
      "provenance": {
        "owner": "API Commons (Kin Lane)",
        "url": "https://apicommons.org/api-authorization"
      },
      "sourceUrl": "https://github.com/api-commons/spectral-api-authorization-ruleset",
      "adoptVia": {
        "method": "npm",
        "value": "@api-common/spectral-api-authorization-ruleset",
        "note": "Install and reference `api-authorization-openapi.yaml` against your OpenAPI and `api-authorization-oauth-metadata.yaml` against your /.well-known OAuth Authorization Server metadata."
      },
      "artifactTypes": ["openapi", "oauth-metadata"],
      "governed": true,
      "notes": "Two lint targets: the OpenAPI carries the scheme/flow/scope contract; the OAuth AS metadata (RFC 8414) carries the FAPI-specific truth (DPoP, PAR, client auth, PKCE). Static conformance is a floor, not a certificate — it checks the declared contract, not runtime enforcement."
    },
    {
      "id": "api-common-problem-details",
      "name": "API Commons Problem Details Ruleset",
      "publisher": "API Commons (API Evangelist)",
      "category": "industry",
      "description": "Lints an OpenAPI's error responses against RFC 9457, Problem Details for HTTP APIs. Sixteen rules covering the problem+json media type, the five members and their JSON types, extension members, type URIs, the WWW-Authenticate and Retry-After headers that belong with 401 and 429, and implementation leakage. Built on the specification's own rule that a member whose value type does not match MUST be ignored, so a status member typed as a string fails silently at every conforming consumer.",
      "provenance": {
        "owner": "API Evangelist / API Commons (Kin Lane)",
        "url": "https://github.com/api-commons/spectral-problem-details-ruleset"
      },
      "sourceUrl": "https://github.com/api-commons/spectral-problem-details-ruleset",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/api-commons/spectral-problem-details-ruleset/main/problem-details.yaml",
        "note": "Reference the hosted ruleset directly from your .spectral.yml `extends`, or install @api-common/spectral-problem-details-ruleset. Built-in Spectral functions only, so it also runs in the browser validator."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Grounded in RFC 9457 (July 2023), which obsoleted RFC 7807. Two residuals are documented rather than faked: it does not check that a problem's status member matches the response's HTTP status code, because comparing a response key against a value in that response's example is not expressible with built-in functions; and it does not flag urn:ietf:rfc:7807, which RFC 9457 Appendix B retained for the XML serialization. OpenAPI 3.x only, since Swagger 2.0 has no content map and the structural rules have no honest 2.0 twin."
    },
    {
      "id": "api-common-fhir",
      "name": "API Commons FHIR Ruleset",
      "publisher": "API Commons (API Evangelist)",
      "category": "industry",
      "description": "Lints an OpenAPI that describes an HL7 FHIR R4 or R5 RESTful API. Fifteen rules covering the application/fhir+json media type, OperationOutcome on errors, the /metadata CapabilityStatement a server SHALL expose, case-sensitive resource-type path segments checked against the 178-type R4 union R5 resource list, the ETag and If-Match optimistic-locking contract with its weak validator, searchset Bundles, and SMART App Launch scope syntax. Closes the gap between an API that returns Patient objects and an API that is actually FHIR.",
      "provenance": {
        "owner": "API Evangelist / API Commons (Kin Lane)",
        "url": "https://github.com/api-commons/spectral-fhir-ruleset"
      },
      "sourceUrl": "https://github.com/api-commons/spectral-fhir-ruleset",
      "adoptVia": {
        "method": "extends",
        "value": "https://raw.githubusercontent.com/api-commons/spectral-fhir-ruleset/main/fhir.yaml",
        "note": "Reference the hosted ruleset directly from your .spectral.yml `extends`, or install @api-common/spectral-fhir-ruleset. Built-in Spectral functions only, so it also runs in the browser validator."
      },
      "artifactTypes": ["openapi"],
      "governed": true,
      "notes": "Governs the HTTP surface, not resource instances — profile and implementation-guide conformance needs StructureDefinitions, terminology servers and the resource graph, none of which exist inside an OpenAPI; use the HL7 validator for that. The resource list is the R4 union R5 union deliberately, so an R4 API using an R5-only type will not be caught. Validated against the public HAPI FHIR R4 server's own generated OpenAPI across 2,973 paths with zero false positives on resource types."
    }
  ]
}