Linting Rules - OpenAPI V3 Security Scheme API Secret

Number of APIs: 1

This is a Spectral governance rule to enforce that API secret security is applied to the OpenAPI. Here is a JSON version of the rule that can be applied using this API-driven collection API, or at CLI or CI/CD pipeline.

{
  "openapi-v3-security-scheme-api-secret": {
    "description": "Requires the usage of API secret for security scheme.",
    "message": "Must add API secret for security scheme.",
    "given": "$.components.securitySchemes[Keys.ClientId]",
    "severity": "error",
    "then": [
      {
        "field": "type",
        "function": "pattern",
        "functionOptions": {
          "match": "^apiKey$"
        }
      },
      {
        "field": "in",
        "function": "pattern",
        "functionOptions": {
          "match": "^header$"
        }
      },
      {
        "field": "name",
        "function": "pattern",
        "functionOptions": {
          "match": "^X-api-secret$"
        }
      }
    ]
  }
}

This request can be run as part of this collection, or dragged and dropped to another collection of governance requests organized by folder, demonstrating how API governance linting works, but also providing a rule that can be used as part of your wider API governance strategy.

1. OpenAPI V3 Security Scheme API Secret POST {{baseUrl}}/linter?rulesUrl=https://rules.linting.org/rules/openapi-v3-security-scheme-api-secret/