Create a ruleset.
curl --request POST \
--url https://{tenant}/api/rulesets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": true,
"resource_type": "oas-api",
"action": "warn",
"categories": [
"payments",
"internal"
],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
'import requests
url = "https://{tenant}/api/rulesets"
payload = {
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": True,
"resource_type": "oas-api",
"action": "warn",
"categories": ["payments", "internal"],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'OAS API Ruleset',
description: 'Validates OAS APIs for compliance',
active: true,
resource_type: 'oas-api',
action: 'warn',
categories: ['payments', 'internal'],
definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
})
};
fetch('https://{tenant}/api/rulesets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}/api/rulesets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'OAS API Ruleset',
'description' => 'Validates OAS APIs for compliance',
'active' => true,
'resource_type' => 'oas-api',
'action' => 'warn',
'categories' => [
'payments',
'internal'
],
'definition' => '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenant}/api/rulesets"
payload := strings.NewReader("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenant}/api/rulesets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}/api/rulesets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}"
response = http.request(request)
puts response.read_body{
"Message": "ruleset created",
"Meta": "6644b38535715ec496cbef3d",
"Status": "success"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}Rulesets
Create a ruleset.
Create a new ruleset. name is required. action defaults to none, resource_type defaults to oas-api. Accepts application/json or multipart/form-data (parts: metadata, ruleset).
POST
/
api
/
rulesets
Create a ruleset.
curl --request POST \
--url https://{tenant}/api/rulesets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": true,
"resource_type": "oas-api",
"action": "warn",
"categories": [
"payments",
"internal"
],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
'import requests
url = "https://{tenant}/api/rulesets"
payload = {
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": True,
"resource_type": "oas-api",
"action": "warn",
"categories": ["payments", "internal"],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'OAS API Ruleset',
description: 'Validates OAS APIs for compliance',
active: true,
resource_type: 'oas-api',
action: 'warn',
categories: ['payments', 'internal'],
definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
})
};
fetch('https://{tenant}/api/rulesets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}/api/rulesets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'OAS API Ruleset',
'description' => 'Validates OAS APIs for compliance',
'active' => true,
'resource_type' => 'oas-api',
'action' => 'warn',
'categories' => [
'payments',
'internal'
],
'definition' => '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenant}/api/rulesets"
payload := strings.NewReader("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{tenant}/api/rulesets")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}/api/rulesets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}"
response = http.request(request)
puts response.read_body{
"Message": "ruleset created",
"Meta": "6644b38535715ec496cbef3d",
"Status": "success"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}{
"ID": "<string>",
"Message": "<string>",
"Meta": "<unknown>",
"Status": "<string>"
}Authorizations
The Tyk Dashboard API Access Credentials
Body
application/json
Full Spectral ruleset definition stored as a JSON string.
Optional stable identifier. If not provided, defaults to the record's internal ID hex. Must be unique within the org. Never changed after creation.
Available options:
oas-api, mcp-api Available options:
none, warn Optional list of category names to associate with this ruleset. Each value must match an existing org API category (as returned by GET /apis/categories); matching is case-insensitive. Unknown values are rejected with 400. Entries are sanitized before validation and storage: surrounding whitespace is trimmed, empty entries are dropped, and case-insensitive duplicates are removed (first occurrence wins).
Example:
["payments", "internal"]
Was this page helpful?
⌘I