Introduction
APIGit’s API Governance framework (powered by spectral) checks your OpenAPI and AsyncAPI documents against rulesets and reports the findings. It helps your APIs stay aligned with your organization’s standards and security requirements.
The editor and pull-request Governance views are advisory. To make an OpenAPI ruleset a required check, run
apigit lint --org <organization> --report-status in CI and require the apigit/lint
commit status through branch protection.
Browser governance supports OpenAPI and AsyncAPI. A GraphQL schema has a Governance view too, which validates its syntax and schema; rule sets and organization policies do not apply to it. CLI 0.6.0 also checks AsyncAPI and GraphQL SDL; hosted server lint is not enabled. See Supported API Formats.
Key Benefits
- Standardized Checks: Apply the same rules across all repositories of an organization
- Streamlined Collaboration: Authors and reviewers see the same findings
- Clear Scope: The Overview tab of an organization’s governance page shows which profiles apply to each repository
Governance Implementation
Governance is available at several points of your API lifecycle:
- Predefined Rulesets: Use ready-made rulesets without any configuration
- Custom Rulesets & Policies: Create tailored rules that reflect your specific organizational requirements
- Continuous Checks: See findings while designing a spec and while reviewing a pull request
Plans
| Feature | Plan |
|---|---|
| Predefined rulesets in the editor and repository viewer | Free, Team, Enterprise |
| Governance tab in pull requests | Organization repositories, so Team and Enterprise |
| Custom rule profiles, governance policies, templates | Enterprise |
AsyncAPI governance
AsyncAPI documents have a Governance tab beside Code, Diff and Preview, and a read-only governance view in the repository. They have no Form tab.
Select API Best Practice to run the rules for the document’s format. The browser’s default set includes Spectral’s OpenAPI rules and its AsyncAPI 2.x and 3.x rules. OWASP and the other OpenAPI-specific builtins do not become AsyncAPI rules.
CLI 0.6.0 includes AsyncAPI checks and GraphQL syntax/schema validation. Server-side lint and account MCP lint_spec are not enabled on the hosted service; they require a configured lint service. GraphQL validation is not provided by browser governance or server lint, and score remains OpenAPI-only.
See the CLI checks. Organization policies and plan restrictions still apply to the browser checks.