curl --request PUT \
--url https://{tenant}/api/rulesets/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": true,
"resource_type": "oas-api",
"action": "warn",
"categories": [
"payments",
"internal"
],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
'import requests
url = "https://{tenant}/api/rulesets/{id}"
payload = {
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": True,
"resource_type": "oas-api",
"action": "warn",
"categories": ["payments", "internal"],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'OAS API Ruleset',
description: 'Validates OAS APIs for compliance',
active: true,
resource_type: 'oas-api',
action: 'warn',
categories: ['payments', 'internal'],
definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
})
};
fetch('https://{tenant}/api/rulesets/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}/api/rulesets/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'OAS API Ruleset',
'description' => 'Validates OAS APIs for compliance',
'active' => true,
'resource_type' => 'oas-api',
'action' => 'warn',
'categories' => [
'payments',
'internal'
],
'definition' => '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenant}/api/rulesets/{id}"
payload := strings.NewReader("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{tenant}/api/rulesets/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}/api/rulesets/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}"
response = http.request(request)
puts response.read_body{
"_id": "<string>",
"ruleset_id": "<string>",
"org_id": "<string>",
"name": "<string>",
"description": "<string>",
"active": true,
"resource_type": "<string>",
"action": "<string>",
"categories": [
"<string>"
],
"owner": "<string>",
"definition": "<string>",
"is_template": true,
"date_created": "2023-11-07T05:31:56Z",
"last_updated": "2023-11-07T05:31:56Z"
}Update a ruleset.
Update an existing ruleset. RulesetID is never changed by an update. action and resource_type fall back to their existing values when omitted. Accepts application/json or multipart/form-data (individual fields: name, description, active, action, resource_type, ruleset_id, categories; optional file field: ruleset for the Spectral definition).
curl --request PUT \
--url https://{tenant}/api/rulesets/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": true,
"resource_type": "oas-api",
"action": "warn",
"categories": [
"payments",
"internal"
],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
'import requests
url = "https://{tenant}/api/rulesets/{id}"
payload = {
"name": "OAS API Ruleset",
"description": "Validates OAS APIs for compliance",
"active": True,
"resource_type": "oas-api",
"action": "warn",
"categories": ["payments", "internal"],
"definition": "{\"rules\":{\"operation-tag-defined\":{\"severity\":\"warn\",\"given\":\"$.paths.*.*\",\"then\":{\"function\":\"enumeration\",\"functionOptions\":{\"values\":[\"payments\",\"internal\"]}}}}}"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
name: 'OAS API Ruleset',
description: 'Validates OAS APIs for compliance',
active: true,
resource_type: 'oas-api',
action: 'warn',
categories: ['payments', 'internal'],
definition: '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
})
};
fetch('https://{tenant}/api/rulesets/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{tenant}/api/rulesets/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'OAS API Ruleset',
'description' => 'Validates OAS APIs for compliance',
'active' => true,
'resource_type' => 'oas-api',
'action' => 'warn',
'categories' => [
'payments',
'internal'
],
'definition' => '{"rules":{"operation-tag-defined":{"severity":"warn","given":"$.paths.*.*","then":{"function":"enumeration","functionOptions":{"values":["payments","internal"]}}}}}'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{tenant}/api/rulesets/{id}"
payload := strings.NewReader("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{tenant}/api/rulesets/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{tenant}/api/rulesets/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"OAS API Ruleset\",\n \"description\": \"Validates OAS APIs for compliance\",\n \"active\": true,\n \"resource_type\": \"oas-api\",\n \"action\": \"warn\",\n \"categories\": [\n \"payments\",\n \"internal\"\n ],\n \"definition\": \"{\\\"rules\\\":{\\\"operation-tag-defined\\\":{\\\"severity\\\":\\\"warn\\\",\\\"given\\\":\\\"$.paths.*.*\\\",\\\"then\\\":{\\\"function\\\":\\\"enumeration\\\",\\\"functionOptions\\\":{\\\"values\\\":[\\\"payments\\\",\\\"internal\\\"]}}}}}\"\n}"
response = http.request(request)
puts response.read_body{
"_id": "<string>",
"ruleset_id": "<string>",
"org_id": "<string>",
"name": "<string>",
"description": "<string>",
"active": true,
"resource_type": "<string>",
"action": "<string>",
"categories": [
"<string>"
],
"owner": "<string>",
"definition": "<string>",
"is_template": true,
"date_created": "2023-11-07T05:31:56Z",
"last_updated": "2023-11-07T05:31:56Z"
}Authorizations
The Tyk Dashboard API Access Credentials
Path Parameters
ObjectId hex or custom ruleset_id.
Body
Full Spectral ruleset definition stored as a JSON string.
Optional stable identifier. If not provided, defaults to the record's internal ID hex. Must be unique within the org. Never changed after creation.
oas-api, mcp-api none, warn Optional list of category names to associate with this ruleset. Each value must match an existing org API category (as returned by GET /apis/categories); matching is case-insensitive. Unknown values are rejected with 400. Entries are sanitized before validation and storage: surrounding whitespace is trimmed, empty entries are dropped, and case-insensitive duplicates are removed (first occurrence wins).
["payments", "internal"]
Response
Ruleset updated.
Stable migration identifier. Same value across environments.
ID of the user who created the ruleset. Set server-side from the session; cannot be supplied by the caller.
Full Spectral ruleset definition stored as a JSON string.
Was this page helpful?