Asana OpenAPI spec score
Octri scored the public spec at https://raw.githubusercontent.com/Asana/openapi/master/defs/asana_oas.yaml for what a code generator can do with it. This is a reading of the document, not a grade of the API.
271 operations · 303 models · 52 tags · OpenAPI 3.0.0
Scored 29 October 2026 · fingerprint e4867e9cd131… · spec version 1.0 · server app.asana.com
Document last changed 29 October 2026.
Where the points went
Every rule, heaviest first, with what it cost this document, how much of the surface it touched, and where. The rule id links to what that rule checks.
| Rule | Weight | Result | Surface | Locations |
|---|---|---|---|---|
| Successful responses declare a schemaresponse-schema | 2.0 | Clean | 271 operations clean | Nothing found |
| Shared models live in components and are $ref'dshared-schemas-referenced | 2.0 | 0.4 lost | 2 of 271 operations | memory://audit/openapi.yaml#/paths/~1events/getmemory://audit/openapi.yaml#/paths/~1workspaces~1{workspace_gid}~1events/get |
| Generated public names do not collideoperation-id-unique | 2.0 | 0.5 lost | 24 of 271 operations | GET /team_memberships/{team_membership_gid}GET /projects/{project_gid}GET /time_tracking_categories/{time_tracking_category_gid}and 21 more |
| Every path placeholder has a parameterpath-parameters-declared | 1.5 | Clean | 271 operations clean | Nothing found |
| Every operation declares an operationIdoperation-id-present | 1.0 | Clean | 271 operations clean | Nothing found |
| operationIds read as method namesoperation-id-naming | 1.0 | 0.2 lost | 1 of 271 operations | GET /user_task_lists/{user_task_list_gid}/tasks |
| Operations carry a summary or descriptionoperation-documented | 1.0 | Clean | 271 operations clean | Nothing found |
| Request bodies are documentedrequest-body-documented | 1.0 | 0.2 lost | 3 of 271 operations | POST /users/{user_gid}/notifications/markUnreadPOST /access_requestsPOST /users/{user_gid}/notifications/markRead |
| Failure responses are declarederror-responses | 1.0 | 0.2 lost | 1 of 271 operations | GET /workspaces/{workspace_gid}/workspace_memberships |
| Operations are taggedoperation-tagged | 1.0 | Clean | 271 operations clean | Nothing found |
| No duplicate or equivalent pathsduplicate-paths | 1.0 | Clean | 192 paths clean | Nothing found |
| Authentication is describedsecurity-declared | 1.0 | Clean | Declared | Nothing found |
| Parameters explain their purposeparameters-documented | 0.75 | 0.16 lost | 4 of 271 operations | GET /workspace_memberships/{workspace_membership_gid}#path:workspace_membership_gidGET /team_memberships/{team_membership_gid}#path:team_membership_gidGET /portfolio_memberships/{portfolio_membership_gid}#path:portfolio_membership_gidand 1 more |
| A server URL is declaredserver-url | 0.5 | Clean | Declared | Nothing found |
What 8.3 means for an SDK
A strong reading, and the three rules that decide most of it.
A generator has what it needs here: typed methods, named models and doc comments that say something. What is left is polish, and it can wait until after the first release.
Three rules carry six of the 10 points between them. On this document they took 0.95.
Clean
Successful responses declare a schema
271 operations clean
−0.4
Shared models live in components and are $ref'd
2 of 271 operations
−0.5
Generated public names do not collide
24 of 271 operations
What to change first
Every rule that deducted, in the order they cost.
0.4 lost
Shared models live in components and are $ref'd
Move the shape into components.schemas once and $ref it from each operation that returns or accepts it.
0.5 lost
Generated public names do not collide
Rename the authored operationId, or set that operation's SDK namespace. The audit proposes one and can apply it; your tags and the wire operation are left alone.
Inside Octri this one has a one-click fix.
0.2 lost
operationIds read as method names
Name the id for the action, not the route. The audit suggests one per operation and can apply it.
Inside Octri this one has a one-click fix.
0.2 lost
Request bodies are documented
Describe the body, or the fields inside it. Field-level prose is the one that reaches the SDK's arguments.
Inside Octri this one has a one-click fix.
0.2 lost
Failure responses are declared
Declare the failures you actually return, or one `default` response carrying your error shape.
0.16 lost
Parameters explain their purpose
Describe what the parameter does and what a valid value looks like. One line each.
Inside Octri this one has a one-click fix.
Where to go next
- Score your own spec The same fourteen rules, on any public URL. No account, and the spec is not kept.
- OpenAPI to a TypeScript SDK Published to npm, with the type definitions generated from your spec.
- OpenAPI to an MCP server The same endpoints, as tools an agent can call.
- How SDK Studio shapes a client Naming, hooks and packaging, decided before ten runtimes are built.
The spec at raw.githubusercontent.com is public. Octri keeps the `info` block, the score, and up to five sample finding locations per rule. The document itself is not stored and is not served from here. The audit predicts what an SDK generator can do with the description; it is not a security review, an uptime measurement or a critique of the API’s design. This page is not affiliated with Asana or Asana Support.