GitHub v3 REST API OpenAPI spec score
Octri scored the public spec at https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.json for what a code generator can do with it. This is a reading of the document, not a grade of the API.
1242 operations · 996 models · 45 tags · OpenAPI 3.0.3
Scored 18 October 2026 · fingerprint 3177ad6a86ca… · spec version 1.1.4 · server api.github.com
Document last changed 18 October 2026.
Where the points went
Every rule, heaviest first, with what it cost this document, how much of the surface it touched, and where. The rule id links to what that rule checks.
| Rule | Weight | Result | Surface | Locations |
|---|---|---|---|---|
| Successful responses declare a schemaresponse-schema | 2.0 | 0.4 lost | 22 of 1242 operations | GET /assignments/{assignment_id}GET /assignments/{assignment_id}/accepted_assignmentsGET /assignments/{assignment_id}/gradesand 19 more |
| Shared models live in components and are $ref'dshared-schemas-referenced | 2.0 | 0.4 lost | 26 of 1242 operations | documentation_url, errors, messageallowed_custom_agents, created_at, created_by, enabledtasks, total_active_count, total_archived_countand 23 more |
| Generated public names do not collideoperation-id-unique | 2.0 | Clean | 1242 operations clean | Nothing found |
| Every path placeholder has a parameterpath-parameters-declared | 1.5 | Clean | 1242 operations clean | Nothing found |
| Every operation declares an operationIdoperation-id-present | 1.0 | Clean | 1242 operations clean | Nothing found |
| operationIds read as method namesoperation-id-naming | 1.0 | 0.2 lost | 15 of 1242 operations | GET /POST /gists/{gist_id}/forksPUT /gists/{gist_id}/starand 12 more |
| Operations carry a summary or descriptionoperation-documented | 1.0 | Clean | 1242 operations clean | Nothing found |
| Request bodies are documentedrequest-body-documented | 1.0 | 0.2 lost | 30 of 1242 operations | PATCH /app/hook/configPOST /markdown/rawPUT /orgs/{org}/actions/permissionsand 27 more |
| Failure responses are declarederror-responses | 1.0 | 0.4 lost | 368 of 1242 operations | GET /GET /appGET /app/hook/configand 365 more |
| Operations are taggedoperation-tagged | 1.0 | Clean | 1242 operations clean | Nothing found |
| No duplicate or equivalent pathsduplicate-paths | 1.0 | 0.2 lost | 2 of 823 paths | /orgs/{}/attestations/{}/users/{}/attestations/{} |
| Authentication is describedsecurity-declared | 1.0 | 1.0 lost | Not declared | components.securitySchemes |
| Parameters explain their purposeparameters-documented | 0.75 | 0.18 lost | 54 of 1242 operations | POST /app-manifests/{code}/conversions#path:codeGET /app/hook/deliveries/{delivery_id}#path:delivery_idPOST /app/hook/deliveries/{delivery_id}/attempts#path:delivery_idand 51 more |
| A server URL is declaredserver-url | 0.5 | Clean | Declared | Nothing found |
Packaging, outside the score
This generates one package with 1242 operations and 996 models. Frontend consumers download all of it to call any of it, and low-spec machines pay for it in IDE and build time. The largest groups are `repos` (203), `actions` (200), `orgs` (116), and each is a candidate for its own project.
What 6.9 means for an SDK
A mixed reading, and the three rules that decide most of it.
The client compiles and works. Callers will feel the soft spots: a few methods that return an untyped value, arguments with no hint on them, a namespace or two named after a path segment rather than a resource.
Three rules carry six of the 10 points between them. On this document they took 0.86.
−0.4
Successful responses declare a schema
22 of 1242 operations
−0.4
Shared models live in components and are $ref'd
26 of 1242 operations
Clean
Generated public names do not collide
1242 operations clean
What to change first
The 6 heaviest of 8 rules that deducted.
0.4 lost
Successful responses declare a schema
Give the success response a schema, or a $ref to one in components. A 204 needs nothing.
Inside Octri this one has a one-click fix.
0.4 lost
Shared models live in components and are $ref'd
Move the shape into components.schemas once and $ref it from each operation that returns or accepts it.
0.2 lost
operationIds read as method names
Name the id for the action, not the route. The audit suggests one per operation and can apply it.
Inside Octri this one has a one-click fix.
0.2 lost
Request bodies are documented
Describe the body, or the fields inside it. Field-level prose is the one that reaches the SDK's arguments.
Inside Octri this one has a one-click fix.
0.4 lost
Failure responses are declared
Declare the failures you actually return, or one `default` response carrying your error shape.
0.2 lost
No duplicate or equivalent paths
Keep one. A server routes both to the same handler, so the second is a duplicate method for your users.
Where to go next
- Score your own spec The same fourteen rules, on any public URL. No account, and the spec is not kept.
- OpenAPI to a TypeScript SDK Published to npm, with the type definitions generated from your spec.
- OpenAPI to an MCP server The same endpoints, as tools an agent can call.
- How SDK Studio shapes a client Naming, hooks and packaging, decided before ten runtimes are built.
The spec at raw.githubusercontent.com is public. Octri keeps the `info` block, the score, and up to five sample finding locations per rule. The document itself is not stored and is not served from here. The audit predicts what an SDK generator can do with the description; it is not a security review, an uptime measurement or a critique of the API’s design. This page is not affiliated with GitHub v3 REST API or Support.