Zally
What it is
Zally is a free, open-source API linter and quality assurance tool for OpenAPI specifications. It checks OpenAPI 3 and Swagger OpenAPI 2 descriptions, with a standard configuration based on Zalando’s RESTful Guidelines. The project also says others can use it out of the box. Users can work through a RESTful API, command-line interface, or web interface. The web UI lists implemented rules and can lint external files and API definitions in its online editor. Server-side rules can be enabled or disabled, some existing rules can be configured, and teams can implement custom rules in Kotlin. An API definition can use the x-zally-ignore extension to disable rules for that API. The README describes a local setup that starts the web UI, server, and database together through Docker Compose. It also lists a Zally Maven Plugin integration, marked unofficial. Maintained by Zalando, the project is offered under an MIT license with an exception. Listed platforms include API, Linux, macOS, self-hosted use, web, and Windows. The Open source plan is free.
For and against
For
- Checks OpenAPI 3 and Swagger OpenAPI 2 specifications.
- Offers RESTful API, CLI, and web interfaces.
- Rules can be configured or extended in Kotlin.
- Docker Compose can start the local web UI, server, and database.
- Free, open source, and MIT-licensed with an exception.
Against
- Access control is listed as basic.
- The Zally Maven Plugin integration is unofficial.
- The security policy page did not expose its policy text.
The verdict
Zally focuses on API specification linting, with configurable guidelines and several ways to run it. Teams can assess whether its rule model and basic access control suit their needs.
Who it suits
Zally suits teams that want to lint OpenAPI 2 or OpenAPI 3 specifications against API guidelines and configure or extend rules. Its CLI, web interface, RESTful API, and self-hosting option offer different ways to use it.
Plans and prices
Open source
MIT license with an exception · API linter
Read 8 Oct 2026 · github.com
On the record
- Customization
- Users can enable or disable server-side rules, configure some existing rules, and implement custom rules in Kotlin.opensource.zalando.com · read 8 Oct 2026
- Guidelines
- Its standard configuration checks APIs against Zalando’s RESTful Guidelines, and the project says it can also be used out of the box by others.opensource.zalando.com · read 8 Oct 2026
- Integration
- The README lists a Zally Maven Plugin integration and labels it unofficial.github.com · read 8 Oct 2026
- Integrations
- The README lists an unofficial Zally Maven Plugin integration.github.com · read 8 Oct 2026
- Interfaces
- Zally provides a RESTful API, a CLI, and a web interface.github.com · read 8 Oct 2026
- License
- The project is offered under an MIT license with an exception.github.com · read 8 Oct 2026
- Local deployment
- The project README says the web UI, server, and database can be started together with Docker Compose.github.com · read 8 Oct 2026
- Maintainer
- The project site says Zally is maintained by Zalando.opensource.zalando.com · read 8 Oct 2026
- Maker
- The project says it is maintained by Zalando.opensource.zalando.com · read 8 Oct 2026
- OpenAPI support
- It supports OpenAPI 3 and Swagger OpenAPI 2 specifications.github.com · read 8 Oct 2026
- Purpose
- Zally is an API linter and quality assurance tool for OpenAPI specifications.github.com · read 8 Oct 2026
- Rule exceptions
- The x-zally-ignore extension lets users disable rules for a specific API.github.com · read 8 Oct 2026
- Security
- The repository has a security policy page, but the opened policy page did not expose its policy text.github.com · read 8 Oct 2026
- Security reporting
- The repository security policy says vulnerability reports can be submitted through Zalando’s form and that its HackerOne bug bounty program is private.github.com · read 8 Oct 2026
- Self-hosting
- The README describes running the web UI, server, and database together with Docker Compose.github.com · read 8 Oct 2026
- Specification support
- It supports OpenAPI 3 and Swagger OpenAPI 2 specifications.github.com · read 8 Oct 2026
- Support
- The project invites users to join its Gitter room or contact maintainers directly.github.com · read 8 Oct 2026
- Web UI
- The web UI lists implemented rules and can lint external files and API definitions in its online editor.opensource.zalando.com · read 8 Oct 2026
