Skip to main content
Templates are pre-configured rulesets that you can use directly or customize before saving as your own ruleset. They exist so a team can have governance running on day one without authoring rules from scratch. To create a ruleset from a template, see Create a Ruleset From a Template, or follow the Quick Start for a full walkthrough.

​
Available Templates

Tyk Governance ships two templates covering the most common starting points for API governance.

​
OWASP API Security

A security baseline aligned to the OWASP API Security Top 10. Use it when the risk you are managing is exposure: APIs reachable by customers, partners, or the public internet. Start this template’s rules at Error severity if you already enforce a security review, or at Warn severity if you are introducing security standards to teams for the first time and want adoption before enforcement. OpenAPI design best practices, drawn from the recommended rule set of the Vacuum engine that Tyk Governance uses to execute rulesets. Use it when the problem you are solving is inconsistency across teams rather than security risk. Design rules are usually the better candidate for a gradual rollout, because a portfolio that has never been linted against them tends to produce a large first result.

​
Customizing a Template

A template is a starting point, not a fixed artifact. When you select one in the creation wizard, its full definition loads into the editor, and you can:
  • Disable individual rules you do not want to enforce.
  • Adjust the severity of individual rules, for example dropping a rule to Warn while teams adopt it.
  • Edit the howToFix text so remediation guidance matches your organization’s own conventions and internal links.
  • Add your own rules alongside the template’s.
Once saved, the result is an ordinary ruleset. It has no further link back to the template, so later changes to the shipped template do not alter a ruleset you already created from it.

​
Template or Custom Ruleset?

Use a template when your standards map closely to a security baseline or to general OpenAPI design quality. Between them, the two shipped templates cover most baseline cases without custom authoring. Write your own ruleset, or import an existing Spectral one, when your standards are specific to your organization: internal naming conventions, required custom headers, domain-specific requirements, or Tyk Gateway configuration requirements expressed through the x-tyk-api-gateway extension. The two are not exclusive, and combining them is the common pattern. A service can be governed by any number of rulesets at once, so a typical setup links a shipped security template plus a house design ruleset to the same category, and reports on each independently. See Scoping Rulesets to Services.

​
Importing an Existing Spectral Ruleset

You can import any existing Spectral ruleset through the own-definition flow. The Vacuum engine that executes rulesets is fully compatible with the Spectral ruleset format, so existing rulesets work without modification. See From Your Own Definition. One behavior to know if you keep rulesets as templates: category-based resolution in the CI/CD sandbox endpoint returns only active, non-template rulesets. To check a spec against a ruleset that is still marked as a template, reference it explicitly by ID instead. See Query Parameters in the Governance Evaluation API reference.