Zally

Zally is for teams that want to check API definitions against a consistent set of quality rules. It suits organizations comfortable running and tailoring developer tools; teams seeking a wider API governance suite should consider other options.

Overview

Zally lints OpenAPI 3 and Swagger OpenAPI 2 specifications, using Zalando’s RESTful Guidelines as its standard rule set. The project says it can also be used out of the box by other teams, giving them a starting point for enforcing shared API conventions. Maintained by Zalando, it is offered under the MIT license with an exception.

The focus is deliberately narrow: Zally checks specifications rather than presenting itself as a complete API lifecycle platform. That makes it a better fit for teams looking to add specification checks than for those seeking a single tool for broader governance work.

Key features

Linting is available through a RESTful API, a command-line interface and a web interface. The choice matters in practice: teams can use the interface that best fits their existing workflow instead of being limited to browser-based review. The web UI also displays implemented rules and can lint external files and API definitions in its online editor.

Teams can enable or disable server-side rules, configure some existing rules and implement custom ones in Kotlin. This provides room to align checks with local conventions, but writing new rules means working in Kotlin. The x-zally-ignore extension lets an API definition exclude rules for that API, a useful escape valve when a rule does not fit a particular definition.

The project README describes starting the web UI, server and database together using Docker Compose. That gives self-hosting teams a documented way to run the components together. The README also names a Zally Maven Plugin integration, but labels it unofficial, so teams should treat it as a community integration rather than a supported core interface.

Zally’s security policy directs vulnerability reports to Zalando’s form and notes a private HackerOne bug bounty program. The project invites users to join its Gitter room or contact maintainers directly for support.

Pricing

Zally is open source and free. Its Open source plan costs nothing and includes the API linter under the MIT license with an exception. There is no paid tier to compare against, so the trade-off is not a feature quota but the work of running and adapting the tool to fit a team’s standards.

Platforms

Zally is available for API, Linux, macOS, Windows, web and self-hosted use. That range supports teams that want to run it locally or deploy the service themselves, while the RESTful API, CLI and browser interface provide different ways to access its linting.

Who it's for

Zally is a strong fit for engineering teams that work with OpenAPI 2 or 3, want a defined baseline for specification quality and can manage their own tooling. Kotlin-capable teams get more value from its custom-rule support; teams that only need to apply or selectively adjust existing rules can use it without writing new checks.

It is less suitable for buyers looking for a broad governance suite or a fully supported Maven integration. The Maven Plugin is explicitly unofficial, and Zally’s core purpose is specification linting.

Pros and cons

• Multiple interfaces: REST API, CLI and web UI let teams choose how to incorporate linting and review.
• Configurable rules: Teams can adjust some existing checks, switch server-side rules on or off, and add Kotlin rules; custom checks do require Kotlin implementation.
• API-level exceptions: The x-zally-ignore extension can exempt a definition from rules that do not suit it.
• Free and open source: The free plan avoids a subscription, but teams must run and adapt the software themselves.
• Unofficial Maven integration: The plugin may suit teams exploring Maven workflows, but its unofficial status makes it a weaker choice when a supported integration is essential.

Alternatives

For a wider set of API governance capabilities, compare API Governance Software. ATA API Governance is the more direct alternative for teams seeking governance features and a freemium plan: its free tier covers 30 endpoints, one team, three users and five Developer Studio applications, with a Startup plan at $35.60 a year.

Postman is a freemium API client and toolkit with a free tier that includes specs and mock servers, Native Git and Collection Runner; choose it when those broader API tools matter more than a focused specification linter. Routebase offers OpenAPI import and export alongside a docs portal, with its free plan capped at one user, two projects and 1,000 mock requests per month; it is a better fit when mock requests and documentation are priorities.

Grapity offers a free self-hosted plan with unlimited APIs and team members and self-managed PostgreSQL, making it worth considering when those specific self-hosted provisions fit the need. oasdiff is an open-source option for teams comparing its engine, CLI and GitHub Action under the Apache 2.0 license.

Karate is a freemium testing framework covering REST, GraphQL and SOAP APIs, as well as browser and desktop UI automation; choose it when testing and automation are the priority rather than specification linting. SwaggerHub offers API design and documentation, with a free plan for basic design and documentation, so it suits teams focused on those tasks. Apiway has a free tier with usage credits and read/write limits; its allowance may suit teams evaluating that platform’s API workflows.

Verdict

Choose Zally if your team needs free, configurable linting for OpenAPI 2 or 3 and is prepared to run the tool and, where needed, write Kotlin rules. Its strongest reason to choose it is the combination of multiple interfaces and adaptable checks without a subscription. Look elsewhere if you need broader API governance or rely on a formally supported Maven integration.