Zally

Zally is a focused OpenAPI linting and quality-assurance tool for teams that need consistent API design checks. It suits developers and platform groups comfortable with command-line or self-hosted tooling, while organizations wanting a complete governance suite may find its scope narrow. The strongest case is flexible, no-cost enforcement across common OpenAPI versions; the main trade-off is that deeper customization and deployment remain your responsibility.

Overview

Zally evaluates OpenAPI 3 and Swagger OpenAPI 2 specifications against rules, using Zalando’s RESTful Guidelines as its standard configuration. That gives a team a concrete style baseline instead of requiring it to define every check from scratch, and the project says the defaults can be used by other organizations. Zalando maintains the project, which is released under an MIT license with an exception.

It is an API linter rather than a broad catalog, lifecycle, analytics or collaboration platform. Choose it when specification quality and style enforcement are the priority; look elsewhere if you need a larger governance system around those checks.

Key features

Three interfaces cover different workflows: a RESTful API for integrating checks into services, a CLI for developer and automation workflows, and a web interface for browser-based review. The web UI lists implemented rules and can lint external files and API definitions in its online editor, useful for inspecting a specification without building a separate review screen.

Rules are adjustable. Administrators can enable or disable server-side rules and configure some existing checks, while teams can implement custom rules in Kotlin. The x-zally-ignore extension allows an API definition to suppress rules for that API, which helps handle justified exceptions but can weaken consistency if used indiscriminately. Writing new checks requires Kotlin capability.

Self-hosting is documented through Docker Compose, which can start the web UI, server and database together. The README also lists an unofficial Zally Maven Plugin integration; its unofficial status makes it less suitable as the sole foundation for a critical, formally supported build pipeline. Security vulnerability reports can be sent through Zalando’s form, and the private HackerOne bug bounty is another reporting route. Users can seek help in the Gitter room or contact maintainers directly.

Pricing

There are no paid tiers, seat charges or usage quotas stated for this plan. It is a strong fit for teams able to operate the software themselves and accept responsibility for deployment and rule maintenance. Those wanting vendor-managed hosting, packaged governance workflows or commercial support should compare paid services instead.

Platforms

Zally is offered across API, Linux, macOS, self-hosted, web and Windows environments. The combination supports local CLI use, browser review and server deployment, although the documented Docker Compose setup means self-hosting teams must manage the web UI, server and database components.

Who it's for

Choose Zally for engineering teams standardizing OpenAPI definitions, organizations adopting Zalando-style REST conventions, and platform groups that need API, CLI and browser entry points. It is also appropriate when open-source licensing and the ability to write Kotlin rules matter. It is less suitable for buyers seeking a turnkey governance portal, extensive commercial support or a fully supported build-system plugin.

Pros and cons

Pros

• OpenAPI 2 and 3 coverage: checks support both Swagger OpenAPI 2 and OpenAPI 3 specifications.
• Flexible operation: REST, CLI and web interfaces fit automation, developer workflows and browser review.
• Adaptable rules: teams can tune existing checks, disable rules, add Kotlin rules and handle API-specific exceptions.
• No license fee: the open-source plan costs nothing.
• Practical self-hosting: Docker Compose brings the web UI, server and database up together.

Cons

• Narrow remit: it concentrates on specification linting rather than a complete API governance platform.
• Customization overhead: custom rules require Kotlin development, and self-hosting requires operational ownership.
• Unofficial Maven integration: teams depending on Maven automation do not get a formally supported integration from the listed option.

Alternatives

For a broader governance product with a capped free tier of 30 endpoints, one team and three users, consider ATA API Governance; its Startup plan is $35.60 a year.

Pick Grapity when unlimited APIs and team members on a self-managed PostgreSQL deployment matter; its self-hosted plan is free forever, while Cloud costs $29.95 a month.

oasdiff is an alternative when an Apache 2.0 open-source engine, CLI and GitHub Action are the priority.

Choose Postman for a wider API client and core-toolset workflow with specs, mock servers and a Collection Runner on its free plan.

Routebase suits teams wanting hosted projects, a documentation portal and 1,000 mock requests per month on its free tier.

Consider Karate when API testing extends to REST, GraphQL, SOAP, browser and desktop automation.

API Architect is a web-only option with project limits and API analytics in higher plans.

For eligible Apigee organizations in supported regions, Apigee API hub is available at no additional cost.

See the API Governance Software list for more options.

Verdict

Zally is a strong choice for teams that want open-source OpenAPI linting, Zalando’s guidelines as a starting point and the freedom to run or extend the system themselves. Choose it for focused, adaptable quality checks across OpenAPI 2 and 3. Look elsewhere when you need a managed, full-lifecycle governance platform or formally supported integrations beyond its core interfaces.