Boolean fields use descriptive prefixes
Why it matters
A field named active could be a boolean, a verb, or a role descriptor — consumers can't tell from the name alone. admin is worse: it reads as a role name but is sometimes a boolean flag. When boolean fields lack is_/has_/can_ prefixes, client code is forced to check documentation or source code before using the value, and TypeScript consumers may assign wrong types. iso-25010:2011 maintainability.readability is the direct impact: any developer reading the response must stop and verify semantics rather than inferring from the name.
Severity rationale
Low because ambiguous boolean naming causes developer confusion and potential type bugs without enabling security exploits or data loss.
Remediation
Add descriptive prefixes to all boolean fields so consumers can infer the type from the name without consulting documentation:
// Before -- ambiguous field names:
{ "active": true, "admin": false, "verified": true }
// After -- intent is unambiguous:
{ "isActive": true, "isAdmin": false, "isVerified": true }
For snake_case APIs, prefer is_active, has_permission, can_edit. Apply the same prefix convention in your TypeScript interfaces, OpenAPI schema, and any serialization functions to keep all three in sync.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.readability — Readability — unambiguous boolean field names
Taxons
History
- 2026-04-18·v1.0.0·Initial import from api-design·automated