api response contract audit derived

{
  "input": {
    "body": {
      "contract": {
        "body_schema": {
          "type": "object",
          "required": [
            "data"
          ],
          "properties": {
            "data": {
              "type": "object"
            }
          }
        },
        "header_values": {
          "content-type": {
            "starts_with": "application/json"
          }
        },
        "expected_status": [
          "2xx"
        ],
        "required_headers": [
          "x-request-id"
        ],
        "forbidden_headers": [
          "x-powered-by"
        ]
      },
      "response": {
        "body": {
          "error": "upstream unavailable"
        },
        "status": 503,
        "headers": {
          "Content-Type": "text/html; charset=utf-8",
          "X-Powered-By": "Express"
        }
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxLines": 2000,
        "maxHeaders": 100,
        "maxFindings": 500,
        "maxPointers": 2000,
        "maxTextBytes": 262144,
        "maxBatchItems": 500,
        "maxDocumentBytes": 262144
      },
      "passed": false,
      "status": 503,
      "checked": {
        "status": true,
        "body_schema": true,
        "header_values": 1,
        "required_headers": 1,
        "forbidden_headers": 1
      },
      "complete": true,
      "findings": [
        {
          "code": "UNEXPECTED_STATUS",
          "detail": "Status 503 is not among the expected 2xx.",
          "status": 503
        },
        {
          "code": "REQUIRED_HEADER_MISSING",
          "detail": "Header x-request-id is required and absent.",
          "header": "x-request-id"
        },
        {
          "code": "FORBIDDEN_HEADER_PRESENT",
          "detail": "Header x-powered-by must not be present.",
          "header": "x-powered-by"
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "api_response_contract_audit",
      "assumptions": [
        "Header names are compared case-insensitively, as HTTP defines them.",
        "An expected status may be an exact code or a class such as 2xx.",
        "The caller supplies the observed response. Nothing is fetched, so this works against any API including one that is not publicly reachable."
      ],
      "limitations": [
        "Conformance against the supplied contract only. Whether the contract is the right contract is not assessed.",
        "conformant is true only when every declared check ran and passed; a body supplied without a body_schema leaves the audit incomplete."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "body_checked": true,
      "header_count": 2,
      "not_examined": [],
      "finding_count": 5,
      "service_version": "1.0.0",
      "findings_by_code": {
        "UNEXPECTED_STATUS": 1,
        "HEADER_VALUE_MISMATCH": 1,
        "REQUIRED_HEADER_MISSING": 1,
        "FORBIDDEN_HEADER_PRESENT": 1,
        "REQUIRED_PROPERTY_MISSING": 1
      }
    }
  }
}