openapi parameter contract audit derived

{
  "input": {
    "body": {
      "request": {
        "path": "/orders",
        "query": {
          "page": "first"
        },
        "method": "GET",
        "headers": {
          "X-Api-Key": "redacted"
        }
      },
      "specification": {
        "info": {
          "title": "Orders API",
          "version": "2.0.0"
        },
        "paths": {
          "/orders": {
            "get": {
              "summary": "List orders",
              "responses": {
                "200": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "type": "array",
                        "items": {
                          "$ref": "#/components/schemas/Order"
                        }
                      }
                    }
                  },
                  "description": "A page of orders"
                }
              },
              "parameters": [
                {
                  "in": "query",
                  "name": "tenant",
                  "schema": {
                    "type": "string"
                  },
                  "required": true
                }
              ],
              "operationId": "listOrdersV2"
            },
            "post": {
              "summary": "Create an order",
              "responses": {
                "201": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "$ref": "#/components/schemas/Order"
                      }
                    }
                  },
                  "description": "Created"
                }
              },
              "operationId": "createOrder",
              "requestBody": {
                "content": {
                  "application/json": {
                    "schema": {
                      "$ref": "#/components/schemas/Order"
                    }
                  }
                },
                "required": true
              }
            },
            "parameters": [
              {
                "in": "query",
                "name": "page",
                "schema": {
                  "type": "integer",
                  "minimum": 1
                }
              }
            ]
          },
          "/orders/{id}": {
            "get": {
              "summary": "Fetch one order",
              "responses": {
                "200": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "$ref": "#/components/schemas/Order"
                      }
                    }
                  },
                  "description": "The order"
                },
                "404": {
                  "description": "Not found"
                }
              },
              "deprecated": true,
              "parameters": [
                {
                  "in": "path",
                  "name": "id",
                  "schema": {
                    "type": "string"
                  }
                }
              ],
              "operationId": "getOrder"
            }
          }
        },
        "openapi": "3.1.0",
        "security": [
          {
            "apiKey": []
          }
        ],
        "components": {
          "schemas": {
            "Order": {
              "type": "object",
              "required": [
                "id",
                "total",
                "tenant_id"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "total": {
                  "type": "number"
                },
                "status": {
                  "enum": [
                    "open",
                    "shipped",
                    "disputed"
                  ],
                  "type": "string"
                },
                "tenant_id": {
                  "type": "string"
                }
              }
            }
          },
          "securitySchemes": {
            "apiKey": {
              "in": "query",
              "name": "api_key",
              "type": "apiKey"
            }
          }
        }
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxOperations": 500,
        "maxClientOperations": 200,
        "maxRequestBodyBytes": 262144
      },
      "checked": {
        "body": false,
        "path_parameters": 0,
        "query_parameters": 2,
        "header_parameters": 0
      },
      "complete": true,
      "findings": [
        {
          "code": "TYPE_MISMATCH",
          "detail": "GET /orders: query parameter page Expected integer, found string.",
          "location": "query",
          "operation": "GET /orders",
          "parameter": "page"
        },
        {
          "code": "REQUIRED_PARAMETER_MISSING",
          "detail": "GET /orders: required query parameter tenant is absent from the request.",
          "location": "query",
          "operation": "GET /orders",
          "parameter": "tenant"
        },
        {
          "code": "SECURITY_REQUIREMENT_UNMET",
          "detail": "GET /orders requires apiKey and the request carries no matching credential.",
          "operation": "GET /orders"
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "openapi_parameter_contract_audit",
      "assumptions": [
        "A literal path segment is preferred over a template, as a router would, so /pets/mine is audited against its own operation rather than /pets/{id}.",
        "Path, query and header values arrive as text, so a value declared as an integer is checked against its text form rather than rejected for being a string.",
        "Header names are compared case-insensitively."
      ],
      "limitations": [
        "Conformance of one request against the supplied specification. Whether the specification is correct is not assessed.",
        "conformant is true only when every declared constraint for the matched operation was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "operation_id": "listOrdersV2",
      "finding_count": 3,
      "path_variables": {},
      "service_version": "1.0.0",
      "findings_by_code": {
        "TYPE_MISMATCH": 1,
        "REQUIRED_PARAMETER_MISSING": 1,
        "SECURITY_REQUIREMENT_UNMET": 1
      },
      "matched_operation": "GET /orders",
      "operation_deprecated": false,
      "matched_path_template": "/orders"
    }
  }
}