openapi response conformance audit derived

{
  "input": {
    "body": {
      "request": {
        "path": "/orders/{id}",
        "method": "GET"
      },
      "response": {
        "body": {
          "id": "o-1",
          "total": "42.50",
          "status": "cancelled"
        },
        "status": 200,
        "headers": {
          "Content-Type": "application/json"
        }
      },
      "specification": {
        "info": {
          "title": "Orders API",
          "version": "1.4.0"
        },
        "paths": {
          "/orders": {
            "get": {
              "summary": "List orders",
              "responses": {
                "200": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "type": "array",
                        "items": {
                          "$ref": "#/components/schemas/Order"
                        }
                      }
                    }
                  },
                  "description": "A page of orders"
                },
                "429": {
                  "description": "Rate limited"
                }
              },
              "operationId": "listOrders"
            },
            "post": {
              "summary": "Create an order",
              "responses": {
                "201": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "$ref": "#/components/schemas/Order"
                      }
                    }
                  },
                  "description": "Created"
                }
              },
              "operationId": "createOrder",
              "requestBody": {
                "content": {
                  "application/json": {
                    "schema": {
                      "$ref": "#/components/schemas/Order"
                    }
                  }
                }
              }
            },
            "parameters": [
              {
                "in": "query",
                "name": "page",
                "schema": {
                  "type": "integer",
                  "minimum": 1
                }
              }
            ]
          },
          "/orders/{id}": {
            "get": {
              "summary": "Fetch one order",
              "responses": {
                "200": {
                  "content": {
                    "application/json": {
                      "schema": {
                        "$ref": "#/components/schemas/Order"
                      }
                    }
                  },
                  "description": "The order"
                },
                "404": {
                  "description": "Not found"
                }
              },
              "parameters": [
                {
                  "in": "path",
                  "name": "id",
                  "schema": {
                    "type": "string"
                  }
                }
              ],
              "operationId": "getOrder"
            }
          },
          "/legacy/export": {
            "get": {
              "summary": "Legacy export",
              "responses": {
                "200": {
                  "description": "A CSV export"
                }
              },
              "operationId": "legacyExport"
            }
          }
        },
        "openapi": "3.1.0",
        "security": [
          {
            "apiKey": []
          }
        ],
        "components": {
          "schemas": {
            "Order": {
              "type": "object",
              "required": [
                "id",
                "total"
              ],
              "properties": {
                "id": {
                  "type": "string"
                },
                "total": {
                  "type": "number"
                },
                "status": {
                  "enum": [
                    "open",
                    "shipped"
                  ],
                  "type": "string"
                },
                "legacy_ref": {
                  "type": "string"
                }
              }
            }
          },
          "securitySchemes": {
            "apiKey": {
              "in": "header",
              "name": "X-Api-Key",
              "type": "apiKey"
            }
          }
        }
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxOperations": 500,
        "maxClientOperations": 200,
        "maxRequestBodyBytes": 262144
      },
      "status": 200,
      "complete": true,
      "findings": [
        {
          "code": "TYPE_MISMATCH",
          "detail": "GET /orders/{id}: response body Expected number, found string.",
          "status": "200",
          "pointer": "/total",
          "operation": "GET /orders/{id}"
        },
        {
          "code": "NOT_IN_ENUM",
          "detail": "GET /orders/{id}: response body \"cancelled\" is not one of the 2 permitted values.",
          "status": "200",
          "pointer": "/status",
          "operation": "GET /orders/{id}"
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "openapi_response_conformance_audit",
      "assumptions": [
        "A status may be declared exactly, as a range such as 2XX, or through default, and the most specific declaration is used.",
        "You supply the observed response, so this works against an API behind authentication or on a private network."
      ],
      "limitations": [
        "Conformance of one response against the supplied specification. Whether the specification is correct is not assessed.",
        "conformant is true only when the operation and status were declared and every declared constraint was evaluated and passed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "body_checked": true,
      "not_examined": [],
      "finding_count": 2,
      "service_version": "1.0.0",
      "findings_by_code": {
        "NOT_IN_ENUM": 1,
        "TYPE_MISMATCH": 1
      },
      "matched_operation": "GET /orders/{id}",
      "matched_status_declaration": "200"
    }
  }
}