api-auditlisted

# zuvo:api-audit — API and Endpoint Integrity Audit Standalone audit of how the application exposes, consumes, and validates data across API boundaries. Evaluates endpoints through 10 weighted dimensions, builds an auth matrix, and runs cross-cutting analysis on contract consistency, money field representation, and payload efficiency. **When to use:** Periodic health check of the API layer, before major releases, after adding new endpoints, when investigating overfetching or waterfall issues. **Out of scope:** Single-file code review (use `zuvo:review`), refactoring (use `zuvo:refactor`), security posture analysis (use `zuvo:security-audit`), feature development (use `zuvo:build`). ## Argument Parsing | Argument | Effect | |----------|--------| | `full` | Audit all endpoints in the project | | `[path]` | Audit endpoints in a specific directory or module | | `--static` | Static analysis only -- skip Phase 2 (GET probing). Use when no running server is available. | | `--security` | Activate D12 (OWASP API Security Top 10): BOLA, BOPLA/mass-assignment, BFLA, JWT alg-confusion, sensitive business flows, shadow endpoints, GraphQL introspection/depth. Auto-activates when an auth surface is detected. | ## Mandatory File Loading Read these files from disk before starting. Print the checklist. Do not proceed from memory. ``` CORE FILES LOADED: 1. ../../rules/cq-checklist.md -- READ/MISSING 2. ../../rules/security.md -- READ/MISSING 3. ../../share