api-contract-testinglisted

# API Contract Quality Treat an API contract as an executable agreement between producers and consumers. Design it before implementation when practical, then verify behavior, security and compatibility continuously. ## Workflow 1. Inventory consumers, endpoints/RPCs, data classifications, owners, versions, SLAs and dependencies. 2. Define resources/messages, success/error schemas, validation, idempotency, pagination, timeouts, retries, rate limits and version compatibility. 3. Specify authentication and authorization separately, including object-level and function-level access checks. Do not put secrets or real personal data in examples. 4. Generate representative positive, negative, boundary, malformed, unauthorized and replay cases from the contract. 5. Run provider contract tests and consumer compatibility tests in CI; use mocks only when their limitations are explicit. 6. Add performance, resilience and security tests proportionate to risk. Define deprecation, changelog and migration policy. 7. Report mismatches with request, response, expected contract, actual behavior, environment, test ID and remediation owner. ## Contract review checklist - Unique operation IDs and stable naming - Explicit required/optional/null semantics - Strict enough validation without rejecting intended evolution - Safe error messages and correlation ID - Authentication plus authorization and tenant/object isolation - No sensitive data leakage in schemas, examples or logs - Timeouts, retry/i