Map the API
Define request and response contracts
Specify allowed methods, parameters, bodies, content types, responses, and errors so unknown input and accidental data exposure are visible.
8 minute lesson
A clear contract gives both clients and the server a boundary. Open-ended objects create room for accidental authority.
Describe required fields, limits, formats, allowed values, and response shapes. Reject unsupported methods and content types. Select response fields deliberately rather than serializing database models.
An invoice response may accidentally expose internalNote when code serializes the database row. A strict response schema catches that leak without forcing every internal field into the public contract.
Contract tests should inspect the complete response, not only required fields. This catches new database columns that appear after a migration and were never approved for API clients.
Write request and response schemas for creating one invoice. Add an unknown input field and an internal database field, then show both are rejected or absent from the response.
Lesson completed