Readiness Scorecard

The spec declares error responses (400, 401, 409) but no scenario exercises any error path — consumers cannot verify failure handling.

This endpoint has zero scenarios, so no behaviour beyond the static schema is asserted. Schema validation alone cannot prove what each input does.

This endpoint has zero scenarios, so no behaviour beyond the static schema is asserted. Schema validation alone cannot prove what each input does.

GET /orders/{id} takes an object id {id} but has no auth_error scenario proving a forbidden id is rejected. Object-level authorization is asserted in code, never in a test.

PATCH /orders/{id} takes an object id {id} but has no auth_error scenario proving a forbidden id is rejected. Object-level authorization is asserted in code, never in a test.

POST /orders/{id}/fulfill takes an object id {id} but has no auth_error scenario proving a forbidden id is rejected. Object-level authorization is asserted in code, never in a test.

POST /orders accepts neither a W3C `traceparent` nor a correlation/request-id header. Calls to this endpoint cannot be stitched into a distributed trace — events here are orphaned from the wider flow.

GET /orders/{id} accepts neither a W3C `traceparent` nor a correlation/request-id header. Calls to this endpoint cannot be stitched into a distributed trace — events here are orphaned from the wider flow.

PATCH /orders/{id} accepts neither a W3C `traceparent` nor a correlation/request-id header. Calls to this endpoint cannot be stitched into a distributed trace — events here are orphaned from the wider flow.

POST /orders/{id}/fulfill accepts neither a W3C `traceparent` nor a correlation/request-id header. Calls to this endpoint cannot be stitched into a distributed trace — events here are orphaned from the wider flow.

Unsafe methods without an Idempotency-Key let a client/load-balancer retry duplicate the operation — duplicated orders, double charges, inconsistent state.

Unsafe methods without an Idempotency-Key let a client/load-balancer retry duplicate the operation — duplicated orders, double charges, inconsistent state.

This endpoint declares 2 responses but has no scenario validating any of them — the contract is unverified, so a breaking change here would pass CI undetected.

This endpoint declares 3 responses but has no scenario validating any of them — the contract is unverified, so a breaking change here would pass CI undetected.

Enum-like string fields need an explicit allowed-value set.

Neither the schema, its properties, nor a linked response supplies an example payload, so documentation, mocks and contract tests must invent data.

This write endpoint only has happy-path coverage. Business semantics — which inputs are rejected and why — are not asserted, the exact gap schema validation cannot close.

The spec declares 1 success status code(s) with no scenario asserting that path, so response-path coverage is incomplete.

This write endpoint only has happy-path coverage. Business semantics — which inputs are rejected and why — are not asserted, the exact gap schema validation cannot close.

Schema validation does not capture business rules — which input yields which status code or downstream effect. These mutating endpoints have no scenario: POST /orders, PATCH /orders/{id}, POST /orders/{id}/fulfill.

POST /orders returns or mutates a collection but has no auth_error scenario. Bulk endpoints leak or alter rows across tenants when scoping is wrong (OWASP API1/API3 at scale).

Dependency timeouts and downstream failures are common in service meshes but routinely under-tested. Without a scenario the degradation path is unproven.

Dependency timeouts and downstream failures are common in service meshes but routinely under-tested. Without a scenario the degradation path is unproven.

Unsafe methods without an Idempotency-Key let a client/load-balancer retry duplicate the operation — duplicated orders, double charges, inconsistent state.

A 429/503 response with no Retry-After header forces clients and agents to guess back-off timing, amplifying load on an already-stressed service.

Dependency timeouts and downstream failures are common in service meshes but routinely under-tested. Without a scenario the degradation path is unproven.

0/4 return at least one response example. Agents stall where humans guess — this lowers automated-consumer readiness.

1/4 declare both 4xx and 5xx classes. Agents stall where humans guess — this lowers automated-consumer readiness.

0/3 mutators declare Idempotency-Key. Agents stall where humans guess — this lowers automated-consumer readiness.

Order Management API declares 4 endpoints and none of them is a probe (GET /healthz, /readyz, /livez, /health, /ready, /live, /status, or a `health` tag). A platform cannot know when this service may receive traffic or must be restarted; a generated workload manifest would carry no probe.

8 error responses (4xx/5xx) are declared and not one carries a schema. Gateways, SDKs and on-call engineers then cannot rely on an error envelope — no stable code, no correlation id, no retryability signal.

PATCH /orders/{id} replaces a resource the same path also exposes for reading, and declare no precondition — no If-Match, no If-Unmodified-Since, no version field in the body. Two clients that read, edit and write in that order both succeed, and the second silently discards the first one's change.

Schema "OrderItem" (7 fields) has no example payload. Without examples, docs are harder to read and test-data generation is guesswork.

POST /orders returns 201 but ships no response example. Consumers cannot see the expected shape without calling the live API.

GET /orders/{id} returns 200 but ships no response example. Consumers cannot see the expected shape without calling the live API.

PATCH /orders/{id} returns 200 but ships no response example. Consumers cannot see the expected shape without calling the live API.

POST /orders/{id}/fulfill returns 202 but ships no response example. Consumers cannot see the expected shape without calling the live API.

POST /orders declares no 429 response, no per-status throttle behaviour and no rate_limit scenario. Without resource/rate limiting the endpoint is an abuse target (OWASP API4).

POST /orders has no validation_error, auth_error or rate_limit scenario. Only happy-path behaviour is asserted, so malformed and hostile input is untested (dynamic security testing gap).

GET /orders/{id} declares no 429 response, no per-status throttle behaviour and no rate_limit scenario. Without resource/rate limiting the endpoint is an abuse target (OWASP API4).

GET /orders/{id} has no validation_error, auth_error or rate_limit scenario. Only happy-path behaviour is asserted, so malformed and hostile input is untested (dynamic security testing gap).

PATCH /orders/{id} declares no 429 response, no per-status throttle behaviour and no rate_limit scenario. Without resource/rate limiting the endpoint is an abuse target (OWASP API4).

PATCH /orders/{id} has no validation_error, auth_error or rate_limit scenario. Only happy-path behaviour is asserted, so malformed and hostile input is untested (dynamic security testing gap).

POST /orders/{id}/fulfill declares no 429 response, no per-status throttle behaviour and no rate_limit scenario. Without resource/rate limiting the endpoint is an abuse target (OWASP API4).

POST /orders/{id}/fulfill has no validation_error, auth_error or rate_limit scenario. Only happy-path behaviour is asserted, so malformed and hostile input is untested (dynamic security testing gap).

This API has 2 scenario(s), but none set or assert a trace/correlation header. Observability isn't wired into the validation pipeline, so trace regressions ship undetected.

Declared success response 200 has no scenario — coverage drift the green pipeline does not reveal.