{"uid":"cap_A-84lEzAE1gImnQXcx9nQ","slug":"api-response-contract-audit-99b5bff4","name":"API Response Contract Audit","description":"Audit an HTTP response you captured against a contract you declare: expected status or status class, required and forbidden headers, header value rules, and a body schema. Header names compare case-insensitively. You supply the response, so this works against an API behind authentication or on a private network.","url":"https://api.zfinia.com/x402/v1/api-response-contract-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"contract":{"type":"object","properties":{"body_schema":{"type":"object"},"header_values":{"type":"object"},"expected_status":{},"required_headers":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":50},"forbidden_headers":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":50}},"additionalProperties":false},"response":{"type":"object","required":["status"],"properties":{"body":{},"status":{"type":"integer","maximum":599,"minimum":100},"headers":{"type":"object"}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.12","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.12/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.12","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_5zuOfTgAqz56reayyC9rF","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.12","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a captured HTTP response against a declared contract covering expected status, required/forbidden headers, header value rules, and a body schema.","exampleAgentPrompt":"Check if this API response is contract-compliant: it returned status 200, has a Content-Type header of application/json, is missing an X-Request-Id header I require, and the body should match a schema with a required 'id' field of type string and 'items' as an array — flag any violations.","exampleUseCases":[{"title":"Verify private auth endpoint response","prompt":"I just captured a response from our internal OAuth token endpoint — status 200, with headers Authorization and Content-Type, body has an access_token field. Check it against our contract: we require Content-Type to be application/json, forbid X-Debug headers, and the body schema must have access_token as a non-empty string and expires_in as an integer."},{"title":"Catch forbidden headers in staging API","prompt":"Our staging API just returned a response and I want to make sure it's not leaking any debug or internal headers like X-Internal-Trace or X-Debug-Info — flag it if any of those are present, and also confirm the status was in the 2xx range."},{"title":"Assert body schema after a third-party webhook","prompt":"I received a webhook from our payment provider and need to verify it matches our expected contract: status must be 200, the body should have an event field as a string and an amount field as a number, and the Content-Type header must be application/json — tell me if anything is off."}],"resultDescription":"An audit report detailing which contract rules passed or failed: whether the HTTP status matched the expected status or class, which required headers were missing, which forbidden headers were present, which header value rules were violated, and which body schema constraints failed — with case-insensitive header name comparison throughout.","failureModes":["Missing required 'status' field in the response object causes a validation error","Malformed body_schema causes schema evaluation to fail","If the response body is not JSON-parseable, body schema validation will fail","Overly broad status class expressions may be misinterpreted","No internet access to the live API — caller must supply the captured response"],"whenToPreferThis":"Use this endpoint when you need to validate a response from an API that sits behind authentication or on a private network, where automated contract testing tools cannot reach it directly. It is ideal when you have already captured the HTTP response and want to assert it against a formally declared contract without re-running the request. Prefer this over general JSON schema validators when you also need to check HTTP status codes and headers simultaneously.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T15:15:59.346Z","isFirstParty":false,"canonicalSlug":"api-response-contract-audit-99b5bff4"}