{"uid":"cap_rfQ98Zy5j8qS2AmCCh9tq","slug":"api-contracts-scope-boundary-audit-fdbdabde","name":"API Contracts Scope Boundary Audit","description":"Compare HTTP contract owner, revision, scope and allowed target declarations exactly. HTTP paths include method and segment boundaries; tool targets include transport. Labels grant no authorization. Offline typed nonpersonal metadata only. Result retention: 24 hours; minimal receipt metadata: 90 days.","url":"https://www.mahastrategies.com/api/v1/verify/api-contracts/scope-boundary-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"ownerRef":{"type":"string"},"revision":{"type":"string"},"scopeRef":{"type":"string"},"contracts":{"type":"array","maxItems":32,"minItems":1},"dataClass":{"enum":["public","synthetic"],"type":"string"},"allowedTargets":{"type":"array","maxItems":32,"minItems":1},"nonpersonalMetadata":{"type":"boolean","const":true}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.038303","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.038303/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.038303","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.038303","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_8imG38TdshRK6FJSoDH__","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.038303","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates HTTP API contract scope boundaries by comparing owner, revision, scope, and allowed target declarations with exact precision across supplied contract records.","exampleAgentPrompt":"Can you run a scope boundary audit on our API contracts? The owner reference is 'org-acme', revision is 'v2.3.1', scope reference is 'payments-api', data class is 'public', allowed targets are ['https://api.acme.com/payments', 'https://api.acme.com/refunds'], and here are the two contracts I need checked — let me know if any scope boundaries are violated.","exampleUseCases":[{"title":"Pre-release API contract compliance check","prompt":"Before we ship version 3.0 of our internal billing API, can you audit the scope boundaries? Owner ref is 'team-billing', revision is 'v3.0.0', scope ref is 'billing-service', data class is 'synthetic', allowed targets are ['https://billing.internal/invoices', 'https://billing.internal/charges'], and here are the 5 contracts that need reviewing."},{"title":"Detecting unauthorized target declarations","prompt":"I think one of our API contracts might be allowing targets outside its declared scope — can you compare the owner ref 'org-platform', revision 'v1.8.4', scope ref 'identity-scope', data class 'public', allowed targets ['https://auth.platform.io/token'], against these 3 contracts and flag any boundary violations?"},{"title":"CI pipeline contract scope validation","prompt":"As part of our automated deployment gate, verify the scope boundaries for owner 'squad-data', revision 'v2.1.0-rc1', scope ref 'data-pipeline-scope', data class 'synthetic', with allowed targets ['grpc://data.internal/ingest', 'https://data.internal/transform'], and check whether these 4 submitted contracts stay within bounds."}],"resultDescription":"Returns a structured audit result indicating whether each supplied contract's owner reference, revision, scope reference, and allowed targets are consistent with declared boundaries. Reports any mismatches at the HTTP path method/segment level and transport level for tool targets, with a receipt of the audit retained for 90 days.","failureModes":["Missing or invalid ownerRef causes request rejection","Revision string mismatch between contract and declared revision returns boundary violation","Contracts array exceeding 32 items or empty array returns validation error","dataClass not set to 'public' or 'synthetic' causes enum rejection","nonpersonalMetadata not set to true (const) causes request failure","Allowed targets array empty or exceeding 32 items triggers schema error","Malformed HTTP path segments in contracts cause parse failure"],"whenToPreferThis":"Choose this endpoint when you need exact, offline scope boundary verification of API contracts against declared owners, revisions, and allowed targets without any persistent storage of contract content. Ideal for CI/CD pipeline gates, pre-release compliance checks, or auditing whether API tool targets respect transport and path segment boundaries. Best suited for public or synthetic (non-personal) data classes where result retention of 24 hours is acceptable.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T00:51:54.258Z","isFirstParty":false,"canonicalSlug":"api-contracts-scope-boundary-audit-fdbdabde"}