0xcryptj API Contract Review
When to Use
Use this capability when a team has an OpenAPI or Swagger document and needs a safe inventory of endpoints plus limited evidence about authentication and server-side error handling.
Prerequisites
- An OpenAPI or Swagger JSON/YAML export.
- Authorization for the optional base URL probe.
- Test credentials only when the engagement explicitly requires authenticated validation.
Workflow
- Run
./agentsec api ./openapi.jsonto inventory the contract. - If authorized, add
--base-url https://staging.examplefor bounded read-only probes. - Review operations missing security declarations, server errors, and sensitive paths.
- Confirm object-level authorization in source or an approved test plan; a contract cannot prove it.
Verification
Verify the report includes every declared operation, the request cap, authorization state, and separate review-needed observations for behavior that cannot be proven from the contract.