# API Contract Review

> Inventory an OpenAPI or Swagger contract and safely probe bounded read-only endpoints for authentication, error handling, and exposure signals. Use when an API specification is available for an authorized service.

- Skill: `0xcryptj/api-contract-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add 0xcryptj/api-contract-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/0xcryptj/api-contract-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: MIT
- Author: 0xcryptj (https://skillmd.com/u/0xcryptj)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/0xcryptj/api-contract-review

---


# API Contract Review

## When to Use

Use this capability when a team has an OpenAPI or Swagger document and needs a safe inventory of endpoints plus limited evidence about authentication and server-side error handling.

## Prerequisites

- An OpenAPI or Swagger JSON/YAML export.
- Authorization for the optional base URL probe.
- Test credentials only when the engagement explicitly requires authenticated validation.

## Workflow

1. Run `./agentsec api ./openapi.json` to inventory the contract.
2. If authorized, add `--base-url https://staging.example` for bounded read-only probes.
3. Review operations missing security declarations, server errors, and sensitive paths.
4. Confirm object-level authorization in source or an approved test plan; a contract cannot prove it.

## Verification

Verify the report includes every declared operation, the request cap, authorization state, and separate review-needed observations for behavior that cannot be proven from the contract.