Search docs
Docs searchValidation category
API Contract Rules
Review implemented validation rules for API contract setup, OpenAPI evidence, and GraphQL path configuration.
API contract findings help teams keep externally visible service contracts present and discoverable before deeper API design rules run.
Overview
Review implemented validation rules for API contract setup, OpenAPI evidence, and GraphQL path configuration.
API contract findings help teams keep externally visible service contracts present and discoverable before deeper API design rules run.
Why it matters
Cloud uses this guidance to help teams interpret local validation findings in organization context without turning the docs into implementation notes.
When this domain drifts, findings become harder to triage, ownership becomes less clear, and architecture review depends too much on individual memory.
Good architectural practices
- OpenAPI contract files present where validation expects them.
- GraphQL paths configured consistently with the repository layout.
- API setup evidence that supports CI review and Cloud finding context.
Common anti-patterns
- OpenAPI contract exists
- GraphQL endpoint documented in OpenAPI
Relationship to other architecture areas
This domain usually overlaps with neighboring validation categories. Use the related pages below to understand the adjacent architecture concerns before changing policy, suppressing a finding, or accepting risk.
Implemented rules
These are the currently implemented rules in this category. Use this table for category-level orientation, then open the Rule Catalog when you need rule-specific examples and remediation guidance.
| Rule ID | Rule title | Category | Severity | Short explanation | Example violation | Remediation guidance | Rule detail |
|---|---|---|---|---|---|---|---|
| AP-API-001 | OpenAPI contract exists | API | error | Checks that an OpenAPI contract is present for REST API review. | REST controllers exist but contracts/openapi.yaml is missing. | Generate or restore the OpenAPI contract. Update the configured contract path if the file moved. Commit the contract or generated artifact according to your team workflow. | View rule page |
| AP-API-002 | GraphQL endpoint documented in OpenAPI | API | error | Checks that GraphQL endpoint exposure is documented when OpenAPI is used as the API review artifact. | /graphql is mounted in code but absent from the API contract. | Document the GraphQL endpoint in the API contract. Regenerate the OpenAPI artifact if it is generated. Add review notes for schema compatibility if GraphQL schema files live separately. | View rule page |
Related pages
Next steps