Validate API responses against schemas to ensure contract compliance and data integrity. Use when ensuring API response correctness. Trigger with phrases like "validate responses", "check API responses", or "verify response format".
npxskills add jeremylongshore/claude-code-plugins-plus-skills--skill validating-api-responsesLoading…
Validate API responses against OpenAPI schemas, JSON Schema definitions, and contract specifications to detect data integrity violations, schema drift, and backward compatibility regressions. Run validation in middleware (development/staging) or as post-deployment contract tests to ensure every response conforms to the documented API contract.
additionalProperties: false) to detect undocumented fields leaking into responses.strict (fail on violation) in development/staging, warn (log only) in production, with violation metrics emitted for monitoring.See ${CLAUDE_SKILL_DIR}/references/implementation.md for the full implementation guide.
${CLAUDE_SKILL_DIR}/src/middleware/response-validator.js - Response schema validation middleware${CLAUDE_SKILL_DIR}/src/validators/ - Compiled JSON Schema validators per endpoint${CLAUDE_SKILL_DIR}/tests/contract/ - Contract test suite validating all endpoint responses${CLAUDE_SKILL_DIR}/reports/validation-coverage.md - Schema coverage report per endpoint and status code${CLAUDE_SKILL_DIR}/reports/schema-drift.json - Detected undocumented response field changes${CLAUDE_SKILL_DIR}/src/config/validation.js - Per-environment validation strictness configuration| Error | Cause | Solution |
|---|---|---|
| Additional property detected | Response contains field not defined in schema | Add field to schema if intentional; remove from serializer if data leak; configure additionalProperties |
| Type mismatch | Field returns string instead of documented integer (or vice versa) | Fix serializer to match schema type; add type coercion test; check ORM field mapping |
| Required field missing | Response omits a field marked required in schema | Verify database query includes the field; check conditional serialization logic |
| Null value on non-nullable | Field returns null but schema does not include nullable: true | Update schema to allow null, or fix data source to guarantee non-null values |
| Format validation failure | Date field does not match RFC 3339 format or email field format invalid | Apply format serialization at the ORM/model level before response construction |
Refer to ${CLAUDE_SKILL_DIR}/references/errors.md for comprehensive error patterns.
CI contract gate: On every pull request, run contract tests that validate all endpoint responses against the OpenAPI spec, failing the build if any response violates the documented schema.
Production response sampling: In production, validate 5% of responses against schemas (sampled randomly), emitting response_validation_failure metrics to detect schema drift caused by data changes.
Backward compatibility check: Compare v1 and v2 response schemas to verify that v2 is a superset of v1 (no removed fields, no type changes), ensuring existing consumers are not broken.
See ${CLAUDE_SKILL_DIR}/references/examples.md for additional examples.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Transcribe audio via OpenAI Audio Transcriptions API (Whisper).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Transcribe audio via OpenAI Audio Transcriptions API (Whisper).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.