API schema definition exists
Why it matters
An API with no machine-readable schema has no contract. Every consumer must read the implementation source to understand request/response shapes — and when the implementation changes, there is no diff to review, no tooling to catch regressions, and no artifact to share with third-party integrators. iso-25010:2011 compatibility.interoperability and maintainability.analysability both fail: the API cannot be consumed reliably by any party without deep implementation access. SDK generation, mock servers, and contract testing are all impossible without a schema.
Severity rationale
Critical because without a machine-readable schema, the API has no enforceable contract, making all consumer integrations fragile and all tooling (SDK gen, mock servers, contract tests) inaccessible.
Remediation
Add a machine-readable schema. The fastest path depends on your framework. For Express/Hono, create openapi.yaml or use @asteasolutions/zod-to-openapi to generate from existing Zod schemas. For FastAPI, verify /docs is accessible — it's auto-generated. For NestJS, install @nestjs/swagger.
# openapi.yaml -- minimal starting point:
openapi: "3.1.0"
info:
title: "Your API"
version: "1.0.0"
paths:
/api/v1/users:
get:
summary: "List users"
responses:
"200":
description: "Success"
For GraphQL, enable introspection: true in development and export the SDL. For gRPC, your .proto files are the schema — ensure they are committed and up to date.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the API Design Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · compatibility.interoperability — Interoperability — machine-readable schema enables tooling and consumer integration
- iso-25010:2011 · maintainability.analysability
Taxons
History
- 2026-04-18·v1.0.0·Initial import from api-design·automated