Orchestrata Ultimate / RTM / 098-api-standards
RTM: 098-api-standards
Requirement to symbol to test rows for 098-api-standards: API Standards.
At a glance
| Item | Value |
|---|---|
| Requirement IDs | 96 |
Traced from src/ |
0 (0.0%) |
| Untraced | 96 |
Cited from tests/ |
0 (0.0%) |
Traced in src/ but not cited from tests/ |
0 |
Reading this matrix
This matrix lists each of the 96 requirement IDs of spec 098-api-standards with the src/ symbols that cite it and the tests that cite it. 0 of them (0.0%) have at least one citing symbol and 96 have none.
0 requirements are also cited from tests/, and 0 are traced in code but never named by a test. A test citation is a @traces on a test function; it shows intent to cover, not that the test runs or reaches the symbol.
Rows showing none in the symbols column are the gaps to close first. The densest untraced groups are REQ-098-* (96).
Requirement to symbols to tests
| Requirement | Symbols in src/ |
Tests citing it |
|---|---|---|
REQ-098-001 All API requests MUST include version information via URL path or header. |
none | none |
REQ-098-002 All API responses MUST include version metadata in the response header and body. |
none | none |
REQ-098-003 API versions within the same MAJOR version MUST maintain backward compatibility. |
none | none |
REQ-098-004 Breaking changes MUST trigger a MAJOR version increment. |
none | none |
REQ-098-005 Deprecated API versions MUST include Deprecation and Sunset headers for 90 days minimum. |
none | none |
REQ-098-006 All error responses MUST follow the defined JSON error schema with code, message, and... |
none | none |
REQ-098-007 Error codes MUST be categorized: AUTH, AUTHZ, VAL, RES, RATE, SYS. |
none | none |
REQ-098-008 All responses MUST include X-RateLimit-Limit, X-RateLimit-Remaining, and... |
none | none |
REQ-098-009 When rate limit is exceeded, API MUST return 429 with Retry-After header. |
none | none |
REQ-098-010 All API requests MUST include valid authentication credentials. |
none | none |
REQ-098-011 All POST/PUT requests MUST be validated against JSON schema. |
none | none |
REQ-098-012 All successful responses MUST include data and metadata objects. |
none | none |
REQ-098-013 List endpoints MUST support pagination with page, per_page parameters. |
none | none |
REQ-098-014 POST endpoints that create resources MUST support Idempotency-Key header. |
none | none |
REQ-098-015 GET responses MAY include ETag and Cache-Control headers. |
none | none |
REQ-098-016 All responses MUST include security headers (X-Content-Type-Options, X-Frame-Options). |
none | none |
REQ-098-017 All responses MUST include X-Request-ID header for tracing. |
none | none |
REQ-098-018 API MUST provide /api/v1/health endpoint for health monitoring. |
none | none |
REQ-098-019 WebSocket endpoints MUST support token-based authentication via query parameter. |
none | none |
REQ-098-020 WebSocket messages MUST use defined message types: subscribe, unsubscribe, event,... |
none | none |
REQ-098-021 All endpoints MUST be documented with OpenAPI 3.x specification. |
none | none |
REQ-098-022 API MUST support CORS for allowed origins. |
none | none |
REQ-098-023 Authentication failures MUST return HTTP 401 with the matching AUTH code: AUTH-001 for... |
none | none |
REQ-098-024 Authorization failures MUST return HTTP 403 with the matching AUTHZ code: AUTHZ-001... |
none | none |
REQ-098-025 Validation failures MUST return HTTP 422 with the matching VAL code: VAL-001 for a... |
none | none |
REQ-098-026 Resource failures MUST return the matching RES code and status: 404 with RES-001 when... |
none | none |
REQ-098-027 Rate-limiting failures MUST return HTTP 429 with the matching RATE code: RATE-001 when... |
none | none |
REQ-098-028 System failures MUST return the matching SYS code and status: 500 with SYS-001 for an... |
none | none |
REQ-098-101 P95 latency MUST be below 500ms for standard requests. |
none | none |
REQ-098-102 P99 latency MUST be below 1000ms for standard requests. |
none | none |
REQ-098-103 A response time header MUST be included in all responses. |
none | none |
REQ-098-104 The API MUST meet a 99.9% uptime target. |
none | none |
REQ-098-105 Rate limit enforcement MUST be provided with configurable tiers. |
none | none |
REQ-098-106 A circuit breaker MUST guard dependency failures. |
none | none |
REQ-098-107 The API MUST support 10x normal load. |
none | none |
REQ-098-108 Rate limiting MUST be enforced per endpoint. |
none | none |
REQ-098-109 Burst allowance MUST be handled. |
none | none |
REQ-098-110 HTTPS MUST be required for all endpoints. |
none | none |
REQ-098-111 API key authentication MUST be mandatory. |
none | none |
REQ-098-112 Security headers MUST be present on all responses. |
none | none |
REQ-098-113 Input validation MUST be applied to all requests. |
none | none |
REQ-098-029 Each integration MUST use the protocol and authentication listed for it: the Neo4j... |
none | none |
REQ-098-030 The API MUST expose GET /api/v{version}/resources/{id} to retrieve a specific... |
none | none |
REQ-098-031 The API MUST expose POST /api/v{version}/resources to create a new resource, taking... |
none | none |
REQ-098-032 The API MUST expose GET /api/v{version}/resources to list resources with pagination,... |
none | none |
REQ-098-033 The API MUST expose GET /ws/v{version}/agents as a WebSocket connection for... |
none | none |
REQ-098-034 For a client migrating to a new API version, API responses MUST include version... |
none | none |
REQ-098-035 For a developer handling API errors, all errors MUST return a consistent JSON format,... |
none | none |
REQ-098-036 For an API user approaching a rate limit, rate limit headers MUST be included in all... |
none | none |
REQ-098-037 For a WebSocket client maintaining a connection, the message types subscribe, event,... |
none | none |
REQ-098-038 A successful API response payload MUST be a JSON object carrying the required members... |
none | none |
REQ-098-039 An error response payload MUST be a JSON object carrying the required member error,... |
none | none |
REQ-098-040 The API MUST be built on the declared dependencies at or above the listed versions:... |
none | none |
REQ-098-041 API design approval MUST require an OpenAPI 3.x specification for every new endpoint,... |
none | none |
REQ-098-042 API access control MUST be governed by PAM++ policies, MUST apply role-based... |
none | none |
REQ-098-043 API versions MUST follow SemVer (MAJOR.MINOR.PATCH) with 1.0.0 as the current version,... |
none | none |
REQ-098-044 The API MUST accept the version indicator either as a URL path segment... |
none | none |
REQ-098-045 Deprecation MUST be notified a minimum of 90 days before removal, MUST carry... |
none | none |
REQ-098-046 The API version lifecycle MUST consist of the stages Development (version not yet... |
none | none |
REQ-098-047 The API MUST use the 2xx status codes as listed: 200 OK for a successful GET request,... |
none | none |
REQ-098-048 The API MUST use the 4xx status codes as listed: 400 Bad Request for invalid request... |
none | none |
REQ-098-049 The API MUST use the 5xx status codes as listed: 500 Internal Server Error for an... |
none | none |
REQ-098-050 Every error response body MUST carry an error object holding code, message,... |
none | none |
REQ-098-051 Error codes MUST be allocated inside their reserved category range: AUTH-001 to... |
none | none |
REQ-098-052 Rate limit tiers MUST be enforced as listed: Free at 60 requests/minute with burst 10... |
none | none |
REQ-098-053 Every response MUST include the rate limit headers X-RateLimit-Limit (requests... |
none | none |
REQ-098-054 A request that exceeds the rate limit MUST be answered with `HTTP/1.1 429 Too Many... |
none | none |
REQ-098-055 Per-endpoint rate limits MUST be enforced as listed: /api/v1/intent at 30/minute... |
none | none |
REQ-098-056 The API MUST use the content type application/json for JSON payloads,... |
none | none |
REQ-098-057 A paginated response MUST carry, alongside the data array, a pagination object... |
none | none |
REQ-098-058 Every request MUST carry the Authorization: Bearer {api_key}, `Content-Type:... |
none | none |
REQ-098-059 A client-to-server WebSocket message MUST carry type, channel and request_id,... |
none | none |
REQ-098-060 POST endpoints that create resources MUST support an optional Idempotency-Key... |
none | none |
REQ-098-061 An idempotent response MUST echo the idempotency_key in its metadata. |
none | none |
REQ-098-062 The API MUST use Cache-Control: no-cache, no-store, must-revalidate as its... |
none | none |
REQ-098-063 When a client re-requests a resource with If-None-Match carrying the ETag the server... |
none | none |
REQ-098-064 Responses MUST carry the standard security headers X-Content-Type-Options: nosniff,... |
none | none |
REQ-098-065 Cross-origin requests MUST be answered with the CORS headers... |
none | none |
REQ-098-066 Every response MUST carry the X-Response-Time header giving the request duration;... |
none | none |
REQ-098-067 GET /api/v1/health MUST return status, version, uptime and a checks object... |
none | none |
REQ-098-068 The API MUST use the HTTP method matching the operation (GET, POST, PUT, DELETE), MUST... |
none | none |
REQ-098-069 The API MUST apply consistent naming conventions, consistent error handling and... |
none | none |
REQ-098-070 The API MUST be secure by default: HTTPS MUST be required, authentication MUST be... |
none | none |
REQ-098-071 Each API endpoint MUST document its URL and method, required parameters, request body... |
none | none |
REQ-098-114 Contract testing MUST exercise all endpoints against the OpenAPI spec, MUST enforce... |
none | none |
REQ-098-115 Load testing MUST verify the 99.9% uptime target, P95 latency below 500ms, and... |
none | none |
REQ-098-116 Chaos testing MUST cover dependency failures, network partitions and cascading failures. |
none | none |
REQ-098-117 Component unit tests MUST cover all public interfaces, error conditions and edge... |
none | none |
REQ-098-118 Component integration tests MUST cover interactions with dependencies, data flow... |
none | none |
REQ-098-119 Load and stress tests MUST run under expected production load, under peak load... |
none | none |
REQ-098-120 CI/CD integration MUST run the tests on every commit, the performance tests nightly,... |
none | none |
REQ-098-121 Component logging MUST log all major operations at their log level, MUST include... |
none | none |
REQ-098-122 Performance metrics MUST include operation duration histograms, request/error rate... |
none | none |
REQ-098-123 Distributed tracing MUST propagate traces across component boundaries, MUST carry span... |
none | none |
REQ-098-124 Critical alerts MUST fire on error rate spikes, performance degradation, resource... |
none | none |
REQ-098-125 The operational dashboard MUST show real-time system health, performance trends, error... |
none | none |