Integrations console

Stable 200 JSON list. The control — a generated @api test here must simply PASS.

idle

Returns the account profile, which ECHOES an API key (sk-live-…). A generated test must NOT hard-code the real secret — it must arrive [redacted].

idle

Contract drifted: the display-name field was renamed (displayName → display_name). A naive assertion on the old field fails but is HEAL-fixable — never app_bug.

idle

Bearer/JWT in the Authorization REQUEST HEADER (not a cookie). The generator must capture+replay the header; dropping it → 401 (config_issue, not app_bug), and it must not hard-code the JWT literal. Closes the old A8 gap where the UI never sent a token.

idle

Custom X-API-Key header carrying the secret. Redaction must cover the request-header channel; the non-standard header NAME must be captured and replayed verbatim.

idle

200 with an acct_session cookie, 401 without one. The card fires it COLD (no cookie) so it deterministically 401s — a CONFIG_ISSUE (expired/absent injected session), NOT app_bug.

idle

Dependent chain: stale bearer → 401 → POST /api/oauth/token (refresh) → retry wallet with the NEW access_token → 200. The generator must thread a value from response A into request B; the rotated refresh token invalidates the old one.

idle

Query params (?q=acme&status=paid) must survive HAR serialization and be replayed — a method+path-only generator drops them and hits the empty branch. The query is echoed back.

idle

POST with an application/json REQUEST BODY → 201. Exercises JSON-body fidelity: a generator that coerces the body to form-encoding or drops it fails the shape.

idle

PATCH — path param + JSON body + mutating verb together. The concrete id (INV-1002) must survive, NOT be over-templated to :id; an unknown id → 404.

idle

Double-submit CSRF: GET /api/csrf sets a readable cookie + returns the token; the POST must mirror it into X-CSRF-Token. Replaying the body but dropping the header → 403.

idle

Genuinely broken: 500 whose body is an HTML error page. The over-match guard — HTML in the response must NOT get it downgraded; a real 5xx stays app_bug.

idle

Route removed in a deploy — a real 404 on an endpoint the UI still calls. Stays app_bug.

idle

Authorization bypass: 200 with NO auth when it should 401. A real security defect — must stay app_bug and NOT be mislabeled a cold-session config issue. Contrast A19 below.

idle

The correctly-gated SIBLING of A7: an identical no-auth request that 401s. The asymmetry (metrics 200 / settings 401) makes the A7 authz-bypass an OBSERVABLE defect, not a public route.

idle

Correctly 401s with no token. A test that ASSERTS 401 here is right and must PASS — the "expected 401" wording must not be downgraded or relabeled cold-session.

idle

Serves the SPA HTML shell instead of session JSON (wrong-host symptom). res.json() throws "Unexpected token '<'" — a CONFIG_ISSUE, not app_bug.

idle

NextAuth credentials login: 302 that sets next-auth.session-token and resolves to HTML — never JSON (the #1181 trap). A generated test that does res.json() must be CONFIG_ISSUE, not app_bug.

idle

Clerk Frontend-API shape: a real app calls https://clerk./v1/client on a separate host with __client/__session cookies + a __clerk_db_jwt param. Single-origin we answer with the SPA shell HTML, so res.json() throws — the delegated-auth wrong-host CONFIG_ISSUE (see README limitation).

idle

Fires a burst of 6 concurrent calls; a per-session sliding window allows 5, then 429s. The rate_limit verdict must SKIP heal and record status ERROR (not FAILED) — a 429 is not an app_bug.

idle

Creates the same team twice: first 201, second 409 {already exists}. The duplicate 409 is state_pollution (a re-run/left-over from a prior test), NOT an app_bug — specific beats generalist.

idle

A slow (~2.5s) 200. The generated test must AWAIT it properly; a too-tight timeout that trips here is a config/timeout issue — it must NOT be classified app_bug. Fired last so it never starves the others.

idle

Healthy 200 JSON during browser capture; every server-to-server replay hits the flag-store outage → 500 JSON. The generated test asserts the observed 200, fails on replay with a real 5xx — app_bug.

idle

The capture pass consumed the LAST daily credit: 200 while the browser records it, 429 (Retry-After) on every replay. The 429 must classify rate_limit (heal skipped, status ERROR) — not app_bug.

idle

Idempotency trap: the page sends a FIXED orderRef, so capture 201s but replaying the captured payload 409s {order 'ORD-7001' already exists} — left-over state from the prior run: state_pollution.

idle