API Acceptance Test
API Acceptance Test
| Field | Value |
|---|---|
| Distribution | BSS — OpenSOF |
| Product | OpenSOF |
| Release | 0.15.1 |
| Deployment | opensof.bss.dev |
| Source | /srv/bss/releases/OpenSOF-v0.15.0-20app |
| Evidence | Static API inventory plus acceptance standard |
| Source fingerprint | cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e |
| Status | Generated baseline — human review required |
Verification boundary: This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.
Scope
Test the 11 REST/HTTP and 8 WebSocket candidates identified by the static scan, then publish only verified interfaces as authoritative.
Per-endpoint test matrix
| Test | Expected |
|---|---|
| Authorized valid request | Documented success status and schema. |
| Unauthenticated request | Rejected without data leakage. |
| Authenticated but unauthorized | 403/policy rejection and audit event. |
| Malformed/invalid data | Deterministic validation error; no crash/partial mutation. |
| Duplicate/retry | Idempotent result or explicitly documented duplicate behavior. |
| Rate/size/timeout boundary | Controlled rejection/backpressure and observable metric/log. |
| Dependency failure | Safe error, no secret/stack leakage, recovery after dependency returns. |
| Audit/correlation | Actor, action, target, outcome and correlation ID present. |
Evidence record
Endpoint and release:
Authentication role:
Request (secrets removed):
Expected status/schema:
Actual status/schema:
Latency/size:
Audit/correlation ID:
Pass/fail and defect/task:
Tester/date:
Maintainer Notes
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.