# API Acceptance Test # API Acceptance Test | Field | Value | | --- | --- | | Distribution | BSS — OpenSOF | | Product | OpenSOF | | Release | 0.15.1 | | Deployment | `opensof.bss.dev` | | Source | `/srv/bss/releases/OpenSOF-v0.15.0-20app` | | Evidence | Static API inventory plus acceptance standard | | Source fingerprint | `cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e` | | Status | Generated baseline — human review required | > **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment. ## Scope Test the 11 REST/HTTP and 8 WebSocket candidates identified by the static scan, then publish only verified interfaces as authoritative. ## Per-endpoint test matrix | Test | Expected | | --- | --- | | Authorized valid request | Documented success status and schema. | | Unauthenticated request | Rejected without data leakage. | | Authenticated but unauthorized | 403/policy rejection and audit event. | | Malformed/invalid data | Deterministic validation error; no crash/partial mutation. | | Duplicate/retry | Idempotent result or explicitly documented duplicate behavior. | | Rate/size/timeout boundary | Controlled rejection/backpressure and observable metric/log. | | Dependency failure | Safe error, no secret/stack leakage, recovery after dependency returns. | | Audit/correlation | Actor, action, target, outcome and correlation ID present. | ## Evidence record ```text Endpoint and release: Authentication role: Request (secrets removed): Expected status/schema: Actual status/schema: Latency/size: Audit/correlation ID: Pass/fail and defect/task: Tester/date: ``` --- ## Maintainer Notes Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.