Verify API shape

A green test suite proves nothing about an external API when the fixtures were hand-written. Fabricated fixtures encode a contract the API does not implement, so every guard passes in CI and the path refuses (or misbehaves) in production forever.

Real case: 278 passing tests, a reviewed and merged feature, and the code path could never succeed. It read three field names the API does not send.

When to run this

• Code reads named fields off an external API response.
• A path "works" in tests but is reported as always refusing or never firing.
• Before marking any task done that consumes an external record.
• A plan or PR asserts "the API returns X".

Procedure

1. Capture a real response first

Run a read-only GET against a non-production environment. Never reason from the fixture, the Swagger, or memory. If the endpoint has no documented response schema, that is itself a finding to report.