Ramp Sandbox Contract Tests and CI Gates

Overview

Separate fast deterministic contract checks from credentialed sandbox smoke tests. CI should reject schema drift and unsafe production targeting without making financial writes or depending on mutable live data.

Prerequisites

• Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary.
• Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation.
• Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved.
• Prepare approved secret storage and a sanitized evidence location.

Current Contract

• Ramp publishes a canonical OpenAPI document for the Developer API and machine-readable guide exports for current behavior.
• The sandbox is isolated from production and cannot move real money; its current API host is https://demo-api.ramp.com.
• Credentialed checks still require the minimum OAuth scopes, and production credentials do not belong in pull-request jobs.
• Unknown fields may be ignored by some endpoints and rejected by others, so request fixtures must be validated against the exact endpoint schema.