Protect API Contracts

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-coder-api-contracts-creators

1. What is the primary purpose of an API contract?

   1. To specify exactly which programming language must be used
   2. To guarantee a consistent interface and behavior other code can depend on
   3. To prevent users from making too many requests
   4. To document every possible error message the API might produce

2. Why should an API validate incoming input data?

   1. Validation is only necessary for user passwords and payment data
   2. AI models already handle all invalid input automatically
   3. It prevents the API from accepting requests that could cause crashes or security issues
   4. Validation makes the API run faster

3. What downstream problem can occur when an API changes its response shape unexpectedly?

   1. The API automatically rate-limits the client
   2. Client applications that parse the response may break
   3. The database connection becomes slower
   4. The API server runs out of memory

4. What is the main benefit of writing contract tests for an API?

   1. They automatically generate documentation for users
   2. They make the API run faster
   3. They verify that the interface remains consistent even after code changes
   4. They replace the need for any other testing

5. When an API receives invalid input, what should it return?

   1. A 200 OK status with a generic error message
   2. A 500 Internal Server Error to hide the problem
   3. The raw data the user sent back as-is
   4. A 400 Bad Request with clear, consistent information about what was wrong

6. Which of the following represents a stable error format that API consumers can depend on?

   1. Errors that include full database stack traces for debugging
   2. A consistent object with 'error' and 'message' fields that always appears
   3. Returning different error structures depending on which internal function failed
   4. A random error format chosen each time the API is updated

7. What does it mean for code to be 'observable'?

   1. The code runs without any errors
   2. The source code is publicly available
   3. The system produces logs and metrics that reveal its internal state and behavior
   4. The code is well-commented for future developers

8. What does 'reversible' mean in the context of deploying AI-generated code?

   1. The AI can reverse-engineer the original requirements
   2. The code can be compiled to run on any operating system
   3. The code can read data in both directions
   4. You can easily undo the change and return to a working state if problems occur

9. Which type of data should an API never expose to external users?

   1. Internal system details like database table names, stack traces, or configuration paths
   2. The HTTP status code of the response
   3. The version number of the API
   4. Error messages that help users understand what went wrong

10. What is the best way to prove that a code change actually works as intended?

    1. Running the code yourself and confirming it doesn't crash
    2. Asking another developer to review the code visually
    3. Writing tests that verify the specific behavior before deploying
    4. Assuming it works because the AI generated it

11. What is the 'happy path' in API development?

    1. The path users take when they are satisfied with the API
    2. The ideal execution flow when everything works correctly with valid input
    3. A special error-handling routine for critical failures
    4. The code path that handles invalid input gracefully

12. Why should API response shapes be kept consistent rather than changed casually?

    1. JSON format doesn't allow changes to structure
    2. The API will run faster with consistent shapes
    3. Consistent shapes are required by HTTP protocol
    4. Code that depends on the API will break if the shape changes

13. According to best practices, what should you define BEFORE selecting a tool to solve a coding problem?

    1. The specific library or framework you will use
    2. The name of the developer who will write the code
    3. The exact output you want the code to produce
    4. The budget for purchasing tools

14. Why is it important to inspect the diff before sharing AI-generated code?

    1. The diff must be approved by a lawyer
    2. To make the code look prettier
    3. Diff inspection is only required for open-source projects
    4. To catch unintended changes, data access patterns, or problematic failure handling

15. Why is the failure path as important to test as the success path?

    1. Failure paths are executed more frequently in production
    2. Success paths cannot be tested automatically
    3. Failure paths require less code to write
    4. Users encounter errors and need clear feedback; broken error handling can expose data or crash systems