{ "openapi": "3.1.0", "info": { "title": "API From Hell", "version": "1.0.0", "description": "A deliberately awkward API for checking how REST clients display bad responses." }, "servers": [ { "url": "https://apichallenges.com", "description": "current request" }, { "url": "https://apichallenges.eviltester.com", "description": "cloud hosted version" }, { "url": "http://localhost:4567", "description": "local execution" } ], "paths": { "/fromhell/status": { "get": { "tags": [ "API From Hell" ], "summary": "Status - Markdown Documentation", "description": "Markdown status text describing the intentionally awkward response set.\n\nWhat is wrong: This is a good response, but it is markdown rather than JSON or XML.\n\nWhat to check in your client: A REST client should show the response body as text/markdown and make the content type visible.", "operationId": "getFromHellstatus", "responses": { "200": { "description": "Status - Markdown Documentation", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/markdown" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/markdown": { "schema": { "type": "string" }, "example": "# Mock API From Hell\n\nAn API designed to test and evaluate REST Clients.\n\n- Do the REST Clients help spot the errors?\n- Are error messages readable and helpful?\n- Do the REST Clients flag errors automatically?\n\nAPI Should have a Swagger file to make it easy to import into clients.\n\nUser should be able to execute requests quickly and spot obvious issues.\n\n## Errors covered\n\n- No Error\n - [x] good endpoints to cover main content types to check REST Client can render and handle them\n- Additional Content Formats\n - [x] Plain text\n - [x] HTML\n - [x] CSV\n - [x] YAML\n - [x] Form URL encoded\n - [x] Octet stream\n- Missing Content-Type\n - [x] JSON body without Content-Type\n - [x] XML body without Content-Type\n - [x] HTML body without Content-Type\n- API Returns malformed JSON\n - [x] Missing final collection terminator\n - [x] Trailing comma in array\n - [x] Trailing comma in object\n - [x] Unquoted key\n - [x] Single quoted string\n - [x] Bad escape sequence\n - [x] Truncated string\n - [x] Extra data after document\n - [x] Missing colon\n - [x] Leading zero number\n - [x] NaN value\n - [x] Unclosed object\n - [x] Raw control character\n- Problematic JSON\n - [x] Duplicate keys\n - [x] Large integer\n - [x] High precision decimal\n - [x] Exponent number\n - [x] Null vs missing field\n - [x] Escaped Unicode\n - [x] Empty object\n - [x] Top-level string\n - [x] Top-level number\n - [x] Top-level boolean\n - [x] Top-level null\n - [x] Empty body with JSON content type\n - [x] UTF-8 BOM prefix\n - [x] NDJSON\n- API Returns malformed XML\n - [x] Missing final root element closure\n - [x] Mismatched tag\n - [x] Unescaped ampersand\n - [x] Duplicate attribute\n - [x] Undefined entity\n - [x] Multiple root elements\n - [x] Missing attribute quote\n - [x] Unclosed CDATA\n - [x] Invalid character\n - [x] Truncated document\n - [x] Bad processing instruction\n- Problematic XML\n - [x] Attributes vs elements\n - [x] Empty vs missing vs nil\n - [x] Whitespace significant text\n - [x] CDATA content\n - [x] Mixed content\n - [x] Processing instruction\n - [x] Comments\n - [x] Encoding declaration mismatch\n - [x] DOCTYPE and DTD\n - [x] Empty body with XML content type\n - [x] UTF-8 BOM prefix\n- API Returns mismatched content-type e.g. content-type xml, but is json\n - [x] json-xml\n - [x] xml-json\n- Status code semantic mismatches\n - [x] 201 with no Location header\n - [x] 3xx with no redirect Location\n - [x] 204 with content\n - [x] 205 with content\n - [x] 304 with content\n - [x] 206 without Content-Range\n - [x] 401 without WWW-Authenticate\n - [x] 405 without Allow\n - [x] 416 without Content-Range\n - [x] 200 with error body\n - [x] 500 with success body\n" } } } } } }, "/fromhell/version": { "get": { "tags": [ "API From Hell" ], "summary": "Version - Missing Content-Type Header", "description": "Returns a small JSON-looking version payload.\n\nWhat is wrong: No content type header is explicitly set for the response.\n\nWhat to check in your client: A REST client should still show the raw body and make the missing or defaulted content type obvious.", "operationId": "getFromHellversion", "responses": { "200": { "description": "Version - Missing Content-Type Header", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/good/json": { "get": { "tags": [ "API From Hell" ], "summary": "Good JSON - Valid JSON And Content-Type", "description": "Returns valid JSON with a matching application/json content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the control sample.\n\nWhat to check in your client: A REST client should format or inspect this as valid JSON.", "operationId": "getFromHellgood_json", "responses": { "200": { "description": "Good JSON - Valid JSON And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}]" } } } } } }, "/fromhell/good/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Good XML - Valid XML And Content-Type", "description": "Returns valid XML with a matching application/xml content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the XML control sample.\n\nWhat to check in your client: A REST client should format or inspect this as valid XML.", "operationId": "getFromHellgood_xml", "responses": { "200": { "description": "Good XML - Valid XML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n <1>\r\n e88067f0-b028-4310-8a33-8cbc03203249\r\n Modesto_Reichel61\r\n \r\n <2>\r\n fee23d87-721f-4ffa-a598-e350e13385b2\r\n Abagail_Shanahan\r\n \r\n <3>\r\n 987fc185-7cc6-4883-a5f4-3273b1045155\r\n Joaquin_Funk12\r\n \r\n <4>\r\n 0c2744bb-881a-41c0-a577-603b052485d9\r\n Maverick.Corkery74\r\n \r\n " } } } } } }, "/fromhell/good/text": { "get": { "tags": [ "API From Hell" ], "summary": "Good Text - Plain Text And Content-Type", "description": "Returns plain text with a matching text/plain content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the plain text control sample.\n\nWhat to check in your client: A REST client should show the response as readable text and make the content type visible.", "operationId": "getFromHellgood_text", "responses": { "200": { "description": "Good Text - Plain Text And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "API From Hell plain text response.\nLine two keeps this as normal text." } } } } } }, "/fromhell/good/html": { "get": { "tags": [ "API From Hell" ], "summary": "Good HTML - Valid HTML And Content-Type", "description": "Returns simple HTML with a matching text/html content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the HTML control sample.\n\nWhat to check in your client: A REST client should make it clear whether it is showing rendered HTML or raw HTML.", "operationId": "getFromHellgood_html", "responses": { "200": { "description": "Good HTML - Valid HTML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/html" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/html": { "schema": { "type": "string" }, "example": "API From Hell

HTML response

This is valid HTML.

" } } } } } }, "/fromhell/good/csv": { "get": { "tags": [ "API From Hell" ], "summary": "Good CSV - Valid CSV And Content-Type", "description": "Returns small comma-separated data with a matching text/csv content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the CSV control sample.\n\nWhat to check in your client: A REST client should show the raw CSV and, if supported, provide a readable table view.", "operationId": "getFromHellgood_csv", "responses": { "200": { "description": "Good CSV - Valid CSV And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/csv" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/csv": { "schema": { "type": "string" }, "example": "id,name,active\n1,Alice,true\n2,Bob,false\n" } } } } } }, "/fromhell/good/yaml": { "get": { "tags": [ "API From Hell" ], "summary": "Good YAML - Valid YAML And Content-Type", "description": "Returns a small YAML document with a matching application/yaml content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the YAML control sample.\n\nWhat to check in your client: A REST client should preserve indentation and make the YAML media type visible.", "operationId": "getFromHellgood_yaml", "responses": { "200": { "description": "Good YAML - Valid YAML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/yaml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/yaml": { "schema": { "type": "string" }, "example": "name: API From Hell\nitems:\n - id: 1\n active: true\n - id: 2\n active: false\n" } } } } } }, "/fromhell/good/form-urlencoded": { "get": { "tags": [ "API From Hell" ], "summary": "Good Form URL Encoded - Valid Form Body And Content-Type", "description": "Returns URL-encoded key/value data with a matching application/x-www-form-urlencoded content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the form-urlencoded control sample.\n\nWhat to check in your client: A REST client should show the raw encoded body and ideally decode the key/value pairs clearly.", "operationId": "getFromHellgood_form_urlencoded", "responses": { "200": { "description": "Good Form URL Encoded - Valid Form Body And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/x-www-form-urlencoded" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "string" }, "example": "name=Alice+Example&role=admin&active=true" } } } } } }, "/fromhell/good/octet-stream": { "get": { "tags": [ "API From Hell" ], "summary": "Good Octet Stream - Binary-Looking Body And Content-Type", "description": "Returns a small binary-looking payload with an application/octet-stream content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the octet-stream control sample.\n\nWhat to check in your client: A REST client should make it clear whether it is showing bytes, text, or offering a download.", "operationId": "getFromHellgood_octet_stream", "responses": { "200": { "description": "Good Octet Stream - Binary-Looking Body And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/octet-stream" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/octet-stream": { "schema": { "type": "string" }, "example": "API-FROM-HELL-BYTES:\u0000\u0001\u0002END" } } } } } }, "/fromhell/missing-content-type/json": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - JSON Body", "description": "Returns a JSON body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like JSON but the server does not declare application/json.\n\nWhat to check in your client: A REST client should show that the content type is missing and avoid hiding how it inferred the format.", "operationId": "getFromHellmissing_content_type_json", "responses": { "200": { "description": "Missing Content-Type - JSON Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/missing-content-type/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - XML Body", "description": "Returns an XML body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like XML but the server does not declare application/xml.\n\nWhat to check in your client: A REST client should show that the content type is missing and avoid hiding how it inferred the format.", "operationId": "getFromHellmissing_content_type_xml", "responses": { "200": { "description": "Missing Content-Type - XML Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/missing-content-type/html": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - HTML Body", "description": "Returns an HTML body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like HTML but the server does not declare text/html.\n\nWhat to check in your client: A REST client should show that the content type is missing and make rendered-vs-raw behavior obvious.", "operationId": "getFromHellmissing_content_type_html", "responses": { "200": { "description": "Missing Content-Type - HTML Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/malformed/json": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Missing Collection Terminator", "description": "Returns a JSON array that starts correctly but never closes the collection.\n\nWhat is wrong: The body is malformed JSON even though the status is 200 and content type says application/json.\n\nWhat to check in your client: A REST client should show a parse/formatting failure and still make the raw body available.", "operationId": "getFromHellmalformed_json", "responses": { "200": { "description": "Malformed JSON - Missing Collection Terminator", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}" } } } } } }, "/fromhell/malformed/json/trailing-comma-array": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Trailing Comma In Array", "description": "Returns a JSON array with a trailing comma before the closing bracket.\n\nWhat is wrong: JSON does not allow a trailing comma after the final array item.\n\nWhat to check in your client: A REST client should show that JSON parsing failed and still make the raw body available.", "operationId": "getFromHellmalformed_json_trailing_comma_array", "responses": { "200": { "description": "Malformed JSON - Trailing Comma In Array", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":1,\"name\":\"first\"},]" } } } } } }, "/fromhell/malformed/json/trailing-comma-object": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Trailing Comma In Object", "description": "Returns a JSON object with a trailing comma before the closing brace.\n\nWhat is wrong: JSON does not allow a trailing comma after the final object property.\n\nWhat to check in your client: A REST client should flag the parse failure near the end of the object.", "operationId": "getFromHellmalformed_json_trailing_comma_object", "responses": { "200": { "description": "Malformed JSON - Trailing Comma In Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"name\":\"first\",}" } } } } } }, "/fromhell/malformed/json/unquoted-key": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Unquoted Object Key", "description": "Returns an object where the property name is not wrapped in double quotes.\n\nWhat is wrong: JSON object keys must be double-quoted strings.\n\nWhat to check in your client: A REST client should not treat JavaScript object literal syntax as valid JSON.", "operationId": "getFromHellmalformed_json_unquoted_key", "responses": { "200": { "description": "Malformed JSON - Unquoted Object Key", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{id:1,\"name\":\"first\"}" } } } } } }, "/fromhell/malformed/json/single-quoted-string": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Single Quoted String", "description": "Returns JSON-looking data using single quotes for strings.\n\nWhat is wrong: JSON strings must use double quotes, not single quotes.\n\nWhat to check in your client: A REST client should distinguish JSON from JavaScript-like object notation.", "operationId": "getFromHellmalformed_json_single_quoted_string", "responses": { "200": { "description": "Malformed JSON - Single Quoted String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{'id':1,'name':'first'}" } } } } } }, "/fromhell/malformed/json/bad-escape": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Bad Escape Sequence", "description": "Returns a string with an unsupported escape sequence.\n\nWhat is wrong: JSON allows only specific escape sequences; \\q is not valid.\n\nWhat to check in your client: A REST client should show where the bad escape sequence breaks parsing.", "operationId": "getFromHellmalformed_json_bad_escape", "responses": { "200": { "description": "Malformed JSON - Bad Escape Sequence", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"path\":\"C:\\temp\\q\"}" } } } } } }, "/fromhell/malformed/json/truncated-string": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Truncated String", "description": "Returns an object with a string value that never closes.\n\nWhat is wrong: The response ends before the string terminator is present.\n\nWhat to check in your client: A REST client should make it clear that the body was incomplete or truncated.", "operationId": "getFromHellmalformed_json_truncated_string", "responses": { "200": { "description": "Malformed JSON - Truncated String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"unterminated}" } } } } } }, "/fromhell/malformed/json/extra-data-after-document": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Extra Data After Document", "description": "Returns one complete JSON object followed by another value.\n\nWhat is wrong: A JSON response body should contain one complete JSON document, not extra data after it.\n\nWhat to check in your client: A REST client should show that the first object parsed but unexpected data follows.", "operationId": "getFromHellmalformed_json_extra_data_after_document", "responses": { "200": { "description": "Malformed JSON - Extra Data After Document", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"ok\":true} {\"extra\":true}" } } } } } }, "/fromhell/malformed/json/missing-colon": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Missing Colon", "description": "Returns an object property without the colon between key and value.\n\nWhat is wrong: JSON object members require a colon between the name and value.\n\nWhat to check in your client: A REST client should identify the structural syntax error.", "operationId": "getFromHellmalformed_json_missing_colon", "responses": { "200": { "description": "Malformed JSON - Missing Colon", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\" \"hello\"}" } } } } } }, "/fromhell/malformed/json/leading-zero-number": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Leading Zero Number", "description": "Returns a numeric value with a leading zero.\n\nWhat is wrong: JSON numbers cannot use leading zeroes like 01.\n\nWhat to check in your client: A REST client should reject the number rather than silently accepting non-standard JSON.", "operationId": "getFromHellmalformed_json_leading_zero_number", "responses": { "200": { "description": "Malformed JSON - Leading Zero Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"count\":01}" } } } } } }, "/fromhell/malformed/json/nan-value": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - NaN Value", "description": "Returns NaN as a value in a JSON-looking object.\n\nWhat is wrong: NaN is not a valid JSON number or literal.\n\nWhat to check in your client: A REST client should not silently accept JavaScript-only numeric values as JSON.", "operationId": "getFromHellmalformed_json_nan_value", "responses": { "200": { "description": "Malformed JSON - NaN Value", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"value\":NaN}" } } } } } }, "/fromhell/malformed/json/unclosed-object": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Unclosed Object", "description": "Returns an object that never closes with a final brace.\n\nWhat is wrong: The JSON object starts correctly but the closing brace is missing.\n\nWhat to check in your client: A REST client should report the incomplete object and preserve the raw response.", "operationId": "getFromHellmalformed_json_unclosed_object", "responses": { "200": { "description": "Malformed JSON - Unclosed Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"name\":\"open\"" } } } } } }, "/fromhell/malformed/json/control-character": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Raw Control Character", "description": "Returns a string containing a raw control character.\n\nWhat is wrong: JSON strings cannot contain unescaped control characters.\n\nWhat to check in your client: A REST client should show that the body is not valid JSON and still allow raw inspection.", "operationId": "getFromHellmalformed_json_control_character", "responses": { "200": { "description": "Malformed JSON - Raw Control Character", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"bad\u0001control\"}" } } } } } }, "/fromhell/problematic/json/duplicate-keys": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Duplicate Keys", "description": "Returns valid JSON syntax with the same object key repeated.\n\nWhat is wrong: Duplicate object keys are ambiguous because parsers disagree on whether the first or last value wins.\n\nWhat to check in your client: A REST client should make duplicate keys visible or warn that values may be overwritten.", "operationId": "getFromHellproblematic_json_duplicate_keys", "responses": { "200": { "description": "Problematic JSON - Duplicate Keys", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"id\":2,\"name\":\"duplicate key example\"}" } } } } } }, "/fromhell/problematic/json/large-integer": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Large Integer", "description": "Returns an integer larger than JavaScript can safely represent exactly.\n\nWhat is wrong: Large JSON numbers can lose precision in clients that store all numbers as floating point values.\n\nWhat to check in your client: A REST client should display the exact raw value and avoid silently rounding it.", "operationId": "getFromHellproblematic_json_large_integer", "responses": { "200": { "description": "Problematic JSON - Large Integer", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"safeLimit\":9007199254740991,\"largerThanSafe\":9007199254740993}" } } } } } }, "/fromhell/problematic/json/high-precision-decimal": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - High Precision Decimal", "description": "Returns a decimal value with more precision than many clients preserve.\n\nWhat is wrong: Some parsers or viewers round high precision decimal values when rendering or generating code.\n\nWhat to check in your client: A REST client should make the raw numeric text available so precision loss can be spotted.", "operationId": "getFromHellproblematic_json_high_precision_decimal", "responses": { "200": { "description": "Problematic JSON - High Precision Decimal", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"amount\":0.12345678901234567890123456789}" } } } } } }, "/fromhell/problematic/json/exponent-number": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Exponent Number", "description": "Returns JSON numbers using exponent notation.\n\nWhat is wrong: Exponent notation is valid JSON, but some clients display, sort, or generate examples awkwardly.\n\nWhat to check in your client: A REST client should show both the raw exponent form and any interpreted value clearly.", "operationId": "getFromHellproblematic_json_exponent_number", "responses": { "200": { "description": "Problematic JSON - Exponent Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"small\":1.23e-10,\"large\":6.022e23}" } } } } } }, "/fromhell/problematic/json/null-vs-missing": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Null Vs Missing Field", "description": "Returns one item with a null field and another item where the same field is missing.\n\nWhat is wrong: Null and missing fields are semantically different but many clients and generated models blur them.\n\nWhat to check in your client: A REST client should make it easy to see that one value is explicit null and another is absent.", "operationId": "getFromHellproblematic_json_null_vs_missing", "responses": { "200": { "description": "Problematic JSON - Null Vs Missing Field", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"items\":[{\"id\":1,\"nickname\":null},{\"id\":2}]}" } } } } } }, "/fromhell/problematic/json/escaped-unicode": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Escaped Unicode", "description": "Returns escaped Unicode including a zero-width space and a visually similar character.\n\nWhat is wrong: Escaped Unicode can make values look normal while containing hidden or confusable characters.\n\nWhat to check in your client: A REST client should let users inspect raw escapes as well as rendered text.", "operationId": "getFromHellproblematic_json_escaped_unicode", "responses": { "200": { "description": "Problematic JSON - Escaped Unicode", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"normal\":\"user\",\"zeroWidth\":\"us\\u200Ber\",\"confusable\":\"payl\\u043Ead\"}" } } } } } }, "/fromhell/problematic/json/empty-object": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Empty Object", "description": "Returns an empty JSON object where useful data would usually be expected.\n\nWhat is wrong: An empty object is valid JSON, but it may violate the semantic contract a client expects.\n\nWhat to check in your client: A REST client should make it clear that the response is valid but contains no fields.", "operationId": "getFromHellproblematic_json_empty_object", "responses": { "200": { "description": "Problematic JSON - Empty Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{}" } } } } } }, "/fromhell/problematic/json/top-level-string": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level String", "description": "Returns a top-level JSON string instead of an object or array.\n\nWhat is wrong: Top-level strings are valid JSON but many clients and schemas assume an object or array.\n\nWhat to check in your client: A REST client should show that the complete JSON document is a scalar string.", "operationId": "getFromHellproblematic_json_top_level_string", "responses": { "200": { "description": "Problematic JSON - Top-Level String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "\"hello\"" } } } } } }, "/fromhell/problematic/json/top-level-number": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Number", "description": "Returns a top-level JSON number instead of an object or array.\n\nWhat is wrong: Top-level numbers are valid JSON but can surprise clients that expect structured data.\n\nWhat to check in your client: A REST client should show that the entire response body is one scalar number.", "operationId": "getFromHellproblematic_json_top_level_number", "responses": { "200": { "description": "Problematic JSON - Top-Level Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "42" } } } } } }, "/fromhell/problematic/json/top-level-boolean": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Boolean", "description": "Returns a top-level JSON boolean.\n\nWhat is wrong: Top-level booleans are valid JSON but can expose assumptions in viewers and generated clients.\n\nWhat to check in your client: A REST client should display the boolean as the whole document, not as missing body content.", "operationId": "getFromHellproblematic_json_top_level_boolean", "responses": { "200": { "description": "Problematic JSON - Top-Level Boolean", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "true" } } } } } }, "/fromhell/problematic/json/top-level-null": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Null", "description": "Returns a top-level JSON null value.\n\nWhat is wrong: Top-level null is valid JSON but can be confused with an empty response or missing data.\n\nWhat to check in your client: A REST client should distinguish the literal null body from no body.", "operationId": "getFromHellproblematic_json_top_level_null", "responses": { "200": { "description": "Problematic JSON - Top-Level Null", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "null" } } } } } }, "/fromhell/problematic/json/empty-body": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Empty Body With JSON Content-Type", "description": "Returns application/json with an empty response body.\n\nWhat is wrong: An empty body is not a valid JSON document, even when the content type says JSON.\n\nWhat to check in your client: A REST client should show the empty body and not pretend it parsed a JSON value.", "operationId": "getFromHellproblematic_json_empty_body", "responses": { "200": { "description": "Problematic JSON - Empty Body With JSON Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/json/bom-prefix": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - UTF-8 BOM Prefix", "description": "Returns a JSON object prefixed with a UTF-8 byte order mark.\n\nWhat is wrong: Some JSON parsers tolerate a BOM and others reject or expose it as an unexpected character.\n\nWhat to check in your client: A REST client should preserve enough raw detail to diagnose the prefix if parsing fails.", "operationId": "getFromHellproblematic_json_bom_prefix", "responses": { "200": { "description": "Problematic JSON - UTF-8 BOM Prefix", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"bom prefix\"}" } } } } } }, "/fromhell/problematic/json/ndjson": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - NDJSON Stream", "description": "Returns newline-delimited JSON objects rather than a single JSON document.\n\nWhat is wrong: NDJSON is useful as a stream format, but it is not one JSON document and needs different handling.\n\nWhat to check in your client: A REST client should show this as line-delimited data rather than trying to parse it as one object.", "operationId": "getFromHellproblematic_json_ndjson", "responses": { "200": { "description": "Problematic JSON - NDJSON Stream", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/x-ndjson" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/x-ndjson": { "schema": { "type": "string" }, "example": "{\"id\":1,\"event\":\"started\"}\n{\"id\":2,\"event\":\"finished\"}\n" } } } } } }, "/fromhell/malformed/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Missing Root Terminator", "description": "Returns XML that starts correctly but does not close the document.\n\nWhat is wrong: The body is malformed XML even though the status is 200 and content type says application/xml.\n\nWhat to check in your client: A REST client should show a parse/formatting failure and still make the raw body available.", "operationId": "getFromHellmalformed_xml", "responses": { "200": { "description": "Malformed XML - Missing Root Terminator", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n\r\n" } } } } } }, "/fromhell/malformed/xml/mismatched-tag": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Mismatched Tag", "description": "Returns XML where a child element closes with the wrong tag name.\n\nWhat is wrong: The item element opens as item but closes as thing.\n\nWhat to check in your client: A REST client should show the mismatched closing tag error and raw XML.", "operationId": "getFromHellmalformed_xml_mismatched_tag", "responses": { "200": { "description": "Malformed XML - Mismatched Tag", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "one" } } } } } }, "/fromhell/malformed/xml/unescaped-ampersand": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Unescaped Ampersand", "description": "Returns XML containing an ampersand that is not escaped as an entity.\n\nWhat is wrong: Ampersands in text content must be escaped as & unless they start a valid entity.\n\nWhat to check in your client: A REST client should show the entity parsing error and raw response text.", "operationId": "getFromHellmalformed_xml_unescaped_ampersand", "responses": { "200": { "description": "Malformed XML - Unescaped Ampersand", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "Tom & Jerry" } } } } } }, "/fromhell/malformed/xml/duplicate-attribute": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Duplicate Attribute", "description": "Returns XML with the same attribute declared twice on one element.\n\nWhat is wrong: An XML element cannot have two attributes with the same name.\n\nWhat to check in your client: A REST client should show the duplicate attribute parse error.", "operationId": "getFromHellmalformed_xml_duplicate_attribute", "responses": { "200": { "description": "Malformed XML - Duplicate Attribute", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "duplicate" } } } } } }, "/fromhell/malformed/xml/undefined-entity": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Undefined Entity", "description": "Returns XML that references an entity which has not been declared.\n\nWhat is wrong: The &unknown; entity is not predefined or declared in the document.\n\nWhat to check in your client: A REST client should expose the undefined entity error.", "operationId": "getFromHellmalformed_xml_undefined_entity", "responses": { "200": { "description": "Malformed XML - Undefined Entity", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "&unknown;" } } } } } }, "/fromhell/malformed/xml/multiple-root-elements": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Multiple Root Elements", "description": "Returns two top-level elements in one XML document.\n\nWhat is wrong: A well-formed XML document must have exactly one root element.\n\nWhat to check in your client: A REST client should show that content appears after the first complete root.", "operationId": "getFromHellmalformed_xml_multiple_root_elements", "responses": { "200": { "description": "Malformed XML - Multiple Root Elements", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/malformed/xml/missing-attribute-quote": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Missing Attribute Quote", "description": "Returns XML where an attribute value is not quoted.\n\nWhat is wrong: XML attribute values must be wrapped in quotes.\n\nWhat to check in your client: A REST client should identify the attribute syntax error.", "operationId": "getFromHellmalformed_xml_missing_attribute_quote", "responses": { "200": { "description": "Malformed XML - Missing Attribute Quote", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "missing quote" } } } } } }, "/fromhell/malformed/xml/unclosed-cdata": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Unclosed CDATA", "description": "Returns XML with a CDATA section that never terminates.\n\nWhat is wrong: CDATA sections must close with ]]>. This response never closes the section.\n\nWhat to check in your client: A REST client should report the unterminated CDATA section.", "operationId": "getFromHellmalformed_xml_unclosed_cdata", "responses": { "200": { "description": "Malformed XML - Unclosed CDATA", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/malformed/xml/invalid-character": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Invalid Character", "description": "Returns XML containing a character that is not allowed in XML 1.0 content.\n\nWhat is wrong: The body includes a raw control character inside the text node.\n\nWhat to check in your client: A REST client should show the invalid character problem without losing the raw response.", "operationId": "getFromHellmalformed_xml_invalid_character", "responses": { "200": { "description": "Malformed XML - Invalid Character", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "bad\u0001char" } } } } } }, "/fromhell/malformed/xml/truncated-document": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Truncated Document", "description": "Returns XML that starts a nested element but ends before closing it.\n\nWhat is wrong: The document is incomplete and ends before the open elements are closed.\n\nWhat to check in your client: A REST client should report the unexpected end of document.", "operationId": "getFromHellmalformed_xml_truncated_document", "responses": { "200": { "description": "Malformed XML - Truncated Document", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "one" } } } } } }, "/fromhell/malformed/xml/bad-processing-instruction": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Bad Processing Instruction", "description": "Returns XML with a processing instruction that never closes.\n\nWhat is wrong: Processing instructions must close with ?> before normal element markup continues.\n\nWhat to check in your client: A REST client should show the processing instruction syntax error.", "operationId": "getFromHellmalformed_xml_bad_processing_instruction", "responses": { "200": { "description": "Malformed XML - Bad Processing Instruction", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/attributes-vs-elements": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Attributes Vs Elements", "description": "Returns the same kind of data in both attributes and child elements.\n\nWhat is wrong: Clients often flatten XML into maps and may hide whether a value came from an attribute or an element.\n\nWhat to check in your client: A REST client should make attributes and elements visibly distinct and avoid silently merging conflicting values.", "operationId": "getFromHellproblematic_xml_attributes_vs_elements", "responses": { "200": { "description": "Problematic XML - Attributes Vs Elements", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "456falseAttribute Example" } } } } } }, "/fromhell/problematic/xml/empty-vs-missing-vs-nil": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Empty Vs Missing Vs Nil", "description": "Returns empty, missing, and explicitly nil values in one document.\n\nWhat is wrong: Empty elements, absent elements, and xsi:nil values are different states but clients may render them identically.\n\nWhat to check in your client: A REST client should help users distinguish empty, missing, and nil values.", "operationId": "getFromHellproblematic_xml_empty_vs_missing_vs_nil", "responses": { "200": { "description": "Problematic XML - Empty Vs Missing Vs Nil", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/whitespace-text": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Whitespace Significant Text", "description": "Returns XML text values with leading, trailing, and multiline whitespace.\n\nWhat is wrong: Pretty printers and object mappers can trim or normalize whitespace that is part of the value.\n\nWhat to check in your client: A REST client should let users inspect the raw text and spot whitespace-preservation issues.", "operationId": "getFromHellproblematic_xml_whitespace_text", "responses": { "200": { "description": "Problematic XML - Whitespace Significant Text", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": " padded value \n line one\n line two\n" } } } } } }, "/fromhell/problematic/xml/cdata-content": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - CDATA Content", "description": "Returns XML with JSON-looking and HTML-looking text inside CDATA.\n\nWhat is wrong: Clients may hide CDATA boundaries or try to interpret embedded markup as real XML.\n\nWhat to check in your client: A REST client should preserve CDATA content as text and make the raw body available.", "operationId": "getFromHellproblematic_xml_cdata_content", "responses": { "200": { "description": "Problematic XML - CDATA Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok\",\"amp\":\"A & B\"}]]>" } } } } } }, "/fromhell/problematic/xml/mixed-content": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Mixed Content", "description": "Returns text and child elements mixed inside the same element.\n\nWhat is wrong: Mixed content is valid XML but awkward for clients that convert XML to simple JSON-like objects.\n\nWhat to check in your client: A REST client should show text nodes and child elements without dropping their order.", "operationId": "getFromHellproblematic_xml_mixed_content", "responses": { "200": { "description": "Problematic XML - Mixed Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "Hello important world." } } } } } }, "/fromhell/problematic/xml/processing-instruction": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Processing Instruction", "description": "Returns a valid processing instruction before the document root.\n\nWhat is wrong: Processing instructions are valid XML but many viewers hide or ignore them.\n\nWhat to check in your client: A REST client should make processing instructions visible in raw or structured views.", "operationId": "getFromHellproblematic_xml_processing_instruction", "responses": { "200": { "description": "Problematic XML - Processing Instruction", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok" } } } } } }, "/fromhell/problematic/xml/comments": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Comments", "description": "Returns XML containing comments between normal elements.\n\nWhat is wrong: Comments may be hidden by formatters or stripped by object conversion.\n\nWhat to check in your client: A REST client should preserve enough raw detail to show whether comments were present.", "operationId": "getFromHellproblematic_xml_comments", "responses": { "200": { "description": "Problematic XML - Comments", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok" } } } } } }, "/fromhell/problematic/xml/encoding-mismatch": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Encoding Declaration Mismatch", "description": "Returns XML where the HTTP charset and XML declaration disagree.\n\nWhat is wrong: The response header says UTF-8 but the XML declaration says ISO-8859-1.\n\nWhat to check in your client: A REST client should expose both the HTTP charset and XML declaration so encoding assumptions are visible.", "operationId": "getFromHellproblematic_xml_encoding_mismatch", "responses": { "200": { "description": "Problematic XML - Encoding Declaration Mismatch", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml; charset=UTF-8" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml; charset=UTF-8": { "schema": { "type": "string" }, "example": "café" } } } } } }, "/fromhell/problematic/xml/doctype-dtd": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - DOCTYPE And DTD", "description": "Returns XML with a safe inline DTD declaration.\n\nWhat is wrong: DOCTYPE and DTD declarations are valid XML but clients may block, ignore, or hide them for security reasons.\n\nWhat to check in your client: A REST client should show that the document includes a DTD without attempting unsafe external resolution.", "operationId": "getFromHellproblematic_xml_doctype_dtd", "responses": { "200": { "description": "Problematic XML - DOCTYPE And DTD", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "]>clientinline doctype only" } } } } } }, "/fromhell/problematic/xml/empty-body": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Empty Body With XML Content-Type", "description": "Returns application/xml with an empty response body.\n\nWhat is wrong: An empty body is not an XML document, even when the content type says XML.\n\nWhat to check in your client: A REST client should show the empty body and not pretend it parsed XML.", "operationId": "getFromHellproblematic_xml_empty_body", "responses": { "200": { "description": "Problematic XML - Empty Body With XML Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/bom-prefix": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - UTF-8 BOM Prefix", "description": "Returns XML prefixed with a UTF-8 byte order mark.\n\nWhat is wrong: Some clients hide the BOM while others expose it as a leading character or parsing issue.\n\nWhat to check in your client: A REST client should preserve enough raw detail to diagnose the prefix if parsing behaves unexpectedly.", "operationId": "getFromHellproblematic_xml_bom_prefix", "responses": { "200": { "description": "Problematic XML - UTF-8 BOM Prefix", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "bom prefix" } } } } } }, "/fromhell/mismatch/content-type/json-xml": { "get": { "tags": [ "API From Hell" ], "summary": "Content-Type Mismatch - Header JSON Body XML", "description": "Returns XML while declaring application/json.\n\nWhat is wrong: The Content-Type header is application/json but the body is XML.\n\nWhat to check in your client: A REST client should make the mismatch visible and allow you to inspect the raw response.", "operationId": "getFromHellmismatch_content_type_json_xml", "responses": { "200": { "description": "Content-Type Mismatch - Header JSON Body XML", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n <1>\r\n e88067f0-b028-4310-8a33-8cbc03203249\r\n Modesto_Reichel61\r\n \r\n <2>\r\n fee23d87-721f-4ffa-a598-e350e13385b2\r\n Abagail_Shanahan\r\n \r\n <3>\r\n 987fc185-7cc6-4883-a5f4-3273b1045155\r\n Joaquin_Funk12\r\n \r\n <4>\r\n 0c2744bb-881a-41c0-a577-603b052485d9\r\n Maverick.Corkery74\r\n \r\n " } } } } } }, "/fromhell/mismatch/content-type/xml-json": { "get": { "tags": [ "API From Hell" ], "summary": "Content-Type Mismatch - Header XML Body JSON", "description": "Returns JSON while declaring application/xml.\n\nWhat is wrong: The Content-Type header is application/xml but the body is JSON.\n\nWhat to check in your client: A REST client should make the mismatch visible and allow you to inspect the raw response.", "operationId": "getFromHellmismatch_content_type_xml_json", "responses": { "200": { "description": "Content-Type Mismatch - Header XML Body JSON", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}]" } } } } } }, "/fromhell/status-code/201-no-location": { "post": { "tags": [ "API From Hell" ], "summary": "201 Missing Location Header", "description": "Returns a created-looking JSON response.\n\nWhat is wrong: The status is 201 Created, but the response does not include a Location header for the created resource.\n\nWhat to check in your client: A REST client should make the missing Location header easy to spot.", "operationId": "postFromHellstatus_code_201_no_location", "responses": { "201": { "description": "201 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":123,\"message\":\"created without a Location header\"}" } } } } } }, "/fromhell/status-code/301-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "301 Missing Location Header", "description": "Returns a permanent redirect status.\n\nWhat is wrong: The status is 301 Moved Permanently, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing.", "operationId": "getFromHellstatus_code_301_no_location", "responses": { "301": { "description": "301 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Moved permanently, but no Location header was supplied." } } } } } }, "/fromhell/status-code/302-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "302 Missing Location Header", "description": "Returns a common temporary redirect status.\n\nWhat is wrong: The status is 302 Found, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing.", "operationId": "getFromHellstatus_code_302_no_location", "responses": { "302": { "description": "302 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Found somewhere else, but no Location header was supplied." } } } } } }, "/fromhell/status-code/307-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "307 Missing Location Header", "description": "Returns a temporary redirect status that should preserve the original method.\n\nWhat is wrong: The status is 307 Temporary Redirect, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing and not silently change method.", "operationId": "getFromHellstatus_code_307_no_location", "responses": { "307": { "description": "307 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Temporary redirect, but no Location header was supplied." } } } } } }, "/fromhell/status-code/204-with-body": { "delete": { "tags": [ "API From Hell" ], "summary": "204 Body Present Despite No Content", "description": "Returns 204 No Content while the catalog defines a JSON response body.\n\nWhat is wrong: The status says no content, but the endpoint attempts to send response content.\n\nWhat to check in your client: A REST client should make it clear whether the body is present, discarded, or hidden by the HTTP stack. Local .jar or Docker execution may expose the body, while production proxies or gateways may strip it, so use an HTTP proxy between the API and client to inspect the actual response.", "operationId": "deleteFromHellstatus_code_204_with_body", "responses": { "204": { "description": "204 Body Present Despite No Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 204 No Content\"}" } } } } } }, "/fromhell/status-code/205-with-body": { "post": { "tags": [ "API From Hell" ], "summary": "205 Body Present Despite Reset Content", "description": "Returns 205 Reset Content while the catalog defines a JSON response body.\n\nWhat is wrong: The status tells the client to reset the document view and should not include a response body.\n\nWhat to check in your client: A REST client should make the body/status contradiction visible.", "operationId": "postFromHellstatus_code_205_with_body", "responses": { "205": { "description": "205 Body Present Despite Reset Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 205 Reset Content\"}" } } } } } }, "/fromhell/status-code/304-with-body": { "get": { "tags": [ "API From Hell" ], "summary": "304 Body Present Despite Not Modified", "description": "Returns 304 Not Modified while the catalog defines a JSON response body.\n\nWhat is wrong: The status is a cache validation response and should not include a response body.\n\nWhat to check in your client: A REST client should make it clear whether the body is present, discarded, or hidden by cache/status handling.", "operationId": "getFromHellstatus_code_304_with_body", "responses": { "304": { "description": "304 Body Present Despite Not Modified", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 304 Not Modified\"}" } } } } } }, "/fromhell/status-code/206-no-content-range": { "get": { "tags": [ "API From Hell" ], "summary": "206 Missing Content-Range Header", "description": "Returns a partial-looking body.\n\nWhat is wrong: The status is 206 Partial Content, but the response does not include Content-Range.\n\nWhat to check in your client: A REST client should make the missing range metadata easy to spot.", "operationId": "getFromHellstatus_code_206_no_content_range", "responses": { "206": { "description": "206 Missing Content-Range Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"items\":[1,2],\"message\":\"partial content without Content-Range\"}" } } } } } }, "/fromhell/status-code/401-no-www-authenticate": { "get": { "tags": [ "API From Hell" ], "summary": "401 Missing WWW-Authenticate Header", "description": "Returns an authentication failure body.\n\nWhat is wrong: The status is 401 Unauthorized, but the response does not include WWW-Authenticate.\n\nWhat to check in your client: A REST client should show the missing authentication challenge header.", "operationId": "getFromHellstatus_code_401_no_www_authenticate", "responses": { "401": { "description": "401 Missing WWW-Authenticate Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"authentication required but no challenge header was sent\"}" } } } } } }, "/fromhell/status-code/405-no-allow": { "post": { "tags": [ "API From Hell" ], "summary": "405 Missing Allow Header", "description": "Returns a method-not-allowed response body.\n\nWhat is wrong: The status is 405 Method Not Allowed, but the response does not include Allow.\n\nWhat to check in your client: A REST client should show the missing allowed-methods metadata.", "operationId": "postFromHellstatus_code_405_no_allow", "responses": { "405": { "description": "405 Missing Allow Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"method not allowed but no Allow header was sent\"}" } } } } } }, "/fromhell/status-code/416-no-content-range": { "get": { "tags": [ "API From Hell" ], "summary": "416 Missing Content-Range Header", "description": "Returns an unsatisfied range response body.\n\nWhat is wrong: The status is 416 Range Not Satisfiable, but the response does not include Content-Range.\n\nWhat to check in your client: A REST client should show the missing range explanation.", "operationId": "getFromHellstatus_code_416_no_content_range", "responses": { "416": { "description": "416 Missing Content-Range Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"range not satisfiable but no Content-Range header was sent\"}" } } } } } }, "/fromhell/status-code/200-error-body": { "get": { "tags": [ "API From Hell" ], "summary": "200 Error-Shaped Body", "description": "Returns a normal success status.\n\nWhat is wrong: The status is 200 OK, but the body is shaped like an error response.\n\nWhat to check in your client: A REST client should make it easy to inspect both status and body without assuming the request succeeded.", "operationId": "getFromHellstatus_code_200_error_body", "responses": { "200": { "description": "200 Error-Shaped Body", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"Everything is broken\",\"code\":\"NOT_OK\"}" } } } } } }, "/fromhell/status-code/500-success-body": { "get": { "tags": [ "API From Hell" ], "summary": "500 Success-Shaped Body", "description": "Returns a server error status.\n\nWhat is wrong: The status is 500 Internal Server Error, but the body claims success.\n\nWhat to check in your client: A REST client should make it easy to inspect both status and body without assuming the body is truthful.", "operationId": "getFromHellstatus_code_500_success_body", "responses": { "500": { "description": "500 Success-Shaped Body", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"success\":true,\"message\":\"The body says success but the status is 500\"}" } } } } } } } }