{ "openapi": "3.0.0", "info": { "title": "API From Hell", "version": "1.0.0", "description": "A deliberately awkward API for checking how REST clients display bad responses." }, "servers": [ { "url": "https://apichallenges.eviltester.com", "description": "current request" }, { "url": "http://localhost:4567", "description": "local execution" } ], "paths": { "/fromhell/status": { "get": { "tags": [ "API From Hell" ], "summary": "Status - Markdown Documentation", "description": "Markdown status text describing the intentionally awkward response set.\n\nWhat is wrong: This is a good response, but it is markdown rather than JSON or XML.\n\nWhat to check in your client: A REST client should show the response body as text/markdown and make the content type visible.", "operationId": "getFromHellstatus", "responses": { "200": { "description": "Status - Markdown Documentation", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/markdown" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/markdown": { "schema": { "type": "string" }, "example": "# Mock API From Hell\n\nAn API designed to test and evaluate REST Clients.\n\n- Do the REST Clients help spot the errors?\n- Are error messages readable and helpful?\n- Do the REST Clients flag errors automatically?\n\nAPI Should have a Swagger file to make it easy to import into clients.\n\nUser should be able to execute requests quickly and spot obvious issues.\n\n## Errors covered\n\n- No Error\n - [x] good endpoints to cover main content types to check REST Client can render and handle them\n- Additional Content Formats\n - [x] Plain text\n - [x] HTML\n - [x] CSV\n - [x] YAML\n - [x] Form URL encoded\n - [x] Octet stream\n- Missing Content-Type\n - [x] JSON body without Content-Type\n - [x] XML body without Content-Type\n - [x] HTML body without Content-Type\n- API Returns malformed JSON\n - [x] Missing final collection terminator\n - [x] Trailing comma in array\n - [x] Trailing comma in object\n - [x] Unquoted key\n - [x] Single quoted string\n - [x] Bad escape sequence\n - [x] Truncated string\n - [x] Extra data after document\n - [x] Missing colon\n - [x] Leading zero number\n - [x] NaN value\n - [x] Unclosed object\n - [x] Raw control character\n- Problematic JSON\n - [x] Duplicate keys\n - [x] Large integer\n - [x] High precision decimal\n - [x] Exponent number\n - [x] Null vs missing field\n - [x] Escaped Unicode\n - [x] Empty object\n - [x] Top-level string\n - [x] Top-level number\n - [x] Top-level boolean\n - [x] Top-level null\n - [x] Empty body with JSON content type\n - [x] UTF-8 BOM prefix\n - [x] NDJSON\n- API Returns malformed XML\n - [x] Missing final root element closure\n - [x] Mismatched tag\n - [x] Unescaped ampersand\n - [x] Duplicate attribute\n - [x] Undefined entity\n - [x] Multiple root elements\n - [x] Missing attribute quote\n - [x] Unclosed CDATA\n - [x] Invalid character\n - [x] Truncated document\n - [x] Bad processing instruction\n- Problematic XML\n - [x] Attributes vs elements\n - [x] Empty vs missing vs nil\n - [x] Whitespace significant text\n - [x] CDATA content\n - [x] Mixed content\n - [x] Processing instruction\n - [x] Comments\n - [x] Encoding declaration mismatch\n - [x] DOCTYPE and DTD\n - [x] Empty body with XML content type\n - [x] UTF-8 BOM prefix\n- API Returns mismatched content-type e.g. content-type xml, but is json\n - [x] json-xml\n - [x] xml-json\n- Status code semantic mismatches\n - [x] 201 with no Location header\n - [x] 3xx with no redirect Location\n - [x] 204 with content\n - [x] 205 with content\n - [x] 304 with content\n - [x] 206 without Content-Range\n - [x] 401 without WWW-Authenticate\n - [x] 405 without Allow\n - [x] 416 without Content-Range\n - [x] 200 with error body\n - [x] 500 with success body\n" } } } } } }, "/fromhell/version": { "get": { "tags": [ "API From Hell" ], "summary": "Version - Missing Content-Type Header", "description": "Returns a small JSON-looking version payload.\n\nWhat is wrong: No content type header is explicitly set for the response.\n\nWhat to check in your client: A REST client should still show the raw body and make the missing or defaulted content type obvious.", "operationId": "getFromHellversion", "responses": { "200": { "description": "Version - Missing Content-Type Header", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/good/json": { "get": { "tags": [ "API From Hell" ], "summary": "Good JSON - Valid JSON And Content-Type", "description": "Returns valid JSON with a matching application/json content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the control sample.\n\nWhat to check in your client: A REST client should format or inspect this as valid JSON.", "operationId": "getFromHellgood_json", "responses": { "200": { "description": "Good JSON - Valid JSON And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}]" } } } } } }, "/fromhell/good/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Good XML - Valid XML And Content-Type", "description": "Returns valid XML with a matching application/xml content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the XML control sample.\n\nWhat to check in your client: A REST client should format or inspect this as valid XML.", "operationId": "getFromHellgood_xml", "responses": { "200": { "description": "Good XML - Valid XML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n <1>\r\n e88067f0-b028-4310-8a33-8cbc03203249\r\n Modesto_Reichel61\r\n \r\n <2>\r\n fee23d87-721f-4ffa-a598-e350e13385b2\r\n Abagail_Shanahan\r\n \r\n <3>\r\n 987fc185-7cc6-4883-a5f4-3273b1045155\r\n Joaquin_Funk12\r\n \r\n <4>\r\n 0c2744bb-881a-41c0-a577-603b052485d9\r\n Maverick.Corkery74\r\n \r\n " } } } } } }, "/fromhell/good/text": { "get": { "tags": [ "API From Hell" ], "summary": "Good Text - Plain Text And Content-Type", "description": "Returns plain text with a matching text/plain content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the plain text control sample.\n\nWhat to check in your client: A REST client should show the response as readable text and make the content type visible.", "operationId": "getFromHellgood_text", "responses": { "200": { "description": "Good Text - Plain Text And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "API From Hell plain text response.\nLine two keeps this as normal text." } } } } } }, "/fromhell/good/html": { "get": { "tags": [ "API From Hell" ], "summary": "Good HTML - Valid HTML And Content-Type", "description": "Returns simple HTML with a matching text/html content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the HTML control sample.\n\nWhat to check in your client: A REST client should make it clear whether it is showing rendered HTML or raw HTML.", "operationId": "getFromHellgood_html", "responses": { "200": { "description": "Good HTML - Valid HTML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/html" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/html": { "schema": { "type": "string" }, "example": "API From Hell

HTML response

This is valid HTML.

" } } } } } }, "/fromhell/good/csv": { "get": { "tags": [ "API From Hell" ], "summary": "Good CSV - Valid CSV And Content-Type", "description": "Returns small comma-separated data with a matching text/csv content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the CSV control sample.\n\nWhat to check in your client: A REST client should show the raw CSV and, if supported, provide a readable table view.", "operationId": "getFromHellgood_csv", "responses": { "200": { "description": "Good CSV - Valid CSV And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/csv" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/csv": { "schema": { "type": "string" }, "example": "id,name,active\n1,Alice,true\n2,Bob,false\n" } } } } } }, "/fromhell/good/yaml": { "get": { "tags": [ "API From Hell" ], "summary": "Good YAML - Valid YAML And Content-Type", "description": "Returns a small YAML document with a matching application/yaml content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the YAML control sample.\n\nWhat to check in your client: A REST client should preserve indentation and make the YAML media type visible.", "operationId": "getFromHellgood_yaml", "responses": { "200": { "description": "Good YAML - Valid YAML And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/yaml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/yaml": { "schema": { "type": "string" }, "example": "name: API From Hell\nitems:\n - id: 1\n active: true\n - id: 2\n active: false\n" } } } } } }, "/fromhell/good/form-urlencoded": { "get": { "tags": [ "API From Hell" ], "summary": "Good Form URL Encoded - Valid Form Body And Content-Type", "description": "Returns URL-encoded key/value data with a matching application/x-www-form-urlencoded content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the form-urlencoded control sample.\n\nWhat to check in your client: A REST client should show the raw encoded body and ideally decode the key/value pairs clearly.", "operationId": "getFromHellgood_form_urlencoded", "responses": { "200": { "description": "Good Form URL Encoded - Valid Form Body And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/x-www-form-urlencoded" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "string" }, "example": "name=Alice+Example&role=admin&active=true" } } } } } }, "/fromhell/good/octet-stream": { "get": { "tags": [ "API From Hell" ], "summary": "Good Octet Stream - Binary-Looking Body And Content-Type", "description": "Returns a small binary-looking payload with an application/octet-stream content type.\n\nWhat is wrong: Nothing is wrong with this response. It is the octet-stream control sample.\n\nWhat to check in your client: A REST client should make it clear whether it is showing bytes, text, or offering a download.", "operationId": "getFromHellgood_octet_stream", "responses": { "200": { "description": "Good Octet Stream - Binary-Looking Body And Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/octet-stream" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/octet-stream": { "schema": { "type": "string" }, "example": "API-FROM-HELL-BYTES:\u0000\u0001\u0002END" } } } } } }, "/fromhell/missing-content-type/json": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - JSON Body", "description": "Returns a JSON body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like JSON but the server does not declare application/json.\n\nWhat to check in your client: A REST client should show that the content type is missing and avoid hiding how it inferred the format.", "operationId": "getFromHellmissing_content_type_json", "responses": { "200": { "description": "Missing Content-Type - JSON Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/missing-content-type/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - XML Body", "description": "Returns an XML body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like XML but the server does not declare application/xml.\n\nWhat to check in your client: A REST client should show that the content type is missing and avoid hiding how it inferred the format.", "operationId": "getFromHellmissing_content_type_xml", "responses": { "200": { "description": "Missing Content-Type - XML Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/missing-content-type/html": { "get": { "tags": [ "API From Hell" ], "summary": "Missing Content-Type - HTML Body", "description": "Returns an HTML body without declaring a Content-Type header.\n\nWhat is wrong: The body looks like HTML but the server does not declare text/html.\n\nWhat to check in your client: A REST client should show that the content type is missing and make rendered-vs-raw behavior obvious.", "operationId": "getFromHellmissing_content_type_html", "responses": { "200": { "description": "Missing Content-Type - HTML Body", "headers": { "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } } } } } }, "/fromhell/malformed/json": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Missing Collection Terminator", "description": "Returns a JSON array that starts correctly but never closes the collection.\n\nWhat is wrong: The body is malformed JSON even though the status is 200 and content type says application/json.\n\nWhat to check in your client: A REST client should show a parse/formatting failure and still make the raw body available.", "operationId": "getFromHellmalformed_json", "responses": { "200": { "description": "Malformed JSON - Missing Collection Terminator", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}" } } } } } }, "/fromhell/malformed/json/trailing-comma-array": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Trailing Comma In Array", "description": "Returns a JSON array with a trailing comma before the closing bracket.\n\nWhat is wrong: JSON does not allow a trailing comma after the final array item.\n\nWhat to check in your client: A REST client should show that JSON parsing failed and still make the raw body available.", "operationId": "getFromHellmalformed_json_trailing_comma_array", "responses": { "200": { "description": "Malformed JSON - Trailing Comma In Array", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "[{\"id\":1,\"name\":\"first\"},]" } } } } } }, "/fromhell/malformed/json/trailing-comma-object": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Trailing Comma In Object", "description": "Returns a JSON object with a trailing comma before the closing brace.\n\nWhat is wrong: JSON does not allow a trailing comma after the final object property.\n\nWhat to check in your client: A REST client should flag the parse failure near the end of the object.", "operationId": "getFromHellmalformed_json_trailing_comma_object", "responses": { "200": { "description": "Malformed JSON - Trailing Comma In Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"name\":\"first\",}" } } } } } }, "/fromhell/malformed/json/unquoted-key": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Unquoted Object Key", "description": "Returns an object where the property name is not wrapped in double quotes.\n\nWhat is wrong: JSON object keys must be double-quoted strings.\n\nWhat to check in your client: A REST client should not treat JavaScript object literal syntax as valid JSON.", "operationId": "getFromHellmalformed_json_unquoted_key", "responses": { "200": { "description": "Malformed JSON - Unquoted Object Key", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{id:1,\"name\":\"first\"}" } } } } } }, "/fromhell/malformed/json/single-quoted-string": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Single Quoted String", "description": "Returns JSON-looking data using single quotes for strings.\n\nWhat is wrong: JSON strings must use double quotes, not single quotes.\n\nWhat to check in your client: A REST client should distinguish JSON from JavaScript-like object notation.", "operationId": "getFromHellmalformed_json_single_quoted_string", "responses": { "200": { "description": "Malformed JSON - Single Quoted String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{'id':1,'name':'first'}" } } } } } }, "/fromhell/malformed/json/bad-escape": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Bad Escape Sequence", "description": "Returns a string with an unsupported escape sequence.\n\nWhat is wrong: JSON allows only specific escape sequences; \\q is not valid.\n\nWhat to check in your client: A REST client should show where the bad escape sequence breaks parsing.", "operationId": "getFromHellmalformed_json_bad_escape", "responses": { "200": { "description": "Malformed JSON - Bad Escape Sequence", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"path\":\"C:\\temp\\q\"}" } } } } } }, "/fromhell/malformed/json/truncated-string": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Truncated String", "description": "Returns an object with a string value that never closes.\n\nWhat is wrong: The response ends before the string terminator is present.\n\nWhat to check in your client: A REST client should make it clear that the body was incomplete or truncated.", "operationId": "getFromHellmalformed_json_truncated_string", "responses": { "200": { "description": "Malformed JSON - Truncated String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"unterminated}" } } } } } }, "/fromhell/malformed/json/extra-data-after-document": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Extra Data After Document", "description": "Returns one complete JSON object followed by another value.\n\nWhat is wrong: A JSON response body should contain one complete JSON document, not extra data after it.\n\nWhat to check in your client: A REST client should show that the first object parsed but unexpected data follows.", "operationId": "getFromHellmalformed_json_extra_data_after_document", "responses": { "200": { "description": "Malformed JSON - Extra Data After Document", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"ok\":true} {\"extra\":true}" } } } } } }, "/fromhell/malformed/json/missing-colon": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Missing Colon", "description": "Returns an object property without the colon between key and value.\n\nWhat is wrong: JSON object members require a colon between the name and value.\n\nWhat to check in your client: A REST client should identify the structural syntax error.", "operationId": "getFromHellmalformed_json_missing_colon", "responses": { "200": { "description": "Malformed JSON - Missing Colon", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\" \"hello\"}" } } } } } }, "/fromhell/malformed/json/leading-zero-number": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Leading Zero Number", "description": "Returns a numeric value with a leading zero.\n\nWhat is wrong: JSON numbers cannot use leading zeroes like 01.\n\nWhat to check in your client: A REST client should reject the number rather than silently accepting non-standard JSON.", "operationId": "getFromHellmalformed_json_leading_zero_number", "responses": { "200": { "description": "Malformed JSON - Leading Zero Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"count\":01}" } } } } } }, "/fromhell/malformed/json/nan-value": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - NaN Value", "description": "Returns NaN as a value in a JSON-looking object.\n\nWhat is wrong: NaN is not a valid JSON number or literal.\n\nWhat to check in your client: A REST client should not silently accept JavaScript-only numeric values as JSON.", "operationId": "getFromHellmalformed_json_nan_value", "responses": { "200": { "description": "Malformed JSON - NaN Value", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"value\":NaN}" } } } } } }, "/fromhell/malformed/json/unclosed-object": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Unclosed Object", "description": "Returns an object that never closes with a final brace.\n\nWhat is wrong: The JSON object starts correctly but the closing brace is missing.\n\nWhat to check in your client: A REST client should report the incomplete object and preserve the raw response.", "operationId": "getFromHellmalformed_json_unclosed_object", "responses": { "200": { "description": "Malformed JSON - Unclosed Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"name\":\"open\"" } } } } } }, "/fromhell/malformed/json/control-character": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed JSON - Raw Control Character", "description": "Returns a string containing a raw control character.\n\nWhat is wrong: JSON strings cannot contain unescaped control characters.\n\nWhat to check in your client: A REST client should show that the body is not valid JSON and still allow raw inspection.", "operationId": "getFromHellmalformed_json_control_character", "responses": { "200": { "description": "Malformed JSON - Raw Control Character", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"bad\u0001control\"}" } } } } } }, "/fromhell/problematic/json/duplicate-keys": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Duplicate Keys", "description": "Returns valid JSON syntax with the same object key repeated.\n\nWhat is wrong: Duplicate object keys are ambiguous because parsers disagree on whether the first or last value wins.\n\nWhat to check in your client: A REST client should make duplicate keys visible or warn that values may be overwritten.", "operationId": "getFromHellproblematic_json_duplicate_keys", "responses": { "200": { "description": "Problematic JSON - Duplicate Keys", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":1,\"id\":2,\"name\":\"duplicate key example\"}" } } } } } }, "/fromhell/problematic/json/large-integer": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Large Integer", "description": "Returns an integer larger than JavaScript can safely represent exactly.\n\nWhat is wrong: Large JSON numbers can lose precision in clients that store all numbers as floating point values.\n\nWhat to check in your client: A REST client should display the exact raw value and avoid silently rounding it.", "operationId": "getFromHellproblematic_json_large_integer", "responses": { "200": { "description": "Problematic JSON - Large Integer", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"safeLimit\":9007199254740991,\"largerThanSafe\":9007199254740993}" } } } } } }, "/fromhell/problematic/json/high-precision-decimal": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - High Precision Decimal", "description": "Returns a decimal value with more precision than many clients preserve.\n\nWhat is wrong: Some parsers or viewers round high precision decimal values when rendering or generating code.\n\nWhat to check in your client: A REST client should make the raw numeric text available so precision loss can be spotted.", "operationId": "getFromHellproblematic_json_high_precision_decimal", "responses": { "200": { "description": "Problematic JSON - High Precision Decimal", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"amount\":0.12345678901234567890123456789}" } } } } } }, "/fromhell/problematic/json/exponent-number": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Exponent Number", "description": "Returns JSON numbers using exponent notation.\n\nWhat is wrong: Exponent notation is valid JSON, but some clients display, sort, or generate examples awkwardly.\n\nWhat to check in your client: A REST client should show both the raw exponent form and any interpreted value clearly.", "operationId": "getFromHellproblematic_json_exponent_number", "responses": { "200": { "description": "Problematic JSON - Exponent Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"small\":1.23e-10,\"large\":6.022e23}" } } } } } }, "/fromhell/problematic/json/null-vs-missing": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Null Vs Missing Field", "description": "Returns one item with a null field and another item where the same field is missing.\n\nWhat is wrong: Null and missing fields are semantically different but many clients and generated models blur them.\n\nWhat to check in your client: A REST client should make it easy to see that one value is explicit null and another is absent.", "operationId": "getFromHellproblematic_json_null_vs_missing", "responses": { "200": { "description": "Problematic JSON - Null Vs Missing Field", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"items\":[{\"id\":1,\"nickname\":null},{\"id\":2}]}" } } } } } }, "/fromhell/problematic/json/escaped-unicode": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Escaped Unicode", "description": "Returns escaped Unicode including a zero-width space and a visually similar character.\n\nWhat is wrong: Escaped Unicode can make values look normal while containing hidden or confusable characters.\n\nWhat to check in your client: A REST client should let users inspect raw escapes as well as rendered text.", "operationId": "getFromHellproblematic_json_escaped_unicode", "responses": { "200": { "description": "Problematic JSON - Escaped Unicode", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"normal\":\"user\",\"zeroWidth\":\"us\\u200Ber\",\"confusable\":\"payl\\u043Ead\"}" } } } } } }, "/fromhell/problematic/json/empty-object": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Empty Object", "description": "Returns an empty JSON object where useful data would usually be expected.\n\nWhat is wrong: An empty object is valid JSON, but it may violate the semantic contract a client expects.\n\nWhat to check in your client: A REST client should make it clear that the response is valid but contains no fields.", "operationId": "getFromHellproblematic_json_empty_object", "responses": { "200": { "description": "Problematic JSON - Empty Object", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{}" } } } } } }, "/fromhell/problematic/json/top-level-string": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level String", "description": "Returns a top-level JSON string instead of an object or array.\n\nWhat is wrong: Top-level strings are valid JSON but many clients and schemas assume an object or array.\n\nWhat to check in your client: A REST client should show that the complete JSON document is a scalar string.", "operationId": "getFromHellproblematic_json_top_level_string", "responses": { "200": { "description": "Problematic JSON - Top-Level String", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "\"hello\"" } } } } } }, "/fromhell/problematic/json/top-level-number": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Number", "description": "Returns a top-level JSON number instead of an object or array.\n\nWhat is wrong: Top-level numbers are valid JSON but can surprise clients that expect structured data.\n\nWhat to check in your client: A REST client should show that the entire response body is one scalar number.", "operationId": "getFromHellproblematic_json_top_level_number", "responses": { "200": { "description": "Problematic JSON - Top-Level Number", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "42" } } } } } }, "/fromhell/problematic/json/top-level-boolean": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Boolean", "description": "Returns a top-level JSON boolean.\n\nWhat is wrong: Top-level booleans are valid JSON but can expose assumptions in viewers and generated clients.\n\nWhat to check in your client: A REST client should display the boolean as the whole document, not as missing body content.", "operationId": "getFromHellproblematic_json_top_level_boolean", "responses": { "200": { "description": "Problematic JSON - Top-Level Boolean", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "true" } } } } } }, "/fromhell/problematic/json/top-level-null": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Top-Level Null", "description": "Returns a top-level JSON null value.\n\nWhat is wrong: Top-level null is valid JSON but can be confused with an empty response or missing data.\n\nWhat to check in your client: A REST client should distinguish the literal null body from no body.", "operationId": "getFromHellproblematic_json_top_level_null", "responses": { "200": { "description": "Problematic JSON - Top-Level Null", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "null" } } } } } }, "/fromhell/problematic/json/empty-body": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - Empty Body With JSON Content-Type", "description": "Returns application/json with an empty response body.\n\nWhat is wrong: An empty body is not a valid JSON document, even when the content type says JSON.\n\nWhat to check in your client: A REST client should show the empty body and not pretend it parsed a JSON value.", "operationId": "getFromHellproblematic_json_empty_body", "responses": { "200": { "description": "Problematic JSON - Empty Body With JSON Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/json/bom-prefix": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - UTF-8 BOM Prefix", "description": "Returns a JSON object prefixed with a UTF-8 byte order mark.\n\nWhat is wrong: Some JSON parsers tolerate a BOM and others reject or expose it as an unexpected character.\n\nWhat to check in your client: A REST client should preserve enough raw detail to diagnose the prefix if parsing fails.", "operationId": "getFromHellproblematic_json_bom_prefix", "responses": { "200": { "description": "Problematic JSON - UTF-8 BOM Prefix", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"bom prefix\"}" } } } } } }, "/fromhell/problematic/json/ndjson": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic JSON - NDJSON Stream", "description": "Returns newline-delimited JSON objects rather than a single JSON document.\n\nWhat is wrong: NDJSON is useful as a stream format, but it is not one JSON document and needs different handling.\n\nWhat to check in your client: A REST client should show this as line-delimited data rather than trying to parse it as one object.", "operationId": "getFromHellproblematic_json_ndjson", "responses": { "200": { "description": "Problematic JSON - NDJSON Stream", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/x-ndjson" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/x-ndjson": { "schema": { "type": "string" }, "example": "{\"id\":1,\"event\":\"started\"}\n{\"id\":2,\"event\":\"finished\"}\n" } } } } } }, "/fromhell/malformed/xml": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Missing Root Terminator", "description": "Returns XML that starts correctly but does not close the document.\n\nWhat is wrong: The body is malformed XML even though the status is 200 and content type says application/xml.\n\nWhat to check in your client: A REST client should show a parse/formatting failure and still make the raw body available.", "operationId": "getFromHellmalformed_xml", "responses": { "200": { "description": "Malformed XML - Missing Root Terminator", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n\r\n" } } } } } }, "/fromhell/malformed/xml/mismatched-tag": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Mismatched Tag", "description": "Returns XML where a child element closes with the wrong tag name.\n\nWhat is wrong: The item element opens as item but closes as thing.\n\nWhat to check in your client: A REST client should show the mismatched closing tag error and raw XML.", "operationId": "getFromHellmalformed_xml_mismatched_tag", "responses": { "200": { "description": "Malformed XML - Mismatched Tag", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "one" } } } } } }, "/fromhell/malformed/xml/unescaped-ampersand": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Unescaped Ampersand", "description": "Returns XML containing an ampersand that is not escaped as an entity.\n\nWhat is wrong: Ampersands in text content must be escaped as & unless they start a valid entity.\n\nWhat to check in your client: A REST client should show the entity parsing error and raw response text.", "operationId": "getFromHellmalformed_xml_unescaped_ampersand", "responses": { "200": { "description": "Malformed XML - Unescaped Ampersand", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "Tom & Jerry" } } } } } }, "/fromhell/malformed/xml/duplicate-attribute": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Duplicate Attribute", "description": "Returns XML with the same attribute declared twice on one element.\n\nWhat is wrong: An XML element cannot have two attributes with the same name.\n\nWhat to check in your client: A REST client should show the duplicate attribute parse error.", "operationId": "getFromHellmalformed_xml_duplicate_attribute", "responses": { "200": { "description": "Malformed XML - Duplicate Attribute", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "duplicate" } } } } } }, "/fromhell/malformed/xml/undefined-entity": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Undefined Entity", "description": "Returns XML that references an entity which has not been declared.\n\nWhat is wrong: The &unknown; entity is not predefined or declared in the document.\n\nWhat to check in your client: A REST client should expose the undefined entity error.", "operationId": "getFromHellmalformed_xml_undefined_entity", "responses": { "200": { "description": "Malformed XML - Undefined Entity", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "&unknown;" } } } } } }, "/fromhell/malformed/xml/multiple-root-elements": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Multiple Root Elements", "description": "Returns two top-level elements in one XML document.\n\nWhat is wrong: A well-formed XML document must have exactly one root element.\n\nWhat to check in your client: A REST client should show that content appears after the first complete root.", "operationId": "getFromHellmalformed_xml_multiple_root_elements", "responses": { "200": { "description": "Malformed XML - Multiple Root Elements", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/malformed/xml/missing-attribute-quote": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Missing Attribute Quote", "description": "Returns XML where an attribute value is not quoted.\n\nWhat is wrong: XML attribute values must be wrapped in quotes.\n\nWhat to check in your client: A REST client should identify the attribute syntax error.", "operationId": "getFromHellmalformed_xml_missing_attribute_quote", "responses": { "200": { "description": "Malformed XML - Missing Attribute Quote", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "missing quote" } } } } } }, "/fromhell/malformed/xml/unclosed-cdata": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Unclosed CDATA", "description": "Returns XML with a CDATA section that never terminates.\n\nWhat is wrong: CDATA sections must close with ]]>. This response never closes the section.\n\nWhat to check in your client: A REST client should report the unterminated CDATA section.", "operationId": "getFromHellmalformed_xml_unclosed_cdata", "responses": { "200": { "description": "Malformed XML - Unclosed CDATA", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/malformed/xml/invalid-character": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Invalid Character", "description": "Returns XML containing a character that is not allowed in XML 1.0 content.\n\nWhat is wrong: The body includes a raw control character inside the text node.\n\nWhat to check in your client: A REST client should show the invalid character problem without losing the raw response.", "operationId": "getFromHellmalformed_xml_invalid_character", "responses": { "200": { "description": "Malformed XML - Invalid Character", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "bad\u0001char" } } } } } }, "/fromhell/malformed/xml/truncated-document": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Truncated Document", "description": "Returns XML that starts a nested element but ends before closing it.\n\nWhat is wrong: The document is incomplete and ends before the open elements are closed.\n\nWhat to check in your client: A REST client should report the unexpected end of document.", "operationId": "getFromHellmalformed_xml_truncated_document", "responses": { "200": { "description": "Malformed XML - Truncated Document", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "one" } } } } } }, "/fromhell/malformed/xml/bad-processing-instruction": { "get": { "tags": [ "API From Hell" ], "summary": "Malformed XML - Bad Processing Instruction", "description": "Returns XML with a processing instruction that never closes.\n\nWhat is wrong: Processing instructions must close with ?> before normal element markup continues.\n\nWhat to check in your client: A REST client should show the processing instruction syntax error.", "operationId": "getFromHellmalformed_xml_bad_processing_instruction", "responses": { "200": { "description": "Malformed XML - Bad Processing Instruction", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/attributes-vs-elements": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Attributes Vs Elements", "description": "Returns the same kind of data in both attributes and child elements.\n\nWhat is wrong: Clients often flatten XML into maps and may hide whether a value came from an attribute or an element.\n\nWhat to check in your client: A REST client should make attributes and elements visibly distinct and avoid silently merging conflicting values.", "operationId": "getFromHellproblematic_xml_attributes_vs_elements", "responses": { "200": { "description": "Problematic XML - Attributes Vs Elements", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "456falseAttribute Example" } } } } } }, "/fromhell/problematic/xml/empty-vs-missing-vs-nil": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Empty Vs Missing Vs Nil", "description": "Returns empty, missing, and explicitly nil values in one document.\n\nWhat is wrong: Empty elements, absent elements, and xsi:nil values are different states but clients may render them identically.\n\nWhat to check in your client: A REST client should help users distinguish empty, missing, and nil values.", "operationId": "getFromHellproblematic_xml_empty_vs_missing_vs_nil", "responses": { "200": { "description": "Problematic XML - Empty Vs Missing Vs Nil", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/whitespace-text": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Whitespace Significant Text", "description": "Returns XML text values with leading, trailing, and multiline whitespace.\n\nWhat is wrong: Pretty printers and object mappers can trim or normalize whitespace that is part of the value.\n\nWhat to check in your client: A REST client should let users inspect the raw text and spot whitespace-preservation issues.", "operationId": "getFromHellproblematic_xml_whitespace_text", "responses": { "200": { "description": "Problematic XML - Whitespace Significant Text", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": " padded value \n line one\n line two\n" } } } } } }, "/fromhell/problematic/xml/cdata-content": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - CDATA Content", "description": "Returns XML with JSON-looking and HTML-looking text inside CDATA.\n\nWhat is wrong: Clients may hide CDATA boundaries or try to interpret embedded markup as real XML.\n\nWhat to check in your client: A REST client should preserve CDATA content as text and make the raw body available.", "operationId": "getFromHellproblematic_xml_cdata_content", "responses": { "200": { "description": "Problematic XML - CDATA Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok\",\"amp\":\"A & B\"}]]>" } } } } } }, "/fromhell/problematic/xml/mixed-content": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Mixed Content", "description": "Returns text and child elements mixed inside the same element.\n\nWhat is wrong: Mixed content is valid XML but awkward for clients that convert XML to simple JSON-like objects.\n\nWhat to check in your client: A REST client should show text nodes and child elements without dropping their order.", "operationId": "getFromHellproblematic_xml_mixed_content", "responses": { "200": { "description": "Problematic XML - Mixed Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "Hello important world." } } } } } }, "/fromhell/problematic/xml/processing-instruction": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Processing Instruction", "description": "Returns a valid processing instruction before the document root.\n\nWhat is wrong: Processing instructions are valid XML but many viewers hide or ignore them.\n\nWhat to check in your client: A REST client should make processing instructions visible in raw or structured views.", "operationId": "getFromHellproblematic_xml_processing_instruction", "responses": { "200": { "description": "Problematic XML - Processing Instruction", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok" } } } } } }, "/fromhell/problematic/xml/comments": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Comments", "description": "Returns XML containing comments between normal elements.\n\nWhat is wrong: Comments may be hidden by formatters or stripped by object conversion.\n\nWhat to check in your client: A REST client should preserve enough raw detail to show whether comments were present.", "operationId": "getFromHellproblematic_xml_comments", "responses": { "200": { "description": "Problematic XML - Comments", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "ok" } } } } } }, "/fromhell/problematic/xml/encoding-mismatch": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Encoding Declaration Mismatch", "description": "Returns XML where the HTTP charset and XML declaration disagree.\n\nWhat is wrong: The response header says UTF-8 but the XML declaration says ISO-8859-1.\n\nWhat to check in your client: A REST client should expose both the HTTP charset and XML declaration so encoding assumptions are visible.", "operationId": "getFromHellproblematic_xml_encoding_mismatch", "responses": { "200": { "description": "Problematic XML - Encoding Declaration Mismatch", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml; charset=UTF-8" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml; charset=UTF-8": { "schema": { "type": "string" }, "example": "café" } } } } } }, "/fromhell/problematic/xml/doctype-dtd": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - DOCTYPE And DTD", "description": "Returns XML with a safe inline DTD declaration.\n\nWhat is wrong: DOCTYPE and DTD declarations are valid XML but clients may block, ignore, or hide them for security reasons.\n\nWhat to check in your client: A REST client should show that the document includes a DTD without attempting unsafe external resolution.", "operationId": "getFromHellproblematic_xml_doctype_dtd", "responses": { "200": { "description": "Problematic XML - DOCTYPE And DTD", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "]>clientinline doctype only" } } } } } }, "/fromhell/problematic/xml/empty-body": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - Empty Body With XML Content-Type", "description": "Returns application/xml with an empty response body.\n\nWhat is wrong: An empty body is not an XML document, even when the content type says XML.\n\nWhat to check in your client: A REST client should show the empty body and not pretend it parsed XML.", "operationId": "getFromHellproblematic_xml_empty_body", "responses": { "200": { "description": "Problematic XML - Empty Body With XML Content-Type", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "" } } } } } }, "/fromhell/problematic/xml/bom-prefix": { "get": { "tags": [ "API From Hell" ], "summary": "Problematic XML - UTF-8 BOM Prefix", "description": "Returns XML prefixed with a UTF-8 byte order mark.\n\nWhat is wrong: Some clients hide the BOM while others expose it as a leading character or parsing issue.\n\nWhat to check in your client: A REST client should preserve enough raw detail to diagnose the prefix if parsing behaves unexpectedly.", "operationId": "getFromHellproblematic_xml_bom_prefix", "responses": { "200": { "description": "Problematic XML - UTF-8 BOM Prefix", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "bom prefix" } } } } } }, "/fromhell/mismatch/content-type/json-xml": { "get": { "tags": [ "API From Hell" ], "summary": "Content-Type Mismatch - Header JSON Body XML", "description": "Returns XML while declaring application/json.\n\nWhat is wrong: The Content-Type header is application/json but the body is XML.\n\nWhat to check in your client: A REST client should make the mismatch visible and allow you to inspect the raw response.", "operationId": "getFromHellmismatch_content_type_json_xml", "responses": { "200": { "description": "Content-Type Mismatch - Header JSON Body XML", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "\r\n \r\n <0>\r\n 57ab8bfa-dcad-4649-9442-3b13010e852d\r\n Damaris76\r\n \r\n <1>\r\n e88067f0-b028-4310-8a33-8cbc03203249\r\n Modesto_Reichel61\r\n \r\n <2>\r\n fee23d87-721f-4ffa-a598-e350e13385b2\r\n Abagail_Shanahan\r\n \r\n <3>\r\n 987fc185-7cc6-4883-a5f4-3273b1045155\r\n Joaquin_Funk12\r\n \r\n <4>\r\n 0c2744bb-881a-41c0-a577-603b052485d9\r\n Maverick.Corkery74\r\n \r\n " } } } } } }, "/fromhell/mismatch/content-type/xml-json": { "get": { "tags": [ "API From Hell" ], "summary": "Content-Type Mismatch - Header XML Body JSON", "description": "Returns JSON while declaring application/xml.\n\nWhat is wrong: The Content-Type header is application/xml but the body is JSON.\n\nWhat to check in your client: A REST client should make the mismatch visible and allow you to inspect the raw response.", "operationId": "getFromHellmismatch_content_type_xml_json", "responses": { "200": { "description": "Content-Type Mismatch - Header XML Body JSON", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/xml" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/xml": { "schema": { "type": "string" }, "example": "[{\"id\":\"57ab8bfa-dcad-4649-9442-3b13010e852d\",\"username\":\"Damaris76\"},{\"id\":\"e88067f0-b028-4310-8a33-8cbc03203249\",\"username\":\"Modesto_Reichel61\"},{\"id\":\"fee23d87-721f-4ffa-a598-e350e13385b2\",\"username\":\"Abagail_Shanahan\"},{\"id\":\"987fc185-7cc6-4883-a5f4-3273b1045155\",\"username\":\"Joaquin_Funk12\"},{\"id\":\"0c2744bb-881a-41c0-a577-603b052485d9\",\"username\":\"Maverick.Corkery74\"}]" } } } } } }, "/fromhell/status-code/201-no-location": { "post": { "tags": [ "API From Hell" ], "summary": "201 Missing Location Header", "description": "Returns a created-looking JSON response.\n\nWhat is wrong: The status is 201 Created, but the response does not include a Location header for the created resource.\n\nWhat to check in your client: A REST client should make the missing Location header easy to spot.", "operationId": "postFromHellstatus_code_201_no_location", "responses": { "201": { "description": "201 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"id\":123,\"message\":\"created without a Location header\"}" } } } } } }, "/fromhell/status-code/301-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "301 Missing Location Header", "description": "Returns a permanent redirect status.\n\nWhat is wrong: The status is 301 Moved Permanently, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing.", "operationId": "getFromHellstatus_code_301_no_location", "responses": { "301": { "description": "301 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Moved permanently, but no Location header was supplied." } } } } } }, "/fromhell/status-code/302-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "302 Missing Location Header", "description": "Returns a common temporary redirect status.\n\nWhat is wrong: The status is 302 Found, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing.", "operationId": "getFromHellstatus_code_302_no_location", "responses": { "302": { "description": "302 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Found somewhere else, but no Location header was supplied." } } } } } }, "/fromhell/status-code/307-no-location": { "get": { "tags": [ "API From Hell" ], "summary": "307 Missing Location Header", "description": "Returns a temporary redirect status that should preserve the original method.\n\nWhat is wrong: The status is 307 Temporary Redirect, but there is no Location header to follow.\n\nWhat to check in your client: A REST client should show that the redirect target is missing and not silently change method.", "operationId": "getFromHellstatus_code_307_no_location", "responses": { "307": { "description": "307 Missing Location Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "text/plain" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "text/plain": { "schema": { "type": "string" }, "example": "Temporary redirect, but no Location header was supplied." } } } } } }, "/fromhell/status-code/204-with-body": { "delete": { "tags": [ "API From Hell" ], "summary": "204 Body Present Despite No Content", "description": "Returns 204 No Content while the catalog defines a JSON response body.\n\nWhat is wrong: The status says no content, but the endpoint attempts to send response content.\n\nWhat to check in your client: A REST client should make it clear whether the body is present, discarded, or hidden by the HTTP stack.", "operationId": "deleteFromHellstatus_code_204_with_body", "responses": { "204": { "description": "204 Body Present Despite No Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 204 No Content\"}" } } } } } }, "/fromhell/status-code/205-with-body": { "post": { "tags": [ "API From Hell" ], "summary": "205 Body Present Despite Reset Content", "description": "Returns 205 Reset Content while the catalog defines a JSON response body.\n\nWhat is wrong: The status tells the client to reset the document view and should not include a response body.\n\nWhat to check in your client: A REST client should make the body/status contradiction visible.", "operationId": "postFromHellstatus_code_205_with_body", "responses": { "205": { "description": "205 Body Present Despite Reset Content", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 205 Reset Content\"}" } } } } } }, "/fromhell/status-code/304-with-body": { "get": { "tags": [ "API From Hell" ], "summary": "304 Body Present Despite Not Modified", "description": "Returns 304 Not Modified while the catalog defines a JSON response body.\n\nWhat is wrong: The status is a cache validation response and should not include a response body.\n\nWhat to check in your client: A REST client should make it clear whether the body is present, discarded, or hidden by cache/status handling.", "operationId": "getFromHellstatus_code_304_with_body", "responses": { "304": { "description": "304 Body Present Despite Not Modified", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"message\":\"This body should not be sent with 304 Not Modified\"}" } } } } } }, "/fromhell/status-code/206-no-content-range": { "get": { "tags": [ "API From Hell" ], "summary": "206 Missing Content-Range Header", "description": "Returns a partial-looking body.\n\nWhat is wrong: The status is 206 Partial Content, but the response does not include Content-Range.\n\nWhat to check in your client: A REST client should make the missing range metadata easy to spot.", "operationId": "getFromHellstatus_code_206_no_content_range", "responses": { "206": { "description": "206 Missing Content-Range Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"items\":[1,2],\"message\":\"partial content without Content-Range\"}" } } } } } }, "/fromhell/status-code/401-no-www-authenticate": { "get": { "tags": [ "API From Hell" ], "summary": "401 Missing WWW-Authenticate Header", "description": "Returns an authentication failure body.\n\nWhat is wrong: The status is 401 Unauthorized, but the response does not include WWW-Authenticate.\n\nWhat to check in your client: A REST client should show the missing authentication challenge header.", "operationId": "getFromHellstatus_code_401_no_www_authenticate", "responses": { "401": { "description": "401 Missing WWW-Authenticate Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"authentication required but no challenge header was sent\"}" } } } } } }, "/fromhell/status-code/405-no-allow": { "post": { "tags": [ "API From Hell" ], "summary": "405 Missing Allow Header", "description": "Returns a method-not-allowed response body.\n\nWhat is wrong: The status is 405 Method Not Allowed, but the response does not include Allow.\n\nWhat to check in your client: A REST client should show the missing allowed-methods metadata.", "operationId": "postFromHellstatus_code_405_no_allow", "responses": { "405": { "description": "405 Missing Allow Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"method not allowed but no Allow header was sent\"}" } } } } } }, "/fromhell/status-code/416-no-content-range": { "get": { "tags": [ "API From Hell" ], "summary": "416 Missing Content-Range Header", "description": "Returns an unsatisfied range response body.\n\nWhat is wrong: The status is 416 Range Not Satisfiable, but the response does not include Content-Range.\n\nWhat to check in your client: A REST client should show the missing range explanation.", "operationId": "getFromHellstatus_code_416_no_content_range", "responses": { "416": { "description": "416 Missing Content-Range Header", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"range not satisfiable but no Content-Range header was sent\"}" } } } } } }, "/fromhell/status-code/200-error-body": { "get": { "tags": [ "API From Hell" ], "summary": "200 Error-Shaped Body", "description": "Returns a normal success status.\n\nWhat is wrong: The status is 200 OK, but the body is shaped like an error response.\n\nWhat to check in your client: A REST client should make it easy to inspect both status and body without assuming the request succeeded.", "operationId": "getFromHellstatus_code_200_error_body", "responses": { "200": { "description": "200 Error-Shaped Body", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"error\":\"Everything is broken\",\"code\":\"NOT_OK\"}" } } } } } }, "/fromhell/status-code/500-success-body": { "get": { "tags": [ "API From Hell" ], "summary": "500 Success-Shaped Body", "description": "Returns a server error status.\n\nWhat is wrong: The status is 500 Internal Server Error, but the body claims success.\n\nWhat to check in your client: A REST client should make it easy to inspect both status and body without assuming the body is truthful.", "operationId": "getFromHellstatus_code_500_success_body", "responses": { "500": { "description": "500 Success-Shaped Body", "headers": { "Content-Type": { "schema": { "type": "string" }, "example": "application/json" }, "Access-Control-Allow-Origin": { "schema": { "type": "string" }, "example": "*" }, "Access-Control-Allow-Methods": { "schema": { "type": "string" }, "example": "GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS" }, "Access-Control-Allow-Headers": { "schema": { "type": "string" }, "example": "Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With" } }, "content": { "application/json": { "schema": { "type": "string" }, "example": "{\"success\":true,\"message\":\"The body says success but the status is 500\"}" } } } } } } } }