API Contract Review
Audits Spring/REST controllers for HTTP verbs, versioning, status codes, and compatibility
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 21, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · d7128c8
Fetched SKILL.md + README via GitHub API/raw; both referenced files return HTTP 200, frontmatter has name+description, no external scripts, no security smells (only benign inline grep tips). Wrote a Spring UserController with planted issues (GET-based delete, POST for idempotent update, no /v1/, entity return, null-on-miss, Map status:200 body) and produced two reviews. Baseline caught the GET-delete, null-return, entity leak, and missing pagination but MISSED versioning, the wrong PUT/POST verb, the 200-with-status-body anti-pattern, and missing @Valid; the skill review caught all of those and organized findings by the 6 categories while dropping off-topic hygiene noise (constructor injection). Trigger judgment: loads on "review the REST endpoints in UserController", "check my API before I release", "are my HTTP verbs/status codes right"; correctly does NOT load on "write a new REST controller for orders" (creation, not audit) or "review my DB schema for indexing" (not REST) — 5/5.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 7/10
- Docs & honesty 5/5
What API Contract Review does
Reviews REST API controllers (Java/Spring-focused) against a 6-point checklist covering HTTP verb semantics, URL versioning, DTO-vs-entity leaks, status-code correctness, error-response format, and backward compatibility. Triggers when the user asks to review an API, check REST endpoints, or before releasing API changes. Pairs with spring-boot-patterns, which writes controllers while this one audits them.
How to install API Contract Review
git clone --depth 1 https://github.com/decebals/claude-code-java.git /tmp/api-contract-review-src
mkdir -p ~/.claude/skills
cp -R /tmp/api-contract-review-src/.claude/skills/api-contract-review ~/.claude/skills/api-contract-review
# Self-contained: SKILL.md + README.md only, no external scripts or deps.
# Java/Spring-oriented (Spring annotations, JPA entities), but the HTTP/REST
# checklist applies to any REST API. No API keys, no tools to install.
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger API Contract Review
-
/api-contract-reviewAudits Spring/REST controllers for HTTP verbs, versioning, status codes, and compatibility
It also activates on plain-language prompts like these:
-
Review this API for backward compatibility issues -
Check these endpoints for REST semantics violations -
Review the API contract before releasing v2
Frequently asked questions
- Is the API Contract Review skill free?
- Yes. The skill itself is free from decebals/claude-code-java. SkillProof publishes the install command and an independent test verdict at no cost.
- Does API Contract Review work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Fetched SKILL.md + README via GitHub API/raw; both referenced files return HTTP 200, frontmatter has name+description, no external scripts, no security smells (only benign inline grep tips). Wrote a Spring UserController with planted issues (GET-based delete, POST for idempotent update, no /v1/, entity return, null-on-miss, Map status:200 body) and produced two reviews. Baseline caught the GET-delete, null-return, entity leak, and missing pagination but MISSED versioning, the wrong PUT/POST verb, the 200-with-status-body anti-pattern, and missing @Valid; the skill review caught all of those and organized findings by the 6 categories while dropping off-topic hygiene noise (constructor injection). Trigger judgment: loads on "review the REST endpoints in UserController", "check my API before I release", "are my HTTP verbs/status codes right"; correctly does NOT load on "write a new REST controller for orders" (creation, not audit) or "review my DB schema for indexing" (not REST) — 5/5.
- What is the API Contract Review SkillProof Score?
- 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.
- How do I install API Contract Review?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use API Contract Review with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.