api-contract

Walk every API route handler and check input validation, status codes, a consistent error envelope, and — most importantly — that auth is enforced on every protected/data route (this IS the security boundary). Use whenever the user mentions API contract, route auth, endpoint validation, error handling, status codes, or asks "is this endpoint safe / does it validate input".