This prompt is for integration engineers and AI developers who need to generate a valid OpenAPI or GraphQL schema from a set of example request-response pairs. The core job-to-be-done is teaching a model to infer a strict, typed API contract by observing concrete HTTP interactions, rather than relying on verbose natural-language instructions. This is the right tool when you have a collection of raw API traffic, curl commands, or log excerpts and you need a machine-readable specification that downstream tools, code generators, and validators can consume without manual cleanup.
Prompt
API Contract Generation Demonstration Prompt

When to Use This Prompt
Defines the job, ideal user, and constraints for using the API Contract Generation Demonstration Prompt.
Use this prompt when the desired output is a structural specification, not a prose description. It is ideal for reverse-engineering internal or third-party APIs where documentation is missing, stale, or non-existent. The required context includes a set of at least 3-5 diverse example interactions covering different endpoints, HTTP methods, success and error responses, and authentication headers. The prompt is designed to work with a few-shot demonstration pattern, where you provide formatted input-output pairs that explicitly model endpoint discovery, parameter typing, error response modeling, and authentication annotation. Do not use this prompt for generating API client code, writing prose documentation, or designing a new API from scratch—it infers a contract from existing traffic, it does not architect a greenfield API.
Before wiring this into a production pipeline, validate the generated schema against the OpenAPI or GraphQL specification using a standard linter like spectral or graphql-inspector. The prompt includes a harness for schema conformance checks, but you must add a human review step if the generated contract will be used to enforce request validation, generate SDKs, or configure an API gateway. The most common failure mode is the model hallucinating optional fields or endpoints not present in the provided examples; always diff the generated contract against the source traffic to catch additions. Proceed by collecting your example pairs, formatting them according to the demonstration structure, and running the prompt with a strict output schema constraint.
Use Case Fit
Where the API Contract Generation Demonstration Prompt works, where it fails, and what you need before you start.
Good Fit: Greenfield Endpoint Discovery
Use when: You have a collection of raw HTTP request/response pairs and need an initial OpenAPI or GraphQL schema draft. Guardrail: Treat the output as a first draft. Always validate against the formal spec and diff against actual traffic before committing.
Bad Fit: Undocumented Legacy Protocols
Avoid when: The API uses binary protocols, custom RPC framing, or non-HTTP transports. The model will hallucinate RESTful semantics onto non-RESTful systems. Guardrail: Use a protocol-specific parser first; feed structured traces, not raw bytes, into the prompt.
Required Input: Authenticated Traffic Samples
Risk: Generating schemas from unauthenticated public endpoints misses auth headers, scopes, and error codes. Guardrail: Include at least one example per auth state (anonymous, user, admin) with redacted tokens. Explicitly annotate the auth mechanism in the demonstration block.
Required Input: Error Response Diversity
Risk: Schemas generated only from 200 OK responses lack error models, status codes, and validation failure shapes. Guardrail: Curate examples that include 400, 401, 403, 422, and 500 responses. The prompt should teach error schema modeling as a first-class concern, not an afterthought.
Operational Risk: Schema Drift from Stale Examples
Risk: The generated contract reflects the examples you provided, not the current API behavior. If the API has changed, the schema will be silently wrong. Guardrail: Version-lock your example sets to API versions. Run a periodic diff between generated schemas and live traffic to detect drift.
Operational Risk: Parameter Type Overfitting
Risk: The model infers types from observed values. A field that always contains "123" in examples may be typed as integer when it is actually a string identifier. Guardrail: Add a post-generation validation step that flags fields where the inferred type conflicts with a known type registry or where the sample values are ambiguous.
Copy-Ready Prompt Template
A reusable prompt template for generating OpenAPI schemas from example request-response pairs, with placeholders for inputs, constraints, and output validation.
This prompt template teaches a model to generate an OpenAPI 3.0 specification from a set of example HTTP request-response pairs. It uses few-shot demonstrations to show the model how to infer endpoint paths, parameter types, request bodies, response schemas, error codes, and authentication annotations. The template is designed for integration engineers who need a starting point that can be adapted to their own API surface and documentation standards.
textYou are an API specification generator. Given example HTTP request-response pairs, produce a valid OpenAPI 3.0 YAML specification. Follow these rules: - Infer the base URL, endpoint paths, HTTP methods, and parameter locations from the examples. - For each endpoint, define request parameters (path, query, header, cookie) with types, required flags, and descriptions. - Define request bodies with JSON Schema for content types present in the examples. - Define response schemas for each status code observed, including error responses. - Add authentication annotations (e.g., bearerAuth, apiKey) if headers like Authorization or X-API-Key appear. - Use consistent naming: camelCase for properties, kebab-case for paths. - Include operationId, summary, and description fields for every operation. - If an example is ambiguous, mark the inferred field with a comment: # INFERRED: <reason>. - Output ONLY the YAML specification, no surrounding explanation. [EXAMPLES] [INPUT] [OUTPUT_SCHEMA] [CONSTRAINTS]
To adapt this template, replace [EXAMPLES] with 2-4 annotated demonstration pairs showing raw HTTP traffic and the corresponding OpenAPI fragment. Replace [INPUT] with the new request-response pairs to process. Use [OUTPUT_SCHEMA] to specify the expected top-level OpenAPI structure (e.g., openapi: 3.0.0, info, servers, paths, components). Use [CONSTRAINTS] to add domain-specific rules such as required error codes, naming conventions, or security scheme types. After generation, validate the output against the OpenAPI 3.0 specification using a schema validator. For production use, add a human review step to confirm inferred types, required fields, and authentication annotations before publishing the contract.
Prompt Variables
Required inputs for the API Contract Generation Demonstration Prompt. Each placeholder must be populated before the prompt is sent to the model. Validation notes describe how to programmatically verify the input before assembly.
| Placeholder | Purpose | Example | Validation Notes |
|---|---|---|---|
[API_DESCRIPTION] | Natural-language summary of the API's purpose, domain, and primary resources | A REST API for managing warehouse inventory items, including stock levels, locations, and reorder thresholds | Non-empty string check. Must contain at least one resource noun. Reject if length < 20 characters or purely generic phrases like 'an API'. |
[ENDPOINT_EXAMPLES] | 3-5 example request-response pairs showing HTTP method, path, request body, and response body | GET /items/42 -> 200 { id: 42, name: 'Widget', quantity: 15 } | Parse each pair as valid JSON or structured object. Verify method is a recognized HTTP verb. Confirm response includes a status code. Reject if fewer than 3 pairs provided. |
[AUTH_TYPE] | Authentication mechanism to document in the generated contract | Bearer JWT with scopes: items:read, items:write | Must match one of: 'none', 'api_key', 'bearer_jwt', 'oauth2', 'basic'. Reject unrecognized values. If 'oauth2', require [AUTH_SCOPES] to be non-empty. |
[AUTH_SCOPES] | Permission scopes required for endpoints, mapped to operations | items:read for GET endpoints, items:write for POST/PUT/DELETE | Must be a non-empty array of scope strings if [AUTH_TYPE] is 'bearer_jwt' or 'oauth2'. Each scope must match pattern ^[a-z_]+:[a-z_]+$. Null allowed only when [AUTH_TYPE] is 'none' or 'api_key'. |
[OUTPUT_FORMAT] | Target specification format for the generated contract | openapi_3_1 | Must be one of: 'openapi_3_0', 'openapi_3_1', 'graphql_schema', 'json_schema'. Reject unrecognized values. Determines which validator is used on the output. |
[ERROR_RESPONSE_EXAMPLES] | 2-3 example error responses showing status codes, error bodies, and conditions | 404 { error: 'ItemNotFound', message: 'No item with id 99' } | Parse each as valid JSON. Verify status code is in 4xx or 5xx range. Confirm each example includes an error code or message field. Reject if fewer than 2 examples. |
[PAGINATION_STYLE] | Pagination mechanism used by the API, if any | cursor-based with next_cursor field in response meta | Must be one of: 'none', 'offset_limit', 'cursor_based', 'page_number'. If 'none', the generated contract should omit pagination parameters. Reject unrecognized values. |
[ADDITIONAL_CONSTRAINTS] | Extra rules the generated contract must satisfy, such as required headers, rate limiting, or versioning | All endpoints require X-Request-ID header. API version is v2 and must appear in the base path /v2/. | Null allowed. If provided, must be a non-empty string. Each constraint is checked post-generation by keyword presence in the output contract. Reject if constraints contradict [ENDPOINT_EXAMPLES]. |
Implementation Harness Notes
How to wire the API contract generation prompt into a reliable application workflow with validation, retries, and spec compliance checks.
The API Contract Generation Demonstration Prompt is designed to be embedded in a pipeline that takes raw request-response pairs and produces a validated OpenAPI or GraphQL schema. This is not a one-shot chat interaction—it's a structured generation step that must be followed by automated validation, repair loops, and human review for production use. The prompt's few-shot demonstrations teach the model to discover endpoints, infer parameter types, model error responses, and annotate authentication requirements, but the output must be treated as a draft that requires mechanical verification before it touches any downstream system.
Wire the prompt into an application by first assembling the input context: a set of example request-response pairs, any known base URLs, and the target specification format (OpenAPI 3.1 or GraphQL SDL). Pass these into the prompt template using the [INPUT_EXAMPLES], [BASE_URL], and [SPEC_FORMAT] placeholders. After generation, run the output through a spec validator—openapi-spec-validator for OpenAPI or graphql npm package for SDL—to catch structural errors immediately. If validation fails, feed the error messages back into a repair prompt (see the Few-Shot JSON Repair Demonstration Prompt in this pillar) with a maximum of two retry attempts. Log every generation attempt, validation result, and repair step for observability. For high-risk integrations where the generated contract will be used to generate client SDKs or enforce API gateways, require human review of endpoint paths, parameter types, and authentication scopes before acceptance.
Model choice matters here. Use a model with strong structured output capabilities and a context window large enough to hold your example pairs plus the prompt. For OpenAPI generation, prefer models that have been fine-tuned on code and schema tasks. Set temperature low (0.0–0.2) to reduce creative drift in field names and type inference. If your examples include sensitive request bodies or authentication tokens, strip those before they enter the prompt—this prompt should work with sanitized shape-only examples. The next step after implementing this harness is to build a regression test suite using known request-response pairs and their expected schema outputs, so you can detect when model updates or prompt changes silently degrade contract quality.
Expected Output Contract
Validate the generated API contract against these fields and rules before integrating it into your application or spec pipeline.
| Field or Element | Type or Format | Required | Validation Rule |
|---|---|---|---|
openapi | String (version) | Must equal '3.0.3' or '3.1.0' | |
info.title | String | Non-empty, matches [API_NAME] placeholder | |
info.version | String (semver) | Must match semver pattern (e.g., '1.0.0') | |
paths | Object | At least one path; each key must start with '/' | |
paths.[endpoint].[method].parameters | Array of objects | If present, each object must have 'name' and 'in' fields | |
paths.[endpoint].requestBody.content | Object | If present, must include 'application/json' schema | |
paths.[endpoint].responses | Object | Must include at least '200' or '201' response; 'default' allowed | |
components.schemas | Object | If present, each schema must have 'type' or '$ref' |
Common Failure Modes
API contract generation prompts fail in predictable ways. These cards cover the most common failure modes when generating OpenAPI or GraphQL schemas from example request-response pairs, along with concrete guardrails to prevent them.
Schema Drift from Inconsistent Examples
What to watch: When demonstration pairs show the same field with different types (e.g., id as string in one example, integer in another), the model guesses a type or invents a union, producing an invalid or overly permissive schema. Guardrail: Pre-validate all example payloads against a target type map before inclusion. Add a constraint like [CONSTRAINTS: Field types must be consistent across all examples. If a field appears with conflicting types, use the most restrictive valid type and note the conflict.]
Missing Error Response Models
What to watch: Demonstration pairs often only show happy-path 200 responses. The model omits 4xx and 5xx response schemas entirely, leaving the generated contract incomplete for client error handling. Guardrail: Require at least one error example per endpoint in the demonstration set. Add an explicit instruction: [CONSTRAINTS: For every endpoint, include at least one error response schema (400, 401, 404, or 500) even if no error example is provided. Use standard RFC 7807 Problem Details format when uncertain.]
Authentication Annotation Omission
What to watch: The model generates endpoint paths and parameters correctly but fails to annotate security requirements (security: [{bearerAuth: []}]) because the examples don't visibly show auth headers or tokens. Guardrail: Include a dedicated demonstration pair showing an unauthenticated request with a 401 response. Add a schema-level instruction: [CONSTRAINTS: Every endpoint must declare security requirements. Default to bearerAuth unless examples show a different scheme.]
Parameter Location Confusion
What to watch: The model misclassifies parameters as query when they should be path, or places IDs in the request body instead of the URL. This happens when examples show full URLs without decomposing them into parameterized templates. Guardrail: Structure demonstrations with explicit parameter tables showing name, in, required, and schema for each parameter. Add eval checks that count path parameter mismatches against the example URL patterns.
Nested Schema Depth Explosion
What to watch: When example response bodies contain deeply nested objects, the model inlines all nested schemas rather than extracting reusable $ref components, producing bloated and unmaintainable specs. Guardrail: Add a post-generation validation step that flags inline objects deeper than 2 levels and prompts a repair pass: [REPAIR: Extract all nested objects at depth 3+ into named component schemas and replace with $ref references.]
Enum Value Leakage from Example Data
What to watch: The model treats every observed string value in examples as the complete enum, missing valid values that didn't appear in the demonstration set. A status field showing only "active" and "pending" omits "archived" and "suspended". Guardrail: Require an explicit enum specification alongside examples. Add: [CONSTRAINTS: For enum fields, use the provided enum definition list, not only values observed in examples. If no enum list is provided, mark the field with x-extensible-enum: true and note that the values are example-driven.]
Evaluation Rubric
Criteria for evaluating the quality of generated API contracts before integrating them into a CI/CD pipeline or documentation. Use this rubric to gate outputs programmatically or during manual review.
| Criterion | Pass Standard | Failure Signal | Test Method |
|---|---|---|---|
Schema Validity | Output passes strict OpenAPI 3.1 or GraphQL schema validator with zero errors. | Validator returns syntax errors, missing required fields, or type mismatches. | Automated: Parse output with a standard schema validator library. Fail on any error. |
Endpoint Completeness | All endpoints present in the [INPUT_EXAMPLES] are represented in the generated contract. | An HTTP method or path from the demonstration examples is missing from the paths object. | Automated: Extract unique method+path tuples from [INPUT_EXAMPLES] and check for corresponding entries in the output. |
Parameter Typing Accuracy | Path, query, header, and cookie parameters match the types and required flags shown in [INPUT_EXAMPLES]. | A parameter is typed as string when an example shows an integer, or a required parameter is marked optional. | Automated: For each parameter in [INPUT_EXAMPLES], assert type and required boolean match the output schema. |
Response Schema Fidelity | Response schemas for each status code correctly model the structure, nesting, and field types from [INPUT_EXAMPLES]. | A field is missing, an array is modeled as an object, or a nested object is flattened. | Automated: Deep-compare the JSON structure of example responses against the generated schemas. Flag structural diffs. |
Error Response Modeling | At least the 4XX and 5XX error responses shown in [INPUT_EXAMPLES] are represented with their correct schemas. | Error responses from the examples are omitted, or their schemas are replaced with a generic object. | Automated: Check for the presence of documented error status codes and verify their schema is not the default empty object. |
Authentication Annotation | Security scheme and requirement objects correctly reflect the auth pattern demonstrated (e.g., Bearer token in headers). | The security field is missing, or the scheme type (http, apiKey, oauth2) is incorrect. | Automated: Assert the securitySchemes and global security requirements match a known set of expected patterns from [INPUT_EXAMPLES]. |
No Hallucinated Endpoints | The contract contains only endpoints, parameters, and schemas directly traceable to [INPUT_EXAMPLES]. | A new endpoint, parameter, or schema is present that has no supporting evidence in the provided examples. | Automated: Diff the generated paths and schemas against a reference set extracted from [INPUT_EXAMPLES]. Flag any additions. |
Description Quality | Endpoints, parameters, and schemas include concise, non-hallucinatory descriptions derived from example context. | Descriptions are missing entirely, are generic placeholders, or invent business logic not present in [INPUT_EXAMPLES]. | Manual: Review a sample of descriptions for relevance and grounding. Automated: Flag empty description fields. |
Enabling Efficiency, Speed & Accuracy
Intelligent Analysis, Decision & Execution
We build AI systems for teams that need search across company data, workflow automation across tools, or AI features inside products and internal software.
Talk to Us
Search across company data
Give teams answers from docs, tickets, runbooks, and product data with sources and permissions.
Useful when people spend too long searching or get different answers from different systems.

Automate internal workflows
Use AI to route work, draft outputs, trigger actions, and keep approvals and logs in place.
Useful when repetitive work moves across multiple tools and teams.

Add AI to products and internal tools
Build assistants, guided actions, or decision support into the software your team or customers already use.
Useful when AI needs to be part of the product, not a separate tool.
Adapt This Prompt
How to adapt
Start with the base demonstration prompt using 2–3 simple request-response pairs. Drop authentication annotations and error response modeling initially. Focus on teaching endpoint discovery and basic parameter typing. Use inline JSON examples without strict schema validation.
code[REQUEST] GET /users/123 [RESPONSE] {"id": 123, "name": "string", "email": "string"}
Watch for
- Missing required OpenAPI fields like
paths,responses, orinfo - Parameter types defaulting to
stringwhenintegerorbooleanis correct - No
requiredfield on parameters that are clearly mandatory

About the author
Prasad Kumkar
CEO & MD, Inference Systems
Prasad Kumkar is the CEO & MD of Inference Systems and writes about AI systems architecture, LLM infrastructure, model serving, evaluation, and production deployment. Over 5+ years, he has worked across computer vision models, L5 autonomous vehicle systems, and LLM research, with a focus on taking complex AI ideas into real-world engineering systems.
His work and writing cover AI systems, large language models, AI agents, multimodal systems, autonomous systems, inference optimization, RAG, evaluation, and production AI engineering.
Partnered with leading AI, data, and software stack.
How We Work
Custom AI workflows for your Business
One-fit-all AI don't work for modern businesses. At Inferensys, we aim to understand your business & custom requirements; which we use to define most efficient agentic workflows, the data, and the tools for your business.
01
Review the use case
We understand the task, the users, and where AI can actually help.
Read more02
Pick the right approach
We define what needs search, automation, or product integration.
Read more03
Build the first useful version
We implement the part that proves the value first.
Read more04
Improve from there
We add the checks and visibility needed to keep it useful.
Read moreThe first call is a practical review of your use case and the right next step.
Talk to Us