Inferensys

Prompt

API Contract Generation Demonstration Prompt

A practical prompt playbook for using API Contract Generation Demonstration Prompt in production AI workflows.
Operations team reviewing AI workflow automation on laptop, workflow builder visible, casual office setup.
PROMPT PLAYBOOK

When to Use This Prompt

Defines the job, ideal user, and constraints for using the API Contract Generation Demonstration Prompt.

This prompt is for integration engineers and AI developers who need to generate a valid OpenAPI or GraphQL schema from a set of example request-response pairs. The core job-to-be-done is teaching a model to infer a strict, typed API contract by observing concrete HTTP interactions, rather than relying on verbose natural-language instructions. This is the right tool when you have a collection of raw API traffic, curl commands, or log excerpts and you need a machine-readable specification that downstream tools, code generators, and validators can consume without manual cleanup.

Use this prompt when the desired output is a structural specification, not a prose description. It is ideal for reverse-engineering internal or third-party APIs where documentation is missing, stale, or non-existent. The required context includes a set of at least 3-5 diverse example interactions covering different endpoints, HTTP methods, success and error responses, and authentication headers. The prompt is designed to work with a few-shot demonstration pattern, where you provide formatted input-output pairs that explicitly model endpoint discovery, parameter typing, error response modeling, and authentication annotation. Do not use this prompt for generating API client code, writing prose documentation, or designing a new API from scratch—it infers a contract from existing traffic, it does not architect a greenfield API.

Before wiring this into a production pipeline, validate the generated schema against the OpenAPI or GraphQL specification using a standard linter like spectral or graphql-inspector. The prompt includes a harness for schema conformance checks, but you must add a human review step if the generated contract will be used to enforce request validation, generate SDKs, or configure an API gateway. The most common failure mode is the model hallucinating optional fields or endpoints not present in the provided examples; always diff the generated contract against the source traffic to catch additions. Proceed by collecting your example pairs, formatting them according to the demonstration structure, and running the prompt with a strict output schema constraint.

PRACTICAL GUARDRAILS

Use Case Fit

Where the API Contract Generation Demonstration Prompt works, where it fails, and what you need before you start.

01

Good Fit: Greenfield Endpoint Discovery

Use when: You have a collection of raw HTTP request/response pairs and need an initial OpenAPI or GraphQL schema draft. Guardrail: Treat the output as a first draft. Always validate against the formal spec and diff against actual traffic before committing.

02

Bad Fit: Undocumented Legacy Protocols

Avoid when: The API uses binary protocols, custom RPC framing, or non-HTTP transports. The model will hallucinate RESTful semantics onto non-RESTful systems. Guardrail: Use a protocol-specific parser first; feed structured traces, not raw bytes, into the prompt.

03

Required Input: Authenticated Traffic Samples

Risk: Generating schemas from unauthenticated public endpoints misses auth headers, scopes, and error codes. Guardrail: Include at least one example per auth state (anonymous, user, admin) with redacted tokens. Explicitly annotate the auth mechanism in the demonstration block.

04

Required Input: Error Response Diversity

Risk: Schemas generated only from 200 OK responses lack error models, status codes, and validation failure shapes. Guardrail: Curate examples that include 400, 401, 403, 422, and 500 responses. The prompt should teach error schema modeling as a first-class concern, not an afterthought.

05

Operational Risk: Schema Drift from Stale Examples

Risk: The generated contract reflects the examples you provided, not the current API behavior. If the API has changed, the schema will be silently wrong. Guardrail: Version-lock your example sets to API versions. Run a periodic diff between generated schemas and live traffic to detect drift.

06

Operational Risk: Parameter Type Overfitting

Risk: The model infers types from observed values. A field that always contains "123" in examples may be typed as integer when it is actually a string identifier. Guardrail: Add a post-generation validation step that flags fields where the inferred type conflicts with a known type registry or where the sample values are ambiguous.

PROMPT PLAYBOOK

Copy-Ready Prompt Template

A reusable prompt template for generating OpenAPI schemas from example request-response pairs, with placeholders for inputs, constraints, and output validation.

This prompt template teaches a model to generate an OpenAPI 3.0 specification from a set of example HTTP request-response pairs. It uses few-shot demonstrations to show the model how to infer endpoint paths, parameter types, request bodies, response schemas, error codes, and authentication annotations. The template is designed for integration engineers who need a starting point that can be adapted to their own API surface and documentation standards.

text
You are an API specification generator. Given example HTTP request-response pairs, produce a valid OpenAPI 3.0 YAML specification.

Follow these rules:
- Infer the base URL, endpoint paths, HTTP methods, and parameter locations from the examples.
- For each endpoint, define request parameters (path, query, header, cookie) with types, required flags, and descriptions.
- Define request bodies with JSON Schema for content types present in the examples.
- Define response schemas for each status code observed, including error responses.
- Add authentication annotations (e.g., bearerAuth, apiKey) if headers like Authorization or X-API-Key appear.
- Use consistent naming: camelCase for properties, kebab-case for paths.
- Include operationId, summary, and description fields for every operation.
- If an example is ambiguous, mark the inferred field with a comment: # INFERRED: <reason>.
- Output ONLY the YAML specification, no surrounding explanation.

[EXAMPLES]

[INPUT]

[OUTPUT_SCHEMA]

[CONSTRAINTS]

To adapt this template, replace [EXAMPLES] with 2-4 annotated demonstration pairs showing raw HTTP traffic and the corresponding OpenAPI fragment. Replace [INPUT] with the new request-response pairs to process. Use [OUTPUT_SCHEMA] to specify the expected top-level OpenAPI structure (e.g., openapi: 3.0.0, info, servers, paths, components). Use [CONSTRAINTS] to add domain-specific rules such as required error codes, naming conventions, or security scheme types. After generation, validate the output against the OpenAPI 3.0 specification using a schema validator. For production use, add a human review step to confirm inferred types, required fields, and authentication annotations before publishing the contract.

IMPLEMENTATION TABLE

Prompt Variables

Required inputs for the API Contract Generation Demonstration Prompt. Each placeholder must be populated before the prompt is sent to the model. Validation notes describe how to programmatically verify the input before assembly.

PlaceholderPurposeExampleValidation Notes

[API_DESCRIPTION]

Natural-language summary of the API's purpose, domain, and primary resources

A REST API for managing warehouse inventory items, including stock levels, locations, and reorder thresholds

Non-empty string check. Must contain at least one resource noun. Reject if length < 20 characters or purely generic phrases like 'an API'.

[ENDPOINT_EXAMPLES]

3-5 example request-response pairs showing HTTP method, path, request body, and response body

GET /items/42 -> 200 { id: 42, name: 'Widget', quantity: 15 }

Parse each pair as valid JSON or structured object. Verify method is a recognized HTTP verb. Confirm response includes a status code. Reject if fewer than 3 pairs provided.

[AUTH_TYPE]

Authentication mechanism to document in the generated contract

Bearer JWT with scopes: items:read, items:write

Must match one of: 'none', 'api_key', 'bearer_jwt', 'oauth2', 'basic'. Reject unrecognized values. If 'oauth2', require [AUTH_SCOPES] to be non-empty.

[AUTH_SCOPES]

Permission scopes required for endpoints, mapped to operations

items:read for GET endpoints, items:write for POST/PUT/DELETE

Must be a non-empty array of scope strings if [AUTH_TYPE] is 'bearer_jwt' or 'oauth2'. Each scope must match pattern ^[a-z_]+:[a-z_]+$. Null allowed only when [AUTH_TYPE] is 'none' or 'api_key'.

[OUTPUT_FORMAT]

Target specification format for the generated contract

openapi_3_1

Must be one of: 'openapi_3_0', 'openapi_3_1', 'graphql_schema', 'json_schema'. Reject unrecognized values. Determines which validator is used on the output.

[ERROR_RESPONSE_EXAMPLES]

2-3 example error responses showing status codes, error bodies, and conditions

404 { error: 'ItemNotFound', message: 'No item with id 99' }

Parse each as valid JSON. Verify status code is in 4xx or 5xx range. Confirm each example includes an error code or message field. Reject if fewer than 2 examples.

[PAGINATION_STYLE]

Pagination mechanism used by the API, if any

cursor-based with next_cursor field in response meta

Must be one of: 'none', 'offset_limit', 'cursor_based', 'page_number'. If 'none', the generated contract should omit pagination parameters. Reject unrecognized values.

[ADDITIONAL_CONSTRAINTS]

Extra rules the generated contract must satisfy, such as required headers, rate limiting, or versioning

All endpoints require X-Request-ID header. API version is v2 and must appear in the base path /v2/.

Null allowed. If provided, must be a non-empty string. Each constraint is checked post-generation by keyword presence in the output contract. Reject if constraints contradict [ENDPOINT_EXAMPLES].

PROMPT PLAYBOOK

Implementation Harness Notes

How to wire the API contract generation prompt into a reliable application workflow with validation, retries, and spec compliance checks.

The API Contract Generation Demonstration Prompt is designed to be embedded in a pipeline that takes raw request-response pairs and produces a validated OpenAPI or GraphQL schema. This is not a one-shot chat interaction—it's a structured generation step that must be followed by automated validation, repair loops, and human review for production use. The prompt's few-shot demonstrations teach the model to discover endpoints, infer parameter types, model error responses, and annotate authentication requirements, but the output must be treated as a draft that requires mechanical verification before it touches any downstream system.

Wire the prompt into an application by first assembling the input context: a set of example request-response pairs, any known base URLs, and the target specification format (OpenAPI 3.1 or GraphQL SDL). Pass these into the prompt template using the [INPUT_EXAMPLES], [BASE_URL], and [SPEC_FORMAT] placeholders. After generation, run the output through a spec validator—openapi-spec-validator for OpenAPI or graphql npm package for SDL—to catch structural errors immediately. If validation fails, feed the error messages back into a repair prompt (see the Few-Shot JSON Repair Demonstration Prompt in this pillar) with a maximum of two retry attempts. Log every generation attempt, validation result, and repair step for observability. For high-risk integrations where the generated contract will be used to generate client SDKs or enforce API gateways, require human review of endpoint paths, parameter types, and authentication scopes before acceptance.

Model choice matters here. Use a model with strong structured output capabilities and a context window large enough to hold your example pairs plus the prompt. For OpenAPI generation, prefer models that have been fine-tuned on code and schema tasks. Set temperature low (0.0–0.2) to reduce creative drift in field names and type inference. If your examples include sensitive request bodies or authentication tokens, strip those before they enter the prompt—this prompt should work with sanitized shape-only examples. The next step after implementing this harness is to build a regression test suite using known request-response pairs and their expected schema outputs, so you can detect when model updates or prompt changes silently degrade contract quality.

IMPLEMENTATION TABLE

Expected Output Contract

Validate the generated API contract against these fields and rules before integrating it into your application or spec pipeline.

Field or ElementType or FormatRequiredValidation Rule

openapi

String (version)

Must equal '3.0.3' or '3.1.0'

info.title

String

Non-empty, matches [API_NAME] placeholder

info.version

String (semver)

Must match semver pattern (e.g., '1.0.0')

paths

Object

At least one path; each key must start with '/'

paths.[endpoint].[method].parameters

Array of objects

If present, each object must have 'name' and 'in' fields

paths.[endpoint].requestBody.content

Object

If present, must include 'application/json' schema

paths.[endpoint].responses

Object

Must include at least '200' or '201' response; 'default' allowed

components.schemas

Object

If present, each schema must have 'type' or '$ref'

PRACTICAL GUARDRAILS

Common Failure Modes

API contract generation prompts fail in predictable ways. These cards cover the most common failure modes when generating OpenAPI or GraphQL schemas from example request-response pairs, along with concrete guardrails to prevent them.

01

Schema Drift from Inconsistent Examples

What to watch: When demonstration pairs show the same field with different types (e.g., id as string in one example, integer in another), the model guesses a type or invents a union, producing an invalid or overly permissive schema. Guardrail: Pre-validate all example payloads against a target type map before inclusion. Add a constraint like [CONSTRAINTS: Field types must be consistent across all examples. If a field appears with conflicting types, use the most restrictive valid type and note the conflict.]

02

Missing Error Response Models

What to watch: Demonstration pairs often only show happy-path 200 responses. The model omits 4xx and 5xx response schemas entirely, leaving the generated contract incomplete for client error handling. Guardrail: Require at least one error example per endpoint in the demonstration set. Add an explicit instruction: [CONSTRAINTS: For every endpoint, include at least one error response schema (400, 401, 404, or 500) even if no error example is provided. Use standard RFC 7807 Problem Details format when uncertain.]

03

Authentication Annotation Omission

What to watch: The model generates endpoint paths and parameters correctly but fails to annotate security requirements (security: [{bearerAuth: []}]) because the examples don't visibly show auth headers or tokens. Guardrail: Include a dedicated demonstration pair showing an unauthenticated request with a 401 response. Add a schema-level instruction: [CONSTRAINTS: Every endpoint must declare security requirements. Default to bearerAuth unless examples show a different scheme.]

04

Parameter Location Confusion

What to watch: The model misclassifies parameters as query when they should be path, or places IDs in the request body instead of the URL. This happens when examples show full URLs without decomposing them into parameterized templates. Guardrail: Structure demonstrations with explicit parameter tables showing name, in, required, and schema for each parameter. Add eval checks that count path parameter mismatches against the example URL patterns.

05

Nested Schema Depth Explosion

What to watch: When example response bodies contain deeply nested objects, the model inlines all nested schemas rather than extracting reusable $ref components, producing bloated and unmaintainable specs. Guardrail: Add a post-generation validation step that flags inline objects deeper than 2 levels and prompts a repair pass: [REPAIR: Extract all nested objects at depth 3+ into named component schemas and replace with $ref references.]

06

Enum Value Leakage from Example Data

What to watch: The model treats every observed string value in examples as the complete enum, missing valid values that didn't appear in the demonstration set. A status field showing only "active" and "pending" omits "archived" and "suspended". Guardrail: Require an explicit enum specification alongside examples. Add: [CONSTRAINTS: For enum fields, use the provided enum definition list, not only values observed in examples. If no enum list is provided, mark the field with x-extensible-enum: true and note that the values are example-driven.]

IMPLEMENTATION TABLE

Evaluation Rubric

Criteria for evaluating the quality of generated API contracts before integrating them into a CI/CD pipeline or documentation. Use this rubric to gate outputs programmatically or during manual review.

CriterionPass StandardFailure SignalTest Method

Schema Validity

Output passes strict OpenAPI 3.1 or GraphQL schema validator with zero errors.

Validator returns syntax errors, missing required fields, or type mismatches.

Automated: Parse output with a standard schema validator library. Fail on any error.

Endpoint Completeness

All endpoints present in the [INPUT_EXAMPLES] are represented in the generated contract.

An HTTP method or path from the demonstration examples is missing from the paths object.

Automated: Extract unique method+path tuples from [INPUT_EXAMPLES] and check for corresponding entries in the output.

Parameter Typing Accuracy

Path, query, header, and cookie parameters match the types and required flags shown in [INPUT_EXAMPLES].

A parameter is typed as string when an example shows an integer, or a required parameter is marked optional.

Automated: For each parameter in [INPUT_EXAMPLES], assert type and required boolean match the output schema.

Response Schema Fidelity

Response schemas for each status code correctly model the structure, nesting, and field types from [INPUT_EXAMPLES].

A field is missing, an array is modeled as an object, or a nested object is flattened.

Automated: Deep-compare the JSON structure of example responses against the generated schemas. Flag structural diffs.

Error Response Modeling

At least the 4XX and 5XX error responses shown in [INPUT_EXAMPLES] are represented with their correct schemas.

Error responses from the examples are omitted, or their schemas are replaced with a generic object.

Automated: Check for the presence of documented error status codes and verify their schema is not the default empty object.

Authentication Annotation

Security scheme and requirement objects correctly reflect the auth pattern demonstrated (e.g., Bearer token in headers).

The security field is missing, or the scheme type (http, apiKey, oauth2) is incorrect.

Automated: Assert the securitySchemes and global security requirements match a known set of expected patterns from [INPUT_EXAMPLES].

No Hallucinated Endpoints

The contract contains only endpoints, parameters, and schemas directly traceable to [INPUT_EXAMPLES].

A new endpoint, parameter, or schema is present that has no supporting evidence in the provided examples.

Automated: Diff the generated paths and schemas against a reference set extracted from [INPUT_EXAMPLES]. Flag any additions.

Description Quality

Endpoints, parameters, and schemas include concise, non-hallucinatory descriptions derived from example context.

Descriptions are missing entirely, are generic placeholders, or invent business logic not present in [INPUT_EXAMPLES].

Manual: Review a sample of descriptions for relevance and grounding. Automated: Flag empty description fields.

ADAPTATION OPTIONS

Adapt This Prompt

How to adapt

Start with the base demonstration prompt using 2–3 simple request-response pairs. Drop authentication annotations and error response modeling initially. Focus on teaching endpoint discovery and basic parameter typing. Use inline JSON examples without strict schema validation.

code
[REQUEST]
GET /users/123

[RESPONSE]
{"id": 123, "name": "string", "email": "string"}

Watch for

  • Missing required OpenAPI fields like paths, responses, or info
  • Parameter types defaulting to string when integer or boolean is correct
  • No required field on parameters that are clearly mandatory
Prasad Kumkar

About the author

Prasad Kumkar

CEO & MD, Inference Systems

Prasad Kumkar is the CEO & MD of Inference Systems and writes about AI systems architecture, LLM infrastructure, model serving, evaluation, and production deployment. Over 5+ years, he has worked across computer vision models, L5 autonomous vehicle systems, and LLM research, with a focus on taking complex AI ideas into real-world engineering systems.

His work and writing cover AI systems, large language models, AI agents, multimodal systems, autonomous systems, inference optimization, RAG, evaluation, and production AI engineering.