API errors & retries
Validate outputs and schemas
Executable checks prove attempts ≤ 3, wall budget ≤ 8s, non-idempotent POSTs never replay without Idempotency-Key on fixtures — including the known misshape behind INC-429-2026-07-11.
1Learn the idea
Read
Schema and policy checks
Add executable validation at the trust boundaries of resilient TypeScript fetch wrapper around POST /v1/chat. Reject unknown fields where they matter, bound string sizes, and coerce only after auth/signature checks when raw bytes are security-relevant. Invariant under test: attempts ≤ 3, wall budget ≤ 8s, non-idempotent POSTs never replay without Idempotency-Key. A TypeScript type or Python annotation is not runtime validation — pair them with parsers.
Read
Golden and adversarial fixtures
Automate the fixtures from setup, including a recreation of INC-429-2026-07-11. Assert both the visible error and the absence of side effects (no provider call, no queue write, no flag flip). Where metrics matter, assert label enums stay bounded.
Read
Implementation artifact
function parseRetryAfter(h: string | null): number | undefined {
if (!h) return undefined;
const sec = Number(h);
if (Number.isFinite(sec) && sec >= 0 && sec <= 60) return Math.floor(sec * 1000);
return undefined; // refuse huge or non-numeric values
}
Read
Gate semantics
Document which failures are client mistakes (4xx) versus operator/config mistakes (5xx/503). Oracle still stands: 429 + Retry-After:2 → sleep once → 200 with attempts=2. Validation should make accidental “success with empty body” impossible for mobile client waiting on a grounded answer.
Read
Stage depth
Property ideas: shuffled field order, Unicode edges, maximum-length strings, and replayed timestamps. Where money, identity, or citations matter, assertion messages should cite the field name. Do not snapshot entire provider payloads in tests; assert semantically. If validation fails open “to keep the demo working,” you have inverted the lab. Tie at least one CI job to the INC-429-2026-07-11 fixture so main cannot regress silently. Re-read attempts ≤ 3, wall budget ≤ 8s, non-idempotent POSTs never replay without Idempotency-Key after each new parser — convenience helpers love to bypass it.
Read
Field notes for `api-error-handling` / `validation`
Table-drive status codes and error codes so reviewers see coverage at a glance. Include a Unicode normalization case if user text is accepted. Verify that oversized bodies fail before CPU-heavy work. Where digests or versions are pinned, assert mismatch behavior. Keep golden files small enough to read in review. CI should fail on skipped tests that mark the incident fixture as xfail without a ticket link. In this chapter the product is resilient TypeScript fetch wrapper around POST /v1/chat, the human stakeholder is mobile client waiting on a grounded answer, and the incident id you design against is INC-429-2026-07-11. Re-state the oracle in your notes — 429 + Retry-After:2 → sleep once → 200 with attempts=2 — and keep the invariant visible: attempts ≤ 3, wall budget ≤ 8s, non-idempotent POSTs never replay without Idempotency-Key. Track retry_attempts_total{outcome} and p95 wall_ms ≤ 8000 as the scoreboard. Surface under change control: POST /v1/chat. If you only have forty minutes, finish the fixture for 429 storm with missing Retry-After that would amplify to 40 calls before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.
Go deeper
Before you start
Why this matters
List three fixtures: one golden success, one schema/auth reject, and one regression for INC-429-2026-07-11. For each, write the exact assertion (status, code, metric, or citation) that must turn red if broken.
In the wild
See how this idea shows up as a product and a company — then come back to the lesson. Skills transfer across vendors.
Related lessons
Check your understanding
Page assessment
Answer from memory. Completion is saved from this evidence, not from opening the next page.
All responses are required.