Audit API contracts, boundary validation, authorization, consistency, pagination, errors, and idempotency.
