# Legacy API golden fixtures

Captured from `https://api.press.zone` by `capture.mjs`. Re-run with `node docs/contracts/fixtures/capture.mjs`; credentials are loaded from `devzone-db` at runtime and scrubbed before writes.

| Endpoint | Scenarios captured (HTTP status) | Outcome / omitted scenarios |
|---|---|---|
| `POST /v1/translate` | happy-path (200), missing-auth (401), invalid-auth (401), malformed-body (400) | Captured |
| `POST /v1/translate/bulk` | happy-path (200), missing-auth (401), invalid-auth (401), malformed-body (400) | Captured |
| `POST /v1/jobs` | happy-path (202), missing-auth (401), invalid-auth (401), malformed-body (400) | Captured |
| `POST /v1/jobs/bulk-strings` | happy-path (202), missing-auth (401), invalid-auth (401), malformed-body (400) | Captured |
| `GET /v1/jobs/{api_job_id}` | happy-path (200), missing-auth (401), invalid-auth (401) | Captured |
| `POST /v1/estimate` | happy-path (200), missing-auth (401), invalid-auth (401), malformed-body (400), rate-limit-probe (200) | Captured |
| `POST /v1/exceptions/sync` | missing-auth (401), invalid-auth (401), malformed-body (400) | happy-path: Not triggerable safely: happy path fully replaces server exception state. |
| `GET /v1/exceptions?limit=100` | happy-path (200), missing-auth (401), invalid-auth (401) | Captured |
| `POST /v1/sites/register` | happy-path (500), missing-auth (401), invalid-auth (401), malformed-body (400) | Captured |
| `PATCH /v1/sites/{site_id}` | happy-path (500), missing-auth (401), invalid-auth (401), malformed-body (500) | Captured |
| `GET /v1/onboarding/plans?plugin=international` | happy-path (200), missing-auth (200), invalid-auth (200) | Captured |
| `POST /v1/auth/register` | happy-path (201), missing-auth (400), malformed-body (400), invalid-auth (400) | Captured |
| `POST /v1/auth/login` | happy-path (200), missing-auth (200), malformed-body (400), invalid-auth (200) | Captured |
| `POST /v1/onboarding/checkout` | malformed-body (403), missing-auth (403), invalid-auth (403) | happy-path: Not triggerable under safety rule: valid payload could initiate a checkout flow. |
| `POST /v1/onboarding/upgrade` | malformed-body (403), missing-auth (403), invalid-auth (403) | happy-path: Not triggerable under safety rule: valid payload could initiate a checkout flow. |
| `POST /v1/subscriptions/checkout` | malformed-body (404), missing-auth (404), invalid-auth (404) | happy-path: Not triggerable under safety rule: valid payload could initiate a checkout flow. |
| `GET /v1/subscriptions/checkout-sessions/{id}` | happy-path (404), missing-auth (404), invalid-auth (404) | Captured |
| `POST /v1/international/license/activate` | malformed-body (400), invalid-auth (400) | happy-path: Not triggerable safely: successful request mutates license activation state.; missing-auth: Not applicable: license key is body credential; endpoint has no authorization header. |
| `POST /v1/international/license/deactivate` | malformed-body (400), invalid-auth (400) | happy-path: Not triggerable safely: successful request mutates license activation state.; missing-auth: Not applicable: license key is body credential; endpoint has no authorization header. |
| `POST /v1/international/license/validate` | happy-path (400), missing-auth (400), malformed-body (400), invalid-auth (400) | Captured |
| `GET /v1/international/license/status` | happy-path (200), missing-auth (200), invalid-auth (200) | Captured |
| `GET /v1/international/updates/check` | happy-path (404), missing-auth (404), invalid-auth (404) | Captured |
| `GET /health` | happy-path (200), missing-auth (200), invalid-auth (200), rate-limit-probe (200) | Captured |

## Findings

- No API rate limiting observed: 40 concurrent `GET /health` plus 15 concurrent `POST /v1/estimate` requests returned zero HTTP 429 responses.
- Insufficient credits (402) not triggered: draining shared test credits was prohibited.
- Payment checkout endpoints captured validation errors only; no PayPal flow was initiated.
- License activation/deactivation happy paths skipped because they mutate shared license state.
- Exception sync happy path skipped because it replaces shared server exception state.
- `POST /v1/sites/register` returned 500 `SITE_REGISTRATION_FAILED`; dependent site PATCH returned 500 `UPDATE_SITE_FAILED` using the sentinel ID.
- Stored `ipz_license_key` failed legacy validation with 400 `VALIDATION_ERROR` (`Invalid license key format`).
- `GET /v1/international/updates/check` returned 404 `NOT_FOUND`; route appears absent on the live legacy backend.