What the specification defines
The file lists the trusted server origins, one API-key security scheme, two POST operations, multipart request bodies, image and video result schemas, and the API error schema. It documents risk ranges, nullable fields, billability, status codes, rate-limit headers, and retry guidance.
The description also states that every request creates a new unique_trx_id and is not idempotent. Preserve that behavior in generated clients, gateways, and test harnesses.
Keep version boundaries explicit
OpenAPI 3.0.3 is the document format. The info.version value 1.0.0 is the public API contract version. neuraldefend, @neuraldefend/sdk, and neuraldefend-mcp have independent package versions.
Record all three dimensions when troubleshooting a generated or wrapped integration: the spec revision, the package version, and the selected environment.
Generate carefully and validate behavior
A generated client can model paths and schemas, but code generation does not supply API access, authorization controls, review policy, retry ownership, or safe browser credential handling. Add those application responsibilities explicitly.
Contract tests should cover both scored and rejected HTTP 200 responses, nullable fields, 400 validation rejection, 401, 403, 429 with Retry-After, 500, and 503. Test separate image and video envelopes rather than one generic response.
Evidence boundary
Limitations
- The public specification does not define tenant-specific entitlements, pricing, retention, residency, support terms, or a browser credential service.
Source record
