Enforce documented-required parameters and return the documented message field

[martian56]

A full audit of all 30 endpoints against developer.epoint.az, extracting every documented request and response parameter from the scraped docs and probing the running container against them.

What the audit found

16 places where the sandbox accepted a payload production documents as invalid. This is the dangerous direction: the developer builds against a sandbox that accepts their incomplete request and only finds out on the switch to production.

• language is documented Required on twelve endpoints and was defaulted to az
• display and save_as_template are documented Required on invoice create and update, and were defaulted

15 endpoints omitted the documented message field. An integration reading it got undefined here and a string in production. The production wording is unknown, so an empty string carries the shape and the gap is recorded as unverified.

The contract test only guarded one direction. It checked for fields the sandbox invents but never for documented fields it omits, which is why the message gap sat unnoticed since the contract work landed.

What did not change

token/widget still does not require language. Its doc page lists only public_key, amount, order_id and description.

card-registration-with-pay still withholds ten documented response fields. The documented "response" carries rrn, bank_response and operation_code 200, which can only exist once the customer has paid, so it reads as the callback payload mislabelled as the response. Guessing would invent data; it is recorded as unverified and needs a production capture.

A note on strictness

Where the docs say Required and production might in fact be lenient, enforcing makes the sandbox stricter than production. That is the safe error: the developer sends the field and it works in both places. The unsafe error is the one being fixed here.

Verification

276 API tests, up from 203. 63 of the new ones assert every documented-required field is refused when omitted, and name the field in the refusal.

Re-ran the audit against a rebuilt container on a clean database with every feature granted: 85 omissions probed, 0 accepted. The response-field audit is clean apart from the deliberate withholding above.

Breaking

A request that omitted language, display or save_as_template used to succeed and now fails. That is the point, but it is a behaviour change for anyone already on 0.1.0.