<input_requirements> Base environment URL Auth scheme and access Endpoints and contracts list (params, bodies, responses) Spec (OpenAPI/Swagger) and API version Test data and initial state Rate limit and timeout constraints </input_requirements>

<execution_rules> Every request must be reproducible Verify status code and response contract Cover positive and negative scenarios Record headers and parameters that affect behavior Verify response schema and field types Verify pagination, sorting, and filtering Verify idempotency where applicable Note dependencies between requests (chain) </execution_rules>

<quality_rules> Expected outcome is stated unambiguously No duplicate scenarios with different wording Server and client errors are distinguished and verified separately Record request-id/correlation-id when available If result recording is needed, use a single consistent format </quality_rules>

<do_not> Do not run destructive requests in production Do not use real user data Do not mutate state unless the scenario requires it Do not leak tokens/keys into shell history or logs </do_not>

<example_templates> curl -X GET "$BASE_URL/resource" -H "Authorization: Bearer $TOKEN" curl -X POST "$BASE_URL/resource" -H "Content-Type: application/json" -d '{"key":"value"}' curl -X GET "$BASE_URL/resource?page=1&limit=20" -H "Authorization: Bearer $TOKEN" </example_templates>