| name | api-constraints-exhibit |
| title | API Access & Constraints Schedule |
| description | Extracts technical API constraints from OpenAPI/Swagger specs and developer docs into a contract-ready API Access & Constraints Schedule with source traceability, risk flags, and change-control language. Use when drafting legal exhibits or schedules covering API access scope, rate limits, authentication, data fields, or deprecation terms for MSAs, SOWs, or order forms. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/api-constraints-exhibit |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | contracts |
| language | en |
API Access & Constraints Schedule
Converts technical API documentation into a contract exhibit that pins constraints to versioned, timestamped sources. Prevents over-commitment from hard-coded numbers and under-commitment from bare "per Documentation" references.
Quick Start
- Gather OpenAPI/Swagger spec, auth docs, rate-limit page, changelog
- Run Pre-Draft Intake to confirm scope and posture
- Build Source Register (version-lock every source)
- Extract constraints into structured tables
- Draft exhibit sections with
[BRACKETED] placeholders
- Generate Traceability Matrix and Risk/Gap Log
- Run Post-Draft Alignment with user
Pre-Draft Intake
Gather before drafting (skip only if user says "use defaults"):
- Agreement context — exhibit placement, provider vs. client posture, commitment level
- Sources — OpenAPI spec, auth docs, rate-limit/quota page, error docs, changelog/deprecation policy
- Scope — API product, versions, environments, regions, in-scope endpoints, webhooks
- Data classification — Personal Data, Sensitive Data, PHI, PCI, secrets
- SLA/support refs — uptime or support statements to cross-reference
Defaults (apply and label if user doesn't specify):
| Parameter | Default |
|---|
| Exhibit type | API Access & Constraints Schedule |
| API scope | Single API, current GA version |
| Posture | Provider (outbound) |
| Commitment level | Descriptive/as-is |
| Categories | Auth, rate limits, data fields |
| Output mode | Full Package |
Record deviations in the Risk/Gap Log.
Core Workflow
1. Source Register
Lock every source with version and retrieval timestamp:
| ID | Source Type | URL/File | Version/Commit | Retrieved (UTC) | Owner |
|---|
| S-1 | OpenAPI spec | | | | Eng |
| S-2 |
