Mandatory Response Assertions

This rule applies to files matching the patterns above.

# Mandatory Response Assertions

## Rule
Every Bruno request MUST include assertions that validate the response. Requests without assertions are prohibited — they exercise the API without verifying behavior.

## Minimum Required Assertions
```
assert {
  res.status: eq 200          # Always check status code
  res.body.data: isDefined     # Always validate response structure
}
```

## Per-Method Requirements

### GET Requests
```
assert {
  res.status: eq 200
  res.body: isDefined
  res.headers.content-type: contains "application/json"
}
```

### POST Requests (Create)
```
assert {
  res.status: eq 201
  res.body.id: isDefined
  res.body.name: eq "{{expectedName}}"
}
```

### PUT/PATCH Requests (Update)
```
assert {
  res.status: eq 200
  res.body.updatedAt: isDefined
}
```

### DELETE Requests
```
assert {
  res.status: eq 204
}
```

### Error Responses
```
assert {
  res.status: eq 401
  res.body.error: isDefined
}
```

## Examples

### Good
```
meta { name: List Products }
get { url: {{baseUrl}}/api/products }

assert {
  res.status: eq 200
  res.body.data: isArray
  res.body.pagination.total: gte 0
  res.headers.content-type: contains "application/json"
}
```

### Bad
```
meta { name: List Products }
get { url: {{baseUrl}}/api/products }
# No assertions — passes even if API returns 500
```

## Anti-Patterns
- Requests with no assert block and no post-response script assertions
- Checking only status code without response body validation
- Only testing success cases (200, 201) without error cases (401, 422, 500)
- Using Bruno purely for manual exploration without any assertions