Mandatory Response Assertions

This rule applies to files matching the patterns above.

# Mandatory Response Assertions

## Rule
Every HTTP response in a .hurl file MUST include assertions. Bare HTTP requests without assertions are prohibited — they exercise the API without verifying behavior.

## Minimum Required Assertions
```hurl
GET http://localhost:3000/api/users

HTTP 200
Content-Type: application/json
[Asserts]
jsonpath "$.data" exists
```

## Per-Method Requirements

### GET
```hurl
GET {{base_url}}/api/products
HTTP 200
Content-Type: application/json
[Asserts]
jsonpath "$.data" isCollection
jsonpath "$.data" count >= 0
```

### POST
```hurl
POST {{base_url}}/api/products
Content-Type: application/json
{ "name": "Widget", "price": 10 }

HTTP 201
[Asserts]
jsonpath "$.id" exists
jsonpath "$.name" == "Widget"
```

### Error Responses
```hurl
GET {{base_url}}/api/protected
HTTP 401
[Asserts]
jsonpath "$.error" exists
```

## Examples

### Good
```hurl
GET {{base_url}}/api/health
HTTP 200
[Asserts]
jsonpath "$.status" == "healthy"
jsonpath "$.uptime" > 0
```

### Bad
```hurl
# No assertions — passes even on 500 errors
GET {{base_url}}/api/health
```

## Anti-Patterns
- HTTP requests with no expected status code
- Status code only without body assertions
- Only testing success (2xx) without error (4xx) cases
- Missing content-type assertion on JSON endpoints