Connect an AI API without trusting every response

Before you begin

• JavaScript / Python prerequisite; inspect the worked fixture before beginning.
• A text editor/spreadsheet for the manual route. Hosted Python/Jupyter for code exercises; applicable dependencies are in requirements.txt.
• For actual AI calls, a legitimate available cloud service and authorised learner credentials; no particular provider or country is mandatory.

Free original, non-accredited practice. Self-review is not independent assessment. No particular provider, payment platform or country is mandatory; use a legitimate available route or explicitly labelled manual practice.

Write the request and response contract

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Specify required fields, maximum sizes and the trust boundary. Inspect the supplied input before using any tool. Write the decision rules in your own words and calculate one small result independently. The reference output is an answer key for this deliberately bounded fixture, not proof of general capability. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error. For learners across regions underserved or excluded by mainstream providers: verify country eligibility, language, account/identity requirements, data terms, cost, quota and connectivity before choosing a cloud service. Use only legitimate available alternatives; never bypass restrictions or invent a country/account. No service access? Complete the labelled manual/fixture route without claiming a live AI run.

Worked example

SOURCE (authored fixture):
{
  "responses": [
    {
      "status": 200,
      "body": {
        "text": "draft"
      }
    },
    {
      "status": 429,
      "body": {}
    },
    {
      "status": 200,
      "body": {
        "wrong": "shape"
      }
    },
    {
      "status": 401,
      "body": {}
    }
  ]
}
INDEPENDENT FIXTURE TARGET:
{
  "decisions": [
    "accept_draft",
    "bounded_retry_later",
    "schema_error",
    "stop_auth_error"
  ]
}

Your practical task

1. Specify required fields, maximum sizes and the trust boundary.
2. Open input.json and expected.json from the practice pack; keep an unmodified original.
3. Record a manual prediction and the relevant rule before consulting the answer key.
4. Perform one small change and predict its effect before rerunning.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Write the request and response contract — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• Timeout: record an unavailable result, not a fabricated draft.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Classify constructed responses

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Distinguish transport status, schema validity and factual verification. Establish a baseline before changing prompts or code. Keep the original input immutable. Record expected values, observed values and whether each comparison passed. If the expected file conflicts with a justified policy, investigate rather than forcing a convenient match. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.

Worked example

MANUAL BASELINE / compare every named field
{
  "decisions": [
    "accept_draft",
    "bounded_retry_later",
    "schema_error",
    "stop_auth_error"
  ]
}
Keep a separate observed-result column; the answer key is not a model response.

Your practical task

1. Distinguish transport status, schema validity and factual verification.
2. Open input.json and expected.json from the practice pack; keep an unmodified original.
3. Record expected and observed values separately; explain every mismatch.
4. Perform one small change and predict its effect before rerunning.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Classify constructed responses — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• A key in a URL or export is a critical failure: remove it and rotate exposed credentials.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Build a bounded client

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Use timeouts and explicit error states instead of an infinite retry loop. Build one inspectable transformation or bounded AI prompt. Keep calculation and validation deterministic where possible. If you make a permitted hosted call, save the actual response separately from the authored examples and verify its material claims; the supplied reference never simulates a live model. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.

Worked example

PROJECT CONTRACT:
This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.
HOSTED REFERENCE: open hosted-lab.ipynb or run reference.py with all fixture files together.
EXPECTED CONSTRUCTED RESULT:
{
  "decisions": [
    "accept_draft",
    "bounded_retry_later",
    "schema_error",
    "stop_auth_error"
  ]
}

Your practical task

1. Use timeouts and explicit error states instead of an infinite retry loop.
2. Open hosted-lab.ipynb and the reference code from the practice pack; keep an unmodified original.
3. Record expected and observed values separately; explain every mismatch.
4. Perform Quota response: respect limits; changing accounts to evade restrictions is not a fallback.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Build a bounded client — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• Quota response: respect limits; changing accounts to evade restrictions is not a fallback.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Exercise authentication and quota failures

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Never paste a live key into a test fixture or public log. Change one assumption at a time and predict the result first. Retain the failure, the revision and the rerun evidence. A failure is useful information: hiding a bad output or editing a test target after seeing the answer destroys the value of the experiment. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.

Worked example

CHANGE TESTS — predict before running:
1. Timeout: record an unavailable result, not a fabricated draft.
2. A key in a URL or export is a critical failure: remove it and rotate exposed credentials.
3. Quota response: respect limits; changing accounts to evade restrictions is not a fallback.
Keep the original expected.json unchanged.

Your practical task

1. Never paste a live key into a test fixture or public log.
2. Open failure-tests.md from the practice pack; keep an unmodified original.
3. Record expected and observed values separately; explain every mismatch.
4. Perform Timeout: record an unavailable result, not a fabricated draft.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Exercise authentication and quota failures — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• Timeout: record an unavailable result, not a fabricated draft.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Review provider-specific access

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Check country, account, data and billing terms before selecting a legitimate alternative. Review what the fixture cannot establish. Explain who owns the decision, where human approval is needed and which access or professional constraints remain. Do not describe a small educational success as production readiness, certification, legal compliance or a guarantee. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error. For learners across regions underserved or excluded by mainstream providers: verify country eligibility, language, account/identity requirements, data terms, cost, quota and connectivity before choosing a cloud service. Use only legitimate available alternatives; never bypass restrictions or invent a country/account. No service access? Complete the labelled manual/fixture route without claiming a live AI run.

Worked example

REVIEW BOUNDARY:
This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.

ACCESS / NOT TESTED: unavailable provider, unsupported language and absent external feedback must remain explicit.

Your practical task

1. Check country, account, data and billing terms before selecting a legitimate alternative.
2. Open README.md and your evidence log from the practice pack; keep an unmodified original.
3. Record the human decision owner, limitations and any untested service access.
4. Perform one small change and predict its effect before rerunning.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Review provider-specific access — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• A key in a URL or export is a critical failure: remove it and rotate exposed credentials.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Ship an integration with a teardown note

An API boundary is a contract for inputs, outputs, authentication and failures. A successful HTTP status does not establish factual correctness or an expected schema. Keep company secrets server-side and use learner-owned credentials only through authorised activity routes. Provide request fixtures, failure tests and safe configuration instructions. Deliver a reproducible bundle rather than a screenshot alone. Include inputs, rules, output, failure tests, a short README and residual limitations. Ask another person to follow the instructions if possible; self-review and actual external review must be labelled separately. Policy for this project: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error.

Worked example

HANDOFF MANIFEST:
input.json — immutable source
expected.json — fixture answer key
actual.json — result actually observed
evidence-log.csv — baseline plus three changes
README.md — reproduction and access route
limitations.md — unresolved failures, rights, approvals and scope
Never bundle a credential.

Your practical task

1. Provide request fixtures, failure tests and safe configuration instructions.
2. Open README.md and your evidence log from the practice pack; keep an unmodified original.
3. Record the human decision owner, limitations and any untested service access.
4. Perform one small change and predict its effect before rerunning.
5. Keep the result and your reasoning in the lesson notes; do not mark a simulated run as live.

Evidence to keep

• Ship an integration with a teardown note — a saved, inspectable artefact tied to the supplied rule.
• A baseline or change-test record with expected/observed results and a limitation.

Mistakes to watch for

• Quota response: respect limits; changing accounts to evade restrictions is not a fallback.
• Treating a supplied answer key, an authored example or self-review as independent field validation.

Check your understanding

Which exact input, rule and expected value would let another learner falsify your conclusion in this activity, and what remains untested?

No-service / offline route

Use the supplied fictional JSON, expected results and paper/text evidence log without a provider account. Manual or constructed completion is labelled; it is not a live cloud integration or trained-model run.

Capstone self-review

Score each criterion 0 (missing), 1 (partial), or 2 (demonstrated). A self-review pass needs at least 8/10 and 2/2 on the critical safety/limits criterion. This is learner practice feedback, not verified assessment.

• Defined task and preserved input: Original input and the project policy are retained; the actual question is clear.
• Checked baseline: The supplied baseline reconciles field by field; unsupported live-run claims are absent.
• Three failure/change tests: All three specified changes have predictions, observed results and explanations.
• Repeatable handoff: Another person can follow the README; supporting practice evidence and unresolved limits are included.
• Safety, rights and access honesty — critical: This reference classifies supplied HTTP fixtures; it makes no live requests. Accept a 200 response only with string text. Retry advice is bounded; never automatically retry every error. Regional access route is legitimate; credentials and private data are absent; manual/constructed work is clearly labelled.

Review questions

Practice files

• README.md
• bounded-client.mjs
• evidence-log.csv
• expected.json
• failure-tests.md
• hosted-lab.ipynb
• input.json
• lab_engine.py
• reference.py
• requirements.txt

References and editorial limits

Original authored practice material; deterministic fixtures build-tested. Not independently expert-reviewed or learner-validated. Time estimates unvalidated.

• MDN HTTP response status codes

Browse all build paths → · Curriculum overview