REST API checks

The REST API panel runs a fixed, zero-config ruleset against the host application's own web layer — Spring MVC (@RestController / @Controller handler methods) or, on Quarkus, JAX-RS/RESTEasy Reactive (@Path resource methods). This page lists every rule that ships with BootUI today, what it inspects, when it fires, and what to do about it.

Each rule is a small class registered in RestApiRuleRegistry and implemented in RestApiRules.java, both in the framework-neutral bootui-engine module so the same 51 rules run identically on Spring Boot and Quarkus. The list intentionally stays compact and reviewable; adding a new rule means adding one focused class plus a registry entry.

What BootUI does

The scanner detects the host application's base package(s) — from the @SpringBootApplication configuration via AutoConfigurationPackages on Spring, or from a build-time Jandex index on Quarkus — imports the compiled .class files from those packages with ArchUnit's ClassFileImporter, derives a read-only handler model (HTTP method(s), path(s), parameters and their annotations, return type, produces/consumes, validation flags, declared throws) once, and evaluates every registered rule against that model. Importing is bounded to the application's own base package(s) — never the entire classpath — and runs only on demand when the scan action is invoked, caching the last report in the controller. A handful of rules reason about Spring-only types with no JAX-RS equivalent (RFC 9457 ProblemDetail); on Quarkus those report SKIPPED with an explanatory reason instead of misfiring — see RAPI-ERR-003 and RAPI-ERR-006 below.

The handler model unwraps common async/reactive return-type wrappers before classifying the response body, so the body-shape rules below (RAPI-DTO-001/002/004/005, RAPI-RESP-004, RAPI-PAGE-001/002, RAPI-NAME-002) see the real payload type on both frameworks: Spring's Mono, CompletableFuture, CompletionStage, DeferredResult, and WebAsyncTask, and — on Quarkus/JAX-RS — SmallRye Mutiny's Uni/Multi (the officially-promoted reactive return types for Quarkus REST resources) and RESTEasy Reactive's typed RestResponse<T>. Plain jakarta.ws.rs.core.Response is intentionally left unwrapped: it is non-generic, and Quarkus itself cannot determine its contained type at build time.

When BootUI is installed through bootui-spring-boot-starter, ArchUnit is included transitively so the panel works without an extra application dependency. The panel is available only when:

ArchUnit is on the classpath, and
a base package is resolvable from the running application.

Every rule catches RuntimeException and LinkageError and degrades to a SKIPPED/ERROR outcome so one unresolvable class never aborts the scan, and the scanner degrades to a stable "scanned, nothing to analyze" report when no controllers can be imported.

What BootUI does not do

It does not check security concerns (CORS, authentication, authorization) — those remain owned by the Security panel.
It does not modify, compile, or instrument application code; it reads already-compiled bytecode.
It is not a replacement for an API design review or contract testing. The heuristics are project-agnostic review prompts, not verdicts.

Severities

Findings are ranked in the scanner's severity order:

CRITICAL — supported by the scanner, but no active REST API rule currently assigns it.
HIGH
MEDIUM
LOW
INFO

The catalogue below ships 51 rules across 8 categories (8 HIGH, 10 MEDIUM, 18 LOW, 15 INFO; no active CRITICAL rules). The RAPI-DOC-* documentation rules only run when OpenAPI annotations are present on the host classpath — Swagger/springdoc-openapi (io.swagger.v3.oas.annotations) on Spring, or MicroProfile OpenAPI (org.eclipse.microprofile.openapi.annotations, honored by Quarkus's quarkus-smallrye-openapi) on either framework; otherwise they are reported as SKIPPED.