In a REST API you have OpenAPI specs that when done properly (follow always design first approach) will allow you to:
- auto generate client SDKS (client API generation)
- auto generate mock servers (frontend team can work in isolation of the backend team)
- create automated tests for contract acceptance between client and server
- automate validation of incoming requests against the specification. This is huge from a security point of view. If the request isn’t in the format allowed in the specification you can refuse it, thus making it a lot harder for attackers to run fuzzing tools against your API in order to breach and exploit it.
- automate user input validation.
