Write an API integration test for invalid suggestion input without coupling to human-readable wording.

Post a suggestion with a blank title and body exceeding the allowed length. Assert 400, application/problem+json, a stable error code, and field keys. Do not assert the full English message sentence.

The client can map errors.title and errors.body while support can correlate the response through traceId.

• Exercise the real model-binding and validation pipeline.
• Assert stable machine-readable fields.
• Avoid stack traces and internal exception text.
• Do not mutate real suggestion data.

I deserialize ValidationProblemDetails and assert the parts clients depend on: status, media type, stable extension, trace id, and field keys. Message prose can improve without breaking the test.

[Fact]
public async Task Invalid_suggestion_returns_validation_problem_details()
{
    await using var factory = new ApiTestFactory();
    var client = factory.CreateAuthenticatedClient("candidate-1", "suggestions.create");

    using var response = await client.PostAsJsonAsync(
        "/api/suggestions",
        new { Title = " ", Body = new string('x', 5001) });

    Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
    Assert.Equal("application/problem+json", response.Content.Headers.ContentType?.MediaType);

    var problem = await response.Content
        .ReadFromJsonAsync<HttpValidationProblemDetails>();

    Assert.Equal(400, problem!.Status);
    Assert.Equal("validation.failed", problem.Extensions["code"]?.ToString());
    Assert.True(problem.Errors.ContainsKey("title"));
    Assert.True(problem.Errors.ContainsKey("body"));
    Assert.False(string.IsNullOrWhiteSpace(problem.Extensions["traceId"]?.ToString()));
}

This is a contract test at the API boundary. It avoids a database dependency because validation must reject the request before persistence; a fake repository can additionally assert that no save method ran.

• Malformed JSON fails model binding before domain validation.
• Only one field is invalid.
• Property-name casing follows the public JSON contract.
• A localization change alters message wording.

• Assert the repository has no new record.
• Test malformed JSON separately from valid-but-invalid input.
• Verify production responses omit internal details.

• Calling the validator directly and calling it an API test.
• Asserting exact English prose.
• Returning a generic 500 for invalid input.
• Forgetting content type and stable error code.