ok 1 - A1 every error response is JSON
ok 2 - A2 mobile contract: body.error is a non-empty string on every error
not ok 3 - A3 every error body has the same top-level keys
ok 4 - A4 status codes: unknown resources 404, malformed JSON 400, nothing is a 500
ok 5 - A5 no stack traces or internal paths leak
ok 6 - A6 the X-Request-Id the app sends comes back on errors
ok 7 - A7 validation errors name the field
ok 8 - A8 success responses keep their shape
