{
  "id": "AUDIT-GAP-001",
  "name": "PII scrub covers top-level apiKey + snake_case session_token",
  "description": "Regression case for the split-dictionary bug in pii_scrub.go: top-level `apiKey` and snake_case `session_token` / `api_key` were not scrubbed by the body walker (C17.3 added `session_key` only, missing the three camelCase/snake_case variants). The fix consolidates to a single PIIBodyBlacklist consumed by both top-level and nested walks. The strong assertion is the unit test TestPIIBlacklistCanonical; the e2e surface here verifies the backend tolerates the PII-shaped payload without echoing the secret values back in any error field — if it did, the scrub is broken. Backend rejects the unknown field with 400 (expected — Account has no apiKey column) and the assertion checks that the plaintext secret does NOT appear in the response.",
  "scene": "audit_log",
  "object": "Account",
  "method": "POST",
  "endpoint": "/services/data/v63.0/sobjects/Account",
  "payload": {
    "Name": "Audit PII top-level {timestamp}",
    "Industry": "Others",
    "apiKey": "leak-top-level-apikey",
    "session_token": "leak-snake-session-token"
  },
  "expects": {"status_code": 400},
  "response_assertions": [
    {"field": "0.message", "operator": "not_contains", "value": "leak-top-level-apikey"},
    {"field": "0.message", "operator": "not_contains", "value": "leak-snake-session-token"}
  ],
  "priority": "P1"
}