Clarify: schema filter runs before transforms, integer type on TeamMember.id is correct

[Copilot]

Addresses a review question on #1138 asking whether the response schema filter is applied after data transforms (pseudonymization). Investigation confirmed it is not — schema filtering precedes transforms.

Finding

In RESTApiSanitizerImpl.sanitize(), the processing order is:

1. filterJsonBySchema(...) — filters raw API response against the response schema
2. applyTransform(...) — pseudonymization/tokenization applied to the filtered document

// Schema filter first
Object document = endpoint.getResponseSchemaOptional().map(schema -> {
    return jsonConfiguration.jsonProvider().parse(
        jsonSchemaFilterUtils.filterJsonBySchema(json, schema, getRootDefinitions()));
}).orElse(jsonResponse);

// Transforms second
for (Transform transform : endpoint.getTransforms()) {
    sanitizerUtils.applyTransform(getPseudonymizer(), transform, document, ...);
}

The automated reviewer's suggestion to change TeamMember.id from type: "integer" to type: "string" (because it's pseudonymized via URL_SAFE_TOKEN) was incorrect. The schema describes the original API response types; TeamMember.id is an integer in the raw Cursor API, so type: "integer" is correct. No schema changes are needed.

Change implications

• dependencies added/changed? no
• something important to note in future release notes? no

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.