diff --git a/pages/api/endpoint/gethash_api.js b/pages/api/endpoint/gethash_api.js
index 1524bce0..f0ef869e 100644
--- a/pages/api/endpoint/gethash_api.js
+++ b/pages/api/endpoint/gethash_api.js
@@ -1,6 +1,7 @@
 import { hashAPIPath } from "../../../actions/core/hash";
 import nextConnect from "next-connect";
 import { getSession } from "next-auth/react";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
 
 const ApiProxy = nextConnect();
 
@@ -8,7 +9,11 @@ ApiProxy.get(async (req, res) => {
     const session = await getSession({ req });
 
     if (!session) {
-        return res.status(401).json();
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
     }
 
     const rawQueryPath = req.query.path;
@@ -39,10 +44,14 @@ ApiProxy.get(async (req, res) => {
         !allowedPrefix.some((prefix) => queryPath.startsWith(prefix)) ||
         queryPath.includes("/api/endpoint/gethash_api")
     ) {
-        return res.status(400).json();
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_HASH_PATH",
+            message: "Invalid path for hash generation"
+        });
     }
 
-    return res.status(200).json({ hash: hashAPIPath(rawQueryPath) });
+    return respondSuccess(res, { hash: hashAPIPath(rawQueryPath) });
 });
 
 export default ApiProxy;
diff --git a/pages/api/endpoint/getmandatoryfields_api.js b/pages/api/endpoint/getmandatoryfields_api.js
index 756e21ad..8fb1a5bf 100644
--- a/pages/api/endpoint/getmandatoryfields_api.js
+++ b/pages/api/endpoint/getmandatoryfields_api.js
@@ -1,3 +1,5 @@
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
 const WORDKEY = process.env.HASHKEY;
 
 const WEBAPI_URL =
@@ -5,16 +7,32 @@ const WEBAPI_URL =
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 export default async function ApiProxy(req, res) {
-    var whichForm = req.query.whichForm;
+    const whichForm = req.query.whichForm;
+
+    if (typeof whichForm !== "string" || whichForm.trim().length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "WHICH_FORM_REQUIRED",
+            message: "whichForm is required"
+        });
+    }
 
     // var queryUrl =
     //     "EntityDefinitions(LogicalName='pinswg_" +
     //     whichForm +
     //     "')/Attributes?$count=true&$select=LogicalName,RequiredLevel";
 
-    const mandatoryFieldsData = require("../../../data/mandatoryfields/pinswg_" +
-        whichForm +
-        ".json");
+    try {
+        const mandatoryFieldsData = require(
+            "../../../data/mandatoryfields/pinswg_" + whichForm + ".json"
+        );
 
-    return res.status(200).json(mandatoryFieldsData);
+        return respondSuccess(res, mandatoryFieldsData);
+    } catch (error) {
+        return respondError(res, {
+            status: 404,
+            code: "MANDATORY_FIELDS_NOT_FOUND",
+            message: "Mandatory fields data not found for requested form"
+        });
+    }
 }
diff --git a/pages/api/endpoint/getpicklists_api.js b/pages/api/endpoint/getpicklists_api.js
index eb293cf2..e69851c8 100644
--- a/pages/api/endpoint/getpicklists_api.js
+++ b/pages/api/endpoint/getpicklists_api.js
@@ -17,6 +17,8 @@
  *         description: hello world
  */
 
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
 const WORDKEY = process.env.HASHKEY;
 
 const WEBAPI_URL =
@@ -24,16 +26,32 @@ const WEBAPI_URL =
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
 export default async function ApiProxy(req, res) {
-    var whichForm = req.query.whichForm;
+    const whichForm = req.query.whichForm;
+
+    if (typeof whichForm !== "string" || whichForm.trim().length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "WHICH_FORM_REQUIRED",
+            message: "whichForm is required"
+        });
+    }
 
     // var queryUrl =
     //     "EntityDefinitions(LogicalName='pinswg_" +
     //     whichForm +
     //     "')/Attributes/Microsoft.Dynamics.CRM.PicklistAttributeMetadata?$select=LogicalName&$expand=OptionSet,GlobalOptionSet&$count=true";
 
-    const pickListData = require("../../../data/picklistdata/pinswg_" +
-        whichForm +
-        ".json");
+    try {
+        const pickListData = require(
+            "../../../data/picklistdata/pinswg_" + whichForm + ".json"
+        );
 
-    return res.status(200).json(pickListData);
+        return respondSuccess(res, pickListData);
+    } catch (error) {
+        return respondError(res, {
+            status: 404,
+            code: "PICKLISTS_NOT_FOUND",
+            message: "Picklist data not found for requested form"
+        });
+    }
 }
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index ce82d259..f2cc2c3c 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -3457,6 +3457,82 @@ test("createcrmtask catch path returns CRM_TASK_CREATE_FAILED", async () => {
     assert.strictEqual(res.state.jsonBody.error.code, "CRM_TASK_CREATE_FAILED");
 });
 
+test("gethash returns UNAUTHENTICATED when session missing", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        hashAPIPath: () => "&hash=expected",
+        getSession: async () => null,
+        nextConnect: () => {
+            const handler = { registeredGet: null };
+            handler.get = (cb) => {
+                handler.registeredGet = cb;
+                return handler;
+            };
+            return handler;
+        }
+    });
+
+    const req = { query: { path: "/api/endpoint/getportallogin_api?x=1" } };
+    const res = createRes();
+    await mod.default.registeredGet(req, res);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+});
+
+test("gethash returns INVALID_HASH_PATH when path is invalid", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        hashAPIPath: () => "&hash=expected",
+        getSession: async () => ({ user: { email: "user@test.local" } }),
+        nextConnect: () => {
+            const handler = { registeredGet: null };
+            handler.get = (cb) => {
+                handler.registeredGet = cb;
+                return handler;
+            };
+            return handler;
+        }
+    });
+
+    const req = { query: { path: "/api/endpoint/gethash_api" } };
+    const res = createRes();
+    await mod.default.registeredGet(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH_PATH");
+});
+
+test("getpicklists returns WHICH_FORM_REQUIRED when whichForm missing", async () => {
+    const mod = loadModule("pages/api/endpoint/getpicklists_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "WHICH_FORM_REQUIRED");
+});
+
+test("getmandatoryfields returns WHICH_FORM_REQUIRED when whichForm missing", async () => {
+    const mod = loadModule("pages/api/endpoint/getmandatoryfields_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock
+    });
+
+    const req = { query: {} };
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "WHICH_FORM_REQUIRED");
+});
+
 test("getsipsmedia returns success contract", async () => {
     const mod = loadModule("pages/api/endpoint/getsipsmedia_api.js", {
         respondSuccess: respondSuccessMock