Document 400 for unsupported flags[] values on GET /{version}/tours

[lrcarrera]

Description

Companion to getyourguide/public-partner-api#2097.

GET /{version}/tours now rejects flags[] values that are not in the documented Flags enum with a 400 (errorCode 12), instead of silently ignoring them, or returning an off-contract 503 when the unknown flag was the only filter (the OWASP ZAP probe that fired the Search API 400 monitor on 2026-09-23). Matching is exact and case-sensitive, so PRIVATE is rejected while private is accepted.

Changes:

• flags[] parameter (spec/components/commons/query.yaml): state that only the Flags enum values are accepted, matched case-sensitively, and that anything else is rejected with a 400.
• ToursQuery 400 (spec/paths/tours.yaml): add an unsupported flags[] value to the examples of invalid parameters.

No schema or type changes. The Flags enum already lists exactly the accepted values, so generated clients are unaffected. Description-only, same shape as #119.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works (n/a, description-only spec change; behavior is covered by unit + Karate tests in the linked service PR)

🤖 Generated with Claude Code

[clue-gyg]

✅ Auto-approved

Tiny diff (~4 lines) to OpenAPI description text only, in spec/components/commons/query.yaml and spec/paths/tours.yaml; no schema/type changes, no new endpoints, and it matches the error-response-improvement exception (documenting a 400 for invalid flags[] input without altering happy-path responses or contracts).