To set up an example, Azure has some API management stuff that could let you do this before you even got to your code. Writing a tool to make sure that API management rule exists would be different than static analysis.

I'd agree with you, but not all of the business logic like that is going to live in code in the future.