Overview

The api-testing skill covers testing API endpoints across HTTP, REST, and GraphQL, ensuring correct behavior, payloads, and responses. It emphasizes endpoint validation, response schema checks, performance considerations, and security checks to deliver reliable APIs.

How This Skill Works

Tests are organized using the scripts in the scripts/ directory and reference guides in references/. Each test exercises HTTP methods (GET, POST, PUT, DELETE, PATCH), validates headers, auth, and body content, and asserts status codes and payload schemas. Performance and security tests cover latency, load, rate limiting, and protections against injections and XSS.

When to Use It

• Before releasing an API, to validate endpoints, methods, headers, and payloads
• As part of CI/CD to run regression tests after code changes
• To verify authentication and authorization controls (tokens, scopes, access)
• When measuring performance, latency, and load characteristics
• During security testing to check input validation, injections, and XSS defenses

Quick Start

1. Step 1: Review API specs and set up the test environment
2. Step 2: Run automated tests from scripts/ and verify responses against schemas
3. Step 3: Inspect results, address failures, and extend test coverage

Best Practices

• Reuse test data and schemas across endpoints to improve consistency
• Assert all relevant status codes and every required field
• Validate responses against JSON/XML schemas and data types
• Isolate tests with separate environments or mocks; avoid flakiness
• Document and version scripts in scripts/ and reference HTTP methods in references/

Example Use Cases

• GET /users endpoint validates 200 and matches the user schema
• POST /orders validates request body and success payload
• GraphQL query performance test for a complex report
• Auth endpoint tests for login and token refresh
• Load test for /search endpoint with rate-limiting verification

Frequently Asked Questions