API Test Automation

Overview

Automate comprehensive API endpoint testing for REST and GraphQL APIs including request generation, response validation, schema compliance, authentication flows, and error handling. Supports Supertest (Node.js), REST-assured (Java), httpx/pytest (Python), Postman/Newman collections, and Pact for consumer-driven contract testing.

Prerequisites

• API testing library installed (Supertest, REST-assured, httpx, or Postman/Newman)
• API specification file (OpenAPI/Swagger YAML/JSON or GraphQL SDL)
• Target API running in a test environment with seeded data
• Authentication credentials or API keys for protected endpoints
• JSON Schema validator (Ajv, jsonschema, or built-in framework assertions)

Instructions

1. Read the API specification and extract all endpoints:

• Parse OpenAPI spec to catalog every path, HTTP method, request schema, and response schema.
• For GraphQL APIs, introspect the schema to list queries, mutations, and subscriptions.
• Document authentication requirements per endpoint (API key, Bearer token, OAuth, none).

1. Generate test cases for each endpoint:

• Success cases: Send valid requests matching the schema and assert 200/201 responses.
• Validation errors: Send requests with missing required fields, wrong types, and out-of-range values; assert 400 responses.
• Authentication: Test with valid, expired, and missing credentials; assert 200, 401, and 403 respectively.
• Not found: Request non-existent resources; assert 404 responses.
• Idempotency: Send the same PUT/DELETE request twice and verify consistent behavior.

1. Validate response structure against schemas:

• Assert response Content-Type matches expected (application/json, etc.).
• Validate response body against the OpenAPI response schema using JSON Schema validation.
• Check response headers (Cache-Control, Rate-Limit headers, CORS headers).
• Verify pagination metadata (total count, page number, next/previous links).

1. Test CRUD lifecycle for resource endpoints:

• Create a resource (POST) and capture the ID.
• Read it back (GET) and verify all fields match.
• Update it (PUT/PATCH) and verify changes persisted.
• Delete it (DELETE) and verify subsequent GET returns 404.

1. Test error handling and edge cases:

• Send excessively large payloads and verify 413 or graceful rejection.
• Send requests with unsupported Content-Types and verify 415.
• Test rate limiting by sending rapid sequential requests.
• Verify error response format is consistent (standard error schema).

1. For GraphQL APIs, test s