API testing guides — test REST and GraphQL APIs, write contract tests, and automate API validation.
Testing
Every third-party API integration needs tests — but mocking, contract testing, and real integration testing each have different tradeoffs. Mocks are fast but drift from reality. Real integration tests are accurate but slow and expensive. Contract tests are the middle ground that most teams miss. This guide covers when to use
Security Testing
Dynamic Application Security Testing (DAST) probes your running application for vulnerabilities — sending real HTTP requests and observing how the server responds. OWASP ZAP and Burp Suite are the two most widely used tools. This guide covers what each finds, how to automate scans in CI, and how to interpret the
Testing
Strapi v5 exposes content via REST and GraphQL APIs. Testing these APIs involves three layers: unit tests for custom service logic, integration tests against a running Strapi instance with a test database, and permission tests that verify role-based access. This guide covers all three using Jest and Supertest. Key Takeaways
API Testing
RESTler is a stateful REST API fuzzer from Microsoft Research. Unlike simple fuzzers that hit each endpoint independently, RESTler infers the relationships between API calls — it knows that you must create a user before you can update it, and that updating requires the ID returned by creation. This stateful awareness
API Testing
Schemathesis and Dredd both test APIs against their OpenAPI specifications. They're often mentioned in the same breath, which leads teams to think they're interchangeable. They're not. They find different bugs, in different ways, with different tradeoffs. Understanding the distinction helps you deploy the right
API Testing
Schemathesis takes your OpenAPI or GraphQL schema and automatically generates hundreds of test cases from it — including edge cases your manual test suite never thought of. It finds server crashes, unhandled exceptions, and schema violations that sit invisible in hand-written tests. This guide covers everything from basic setup to stateful
Contract Testing
Specmatic turns your OpenAPI specifications into executable contracts that work from both sides: it can run your spec as a stub server for consumer testing, and verify that your actual API implementation conforms to the spec for provider testing. One spec file, both directions — without writing a single test. The
API Testing
Dredd validates that your API implementation matches its documentation. It reads your API Blueprint or OpenAPI specification, makes real HTTP requests to your running server, and checks that the responses match what the spec promises. When your code and your docs disagree, Dredd fails — forcing you to keep them in
API Testing
API fuzzing finds the bugs that escape manual testing and code review: server crashes from unexpected inputs, schema violations from edge cases, and authorization gaps revealed by unusual request sequences. But fuzzing without a clear strategy wastes time and generates noise. This guide covers the practices that make API fuzzing
Testing
API-first development means writing your OpenAPI specification before writing code. But there's a gap between having a spec and having something to develop against — until you write the API, frontend developers are blocked. Prism closes this gap. Give it an OpenAPI (Swagger) specification and it instantly runs a
Testing
Most API mocking libraries intercept calls at the code level — patching fetch, wrapping axios, or monkey-patching network modules. This approach breaks easily when libraries change internals or when you switch HTTP clients. Mock Service Worker (MSW) takes a different approach. In browsers, it registers an actual service worker that intercepts
Testing
Most API mocking tools only speak HTTP. That's fine for REST APIs, but modern systems include gRPC services, legacy TCP protocols, SMTP servers, and binary protocols that HTTP-only tools can't touch. Mountebank is a service virtualization tool that handles multiple protocols through a unified interface. You