API testing guides — test REST and GraphQL APIs, write contract tests, and automate API validation.
Testing
Generating a Pact contract locally is a useful proof of concept. But contracts only deliver their value when they're shared automatically between teams, versioned alongside code, and verified on every pull request. That's what the Pact Broker is for. This post covers running a Pact Broker,
API Testing
REST APIs have OpenAPI. Event-driven systems — Kafka topics, RabbitMQ queues, WebSocket channels — have AsyncAPI. If your microservices communicate via events and you're not validating message schemas, you're flying blind. A producer changes a field name, drops a required field, or changes a type. Every downstream
Testing
Snapshot testing is associated with UI components — you render a tree, save it, and fail if it changes. But the same technique works exceptionally well for API responses, and for many teams it's more valuable there than in the UI layer. API responses are structured, deterministic (once you
API Testing
If you write Java and need to test REST APIs, REST Assured is the most popular library for the job. It lets you write readable, expressive HTTP tests that fit naturally into a JUnit or TestNG test suite. This tutorial walks you through everything from initial setup to writing your
Allure
Allure integrates with REST-assured via a filter that captures every HTTP request and response and attaches them to the test report. When an API test fails, the Allure report shows the exact request sent and response received — no log digging required. Key Takeaways AllureRestAssured filter attaches request/response to
Contract Testing
Pact, Dredd, and Schemathesis are three different approaches to API contract testing, each solving a different part of the problem. Pact validates what individual consumers expect. Dredd validates that an implementation matches its OpenAPI/API Blueprint spec. Schemathesis uses property-based testing to automatically generate edge-case requests from an
gRPC
gRPC streaming RPCs are among the most powerful features of the protocol — and among the hardest to test correctly. Unlike unary calls, streams introduce ordering, backpressure, partial failure, and cancellation scenarios that require different testing approaches. This guide covers testing all three streaming types: server streaming, client streaming, and bidirectional
GraphQL
GraphQL persisted queries reduce payload size and improve security by replacing full query strings with short hash identifiers. But they introduce new failure modes — hash mismatches, cache invalidation bugs, and APQ negotiation failures — that require dedicated testing strategies. This guide covers everything you need to test persisted queries and APQ
gRPC
gRPC security testing is often skipped because certificates are annoying to set up in test environments. That's exactly why certificate misconfigurations, expired credentials, and bypass vulnerabilities make it to production. This guide covers practical approaches to testing gRPC TLS and authentication without making your CI pipeline miserable. What
GraphQL
GraphQL error handling is fundamentally different from REST. A 200 response can contain errors. A query can partially succeed — returning some data while failing on other fields. Null propagation can silently wipe out entire subtrees. If you're only testing the happy path, you're missing half the
Shift-Left Testing
Microservices solve organizational problems — independent deployments, team autonomy, technology flexibility. But they create a testing problem: how do you verify that services that evolve independently still work together? Integration test suites require running all services simultaneously. End-to-end tests are slow and brittle. Neither catches API contract breaks early
Email Testing
Resend has quickly become the developer-favorite transactional email API — clean SDK, React Email template support, and a generous free tier. But email is one of the most undertested parts of most applications. Password reset emails that don't send, welcome emails with broken links, and invoice emails with