API testing guides — test REST and GraphQL APIs, write contract tests, and automate API validation.
Testing
API testing has a tooling problem. Postman collections balloon into unmaintainable JSON blobs. Custom shell scripts with curl become brittle and unreadable. Language-specific frameworks require onboarding everyone to the same tech stack. Hurl cuts through all of that with a refreshingly simple idea: describe HTTP requests and assertions in plain
Testing
Microservices break apart functionality and introduce integration failure as a first-class risk. When Team A changes an API endpoint, Team B's service breaks — in production, during an incident, after everyone has gone home. Contract testing exists to catch these failures before they reach production, by codifying the agreement
Testing
There are two kinds of API testing tools: the ones that look impressive in demos and the ones that actually fit into your daily workflow. httpyac is firmly in the second category. It extends the familiar .http file format with scripting, environments, authentication helpers, and a capable CLI — then wraps
Testing
Writing HTTP API tests is the easy part. The test files exist, the assertions look right, and they pass on your laptop. Then CI comes into play and everything falls apart: secrets are not available, the test environment is not ready, tests run in the wrong order, results do not
API Testing
Tyk is an open-source API gateway that manages authentication, rate limiting, analytics, and API versioning through a declarative API definition system. Unlike gateways that use UI-driven configuration, Tyk stores its entire configuration as JSON documents — which means you can version-control it and write automated tests against it. This guide covers
API Testing
Okta is the identity layer for many enterprise applications. Testing Okta integrations is challenging because identity flows involve browser redirects, SAML assertions, multi-step authentication, and external callback URLs. But untested auth is the most dangerous untested code — a broken login means no users can access your application. This guide covers
API Testing
Envoy Proxy powers many service meshes (Istio, AWS App Mesh) and API gateways (Contour, Emissary-Ingress). It's highly capable and highly complex. Testing Envoy configurations before deploying them prevents outages caused by misconfigured filter chains, broken xDS configs, and subtle routing mistakes. This guide covers testing Envoy's
API Testing
AWS Cognito provides user authentication, authorization, and identity management for AWS-hosted applications. Testing Cognito integrations is critical — a misconfigured user pool can lock users out, a broken Lambda trigger can block all signups, and a wrong JWT audience claim can silently reject valid users. This guide covers testing Cognito user
API Testing
An API gateway is one of the most critical components in a modern backend architecture. It handles authentication, rate limiting, routing, request transformation, and more — all before a request reaches your application code. When the gateway misbehaves, everything downstream breaks. Testing it thoroughly is non-negotiable. This guide covers the full
OWASP ZAP
OWASP ZAP is the most widely used open-source web application security scanner. This guide covers integrating ZAP's Docker-based full scan and API scanning into GitHub Actions CI/CD pipelines, configuring authentication for authenticated scans, and handling alert triage to keep pipelines actionable. Key Takeaways Run ZAP as Docker
GraphQL
GraphQL APIs require a layered testing strategy that covers resolvers in isolation, schema stitching, and full client-to-server flows. This guide walks through unit testing individual resolvers with Jest, integration testing with Apollo Server's executeOperation, end-to-end testing with real clients, mocking with MSW, and testing subscriptions — with tool recommendations
GraphQL
GraphQL schemas evolve, and every change carries the risk of breaking clients. Contract testing catches breaking changes before deployment by comparing schema versions and validating that client queries still work against the new schema. This post covers what counts as a breaking change, how to use GraphQL Inspector for schema