API testing guides — test REST and GraphQL APIs, write contract tests, and automate API validation.
GraphQL
GraphQL schemas evolve, and every change carries the risk of breaking clients. Contract testing catches breaking changes before deployment by comparing schema versions and validating that client queries still work against the new schema. This post covers what counts as a breaking change, how to use GraphQL Inspector for schema
Testing
Stripe webhooks are the backbone of payment processing — they notify your application when payments succeed, subscriptions change, and invoices are due. But webhook endpoints are notoriously hard to test: they need HTTPS, a signature verification step, and they handle async events that don't return values. This guide covers
Testing
Nuxt 3's server directory provides a full Node.js server powered by H3, Nitro, and unjs utilities. Server routes in /server/api/, middleware in /server/middleware/, and utilities in /server/utils/ are testable as regular HTTP handlers — you don't need to spin up a browser to
Rust
End-to-end API testing in Rust has two distinct challenges: running tests fast enough that developers actually run them, and isolating your system from external HTTP dependencies without rewriting your production code. cargo-nextest solves the first problem — it runs tests in parallel processes with better output than cargo
Testing
OneSignal abstracts the complexity of FCM and APNS behind a unified REST API, but that means your integration is only as reliable as your HTTP layer. This guide covers testing OneSignal notification delivery, segment targeting, A/B test setup, and delivery reporting using Python with requests-mock and httpretty — all
API Testing
Kong API Gateway sits between your clients and your services. It handles authentication, rate limiting, routing, transformations, and more — all through plugins. Testing Kong configurations catches issues before they reach production: misconfigured rate limits, broken auth chains, routing errors, and plugin interactions that work in isolation but conflict when combined.
API Testing
AWS API Gateway is notoriously difficult to test. Its configuration is spread across stages, integrations, authorizers, and models — none of which is easily testable in isolation. This guide covers pragmatic strategies: unit-testing Lambda authorizers, using mock integrations for downstream isolation, testing with CDK constructs, and integration testing against real
Testing
Every third-party API integration needs tests — but mocking, contract testing, and real integration testing each have different tradeoffs. Mocks are fast but drift from reality. Real integration tests are accurate but slow and expensive. Contract tests are the middle ground that most teams miss. This guide covers when to
Security Testing
Dynamic Application Security Testing (DAST) probes your running application for vulnerabilities — sending real HTTP requests and observing how the server responds. OWASP ZAP and Burp Suite are the two most widely used tools. This guide covers what each finds, how to automate scans in CI, and how to interpret the
Testing
Strapi v5 exposes content via REST and GraphQL APIs. Testing these APIs involves three layers: unit tests for custom service logic, integration tests against a running Strapi instance with a test database, and permission tests that verify role-based access. This guide covers all three using Jest and Supertest. Key
API Testing
RESTler is a stateful REST API fuzzer from Microsoft Research. Unlike simple fuzzers that hit each endpoint independently, RESTler infers the relationships between API calls — it knows that you must create a user before you can update it, and that updating requires the ID returned by creation. This stateful awareness
API Testing
Schemathesis and Dredd both test APIs against their OpenAPI specifications. They're often mentioned in the same breath, which leads teams to think they're interchangeable. They're not. They find different bugs, in different ways, with different tradeoffs. Understanding the distinction helps you deploy the right