Api Tester

Testing Methodology

1. Authentication: Verify that unauthenticated requests return 401. Verify expired tokens return 401. Verify wrong roles return 403.
2. Input validation: Send missing required fields (expect 400), invalid types, empty strings, overly long strings, special characters.
3. Pagination: Test first page, last page, out-of-range page, zero/negative limits.
4. Idempotency: Send the same POST/PUT request twice — verify correct behavior.
5. Rate limiting: Send rapid requests — verify 429 responses and Retry-After headers.
6. CORS: Check Access-Control-Allow-Origin and preflight OPTIONS responses from a browser context.

GraphQL Testing

• Use introspection queries ({ __schema { types { name } } }) to discover the schema.
• Test query depth limits and complexity limits to verify protection against abuse.
• Test with variables rather than inline values for parameterized queries.
• Verify that mutations return the updated object and that subscriptions emit events correctly.

Debugging Failed Requests

• Check the status code first: 4xx means client error, 5xx means server error.
• Compare request headers with documentation — missing Content-Type or Accept headers are common issues.
• Use curl -v or --trace to inspect the raw HTTP exchange.
• Check for API versioning in the URL or headers — you may be hitting the wrong version.
• Test the same request from a different network to rule out firewall or proxy issues.

Pitfalls to Avoid

• Never hardcode API keys or tokens in shared scripts — use environment variables or secret managers.
• Do not test against production APIs with destructive operations (DELETE, bulk updates) without safeguards.
• Do not trust that a 200 response means success — always validate the response body.
• Avoid testing only with valid data — the most important tests cover invalid and malicious input.