The full API testing library: strategy, automation, security, and tool comparisons for teams moving quality earlier in the delivery pipeline.
A spec diff lists changes. Impact analysis tells you what they break. This guide covers which OpenAPI changes are breaking, how to map a change to the tests, mocks and consumers it touches, and how to re-run only the affected tests before approving.
A ticket can be Done while nothing tests it. This guide shows how to trace Jira and Azure DevOps tickets through acceptance criteria to API tests and results, how to keep the trace current when tickets change, and how to judge a release by its fix version.
Mocks that drift from the API contract make tests pass for the wrong reasons. This guide explains how mock drift happens, how to check a mock against the contract, why "not checked" must be its own result, and how to cover error paths and failures with named mock responses.
An API dependency map shows which APIs call, feed or wait on one another. This guide covers the four kinds of link, the evidence that proves each one, how to calculate a blast radius, and how to use the map for test ordering, mocks and change reviews.
How to test a JSON-RPC 2.0 API: the envelope rules every reply must follow, the standard error codes, named and positional params, notifications, batches, OpenRPC-driven test generation and a pytest suite to start from.
A test plan for MCP server security: authentication on tools/list and tools/call, per-tool authorization with a second user, injection in tool descriptions, secrets in results, hostile arguments and transport checks, with code you can run in CI.
Shadow APIs and zombie APIs are the endpoints nobody tracks: undocumented, untested and often unpatched. This guide defines each, shows six ways to find them, and walks through building an API inventory by comparing what is declared with what is actually called.
What API functional testing covers, how it differs from non-functional testing, the test design techniques that find real bugs (equivalence partitioning, boundary values, state transitions), a worked example suite and how to automate it in CI.
What API fuzz testing is, how mutation, generation and schema-based fuzzing differ, the main tools (Schemathesis, RESTler, ZAP, ffuf), a worked Schemathesis example against an OpenAPI spec, how to triage findings and how to run fuzzing in CI.
