Generate API Test Cases from Swagger: Your First Project

This is lesson 9.1 of Shift-Left API in Depth, the product track of the learning center. You need nothing installed to follow the concept part; for the demo, use the free edition of Shift-Left API and the public sandbox store API.

How do you generate API test cases from Swagger?

You don't start from a blank page. A Swagger or OpenAPI spec already describes every endpoint, every field and every rule for what's valid. That is most of a test plan, written down. To generate API test cases from Swagger, you read that contract and test both sides of every rule in it.

What a spec tells you

Take the sandbox store's schema for creating a user:

• name is required, from 1 to 100 characters
• email must be a valid email address
• role is one of user, admin or moderator
• age is a whole number from 0 to 150

Every one of those limits is a test. A valid user should be created. A missing name, a bad email or an age of 151 should be rejected. And the edges, 0 and 150, should still pass. That is swagger test case generation in a nutshell: positive cases that must be accepted, negative cases that must be refused, and boundary cases right on each limit.

Import a spec into Shift-Left API

1. Click Project, give it a name (and a description if you like), and create it. A new project opens straight into Import API.
2. Choose the API type, or leave it on Auto-detect: REST from OpenAPI or Swagger, SOAP from WSDL, or GraphQL.
3. Paste the spec's URL and import it. For the sandbox, that's https://demo.totalshiftleft.ai/openapi/rest.json.

Shift-Left API reads the whole document and creates features and endpoints from it, then shows a Swagger view of what it imported. Notice what that view says: no tests yet. A spec describes endpoints; the tests come next.

A URL is the quickest way in. There are other ways in, too: upload an OpenAPI or Swagger spec in JSON or YAML, a WSDL, a GraphQL schema or a Postman collection, or paste a cURL command or the spec text itself.

Explore features and endpoints

The spec's tags become features. For the sandbox store that's demo data, users, orders, products and the protected store, with 38 endpoints between them. Each feature shows its endpoint count, its tests and its coverage, all at zero for now.

Open Users, then double-click an endpoint (or click Edit on its row). Every field came from the spec: name, path, method, tags, description, summary and operation ID, then the parameters, the request body with the user schema, and the responses it can return, such as 201 when the user is created and 400 when validation fails.

OpenAPI: generate test cases

On the endpoint, click Generate tests. In a few seconds you have a full set built from the spec, and the summary reads Requirements: not used. You don't need a single requirements document to get started.

The new tests are the same cases worked out above: positive tests that should be accepted, and negative and boundary tests for every limit in the schema, each with a severity.

• To cover a whole feature at once, use Generate Tests for All. Every endpoint gets its tests, and the counts and coverage fill in.
• To choose the techniques, open Project Settings → AI Generation: positive, negative, boundary, pairwise, auth, schema fuzzing and more, switched on or off per project. Lesson 9.5 covers these strategies in depth.

Try it yourself

Create a project, import the sandbox spec from https://demo.totalshiftleft.ai/openapi/rest.json, open Users, and generate tests for Create a new user. Check the summary: how many tests did you get, and which one checks the age limit?

Recap

• An OpenAPI or Swagger spec already holds your test plan: every field, limit and response.
• Import it by URL, file or paste, and it becomes features and endpoints.
• Generate API test cases from Swagger one endpoint or one feature at a time, with no requirements needed.

A spec tells you what's valid, not your business rules. Next, in lesson 9.2, you add a requirements document and see how each requirement maps onto these endpoints. For the background on how generation works, read how AI generates API tests from OpenAPI.