All ResourcesPublic Sector • ZIP: CSV pack + checklist + guide

Public Sector API Test-Case Pack

Citizen identity and assurance levels, case management, eligibility rules, records requests and inter-agency data sharing

What's inside:

Citizen identity: OpenID Connect, PKCE, nonce and assurance-level cases
Case management and caseworker access-control cases
Eligibility rule boundaries, records requests and data-sharing cases
Self-hosted deployment and audit checklist included

For: QA and platform teams in government and public bodies

Get your free copy

Enter your email and we'll send the download link to your inbox.

No spam. Unsubscribe anytime. We respect your privacy.

Preview: Public Sector API Test-Case Pack

This page shows roughly the first 20% of the pack so you can judge it before you download. The full ZIP contains 5 files: public-sector-api-test-cases.csv, public-sector-api-test-cases-guide.pdf, public-sector-api-test-cases-guide.md, deployment-audit-checklist.csv, self-hosted-api-testing-deployment-checklist.pdf.

About this pack

Government APIs decide entitlements and share records between agencies. The defects that matter are wrong decisions at rule boundaries, citizens or caseworkers seeing records they should not, and disclosures that cannot be explained afterwards. These cases cover identity, access, rules and disclosure.

public-sector-api-test-cases.csv has 30 cases. Each names the domain area, the request, the expected result, a type, a priority and the public standard or document it was written against. Replace placeholders in {braces} with your own paths, identifiers and data.

Areas covered

Domain areaCases
Citizen identity6
Case management6
Eligibility5
Records requests2
Inter-agency data sharing5
Fees and payments2
Notifications1
Data validation2
Languages1

Public sector API test cases

public-sector-api-test-cases.csv · showing 6 of 30 rows. Citizen identity, case management, eligibility, records requests and data sharing.

  1. GOV-001

    Citizen sign-in with authorization code and PKCE

    Domain Area
    Citizen identity
    Preconditions
    Service registered with the identity provider (IdP)
    Input / Request
    Authorize with code_challenge (S256), state and nonce; exchange the code with the code_verifier
    Expected Result
    Tokens issued; ID token signature valid; iss, aud, exp and nonce match
    Type
    Positive
    Priority
    P1
    Reference
    OpenID Connect Core 1.0; RFC 7636 (PKCE)

  2. GOV-002

    Replayed or mismatched nonce is refused

    Domain Area
    Citizen identity
    Preconditions
    ID token issued for nonce N1
    Input / Request
    Service validates an ID token against nonce N2, or accepts the same ID token twice
    Expected Result
    Token rejected; session not created
    Type
    Security
    Priority
    P1
    Reference
    OpenID Connect Core 1.0

  3. GOV-003

    ID token from the wrong issuer or audience is refused

    Domain Area
    Citizen identity
    Preconditions
    Token issued for another service
    Input / Request
    Present it to the service's token-validation endpoint or session API
    Expected Result
    Rejected
    Type
    Security
    Priority
    P1
    Reference
    OpenID Connect Core 1.0

  4. GOV-004

    Service requiring higher assurance asks for step-up

    Domain Area
    Citizen identity
    Preconditions
    Citizen signed in at a lower assurance level (acr)
    Input / Request
    Call an operation configured to need a higher level
    Expected Result
    401/403 with a step-up signal, or redirect with acr_values for the higher level; no data before step-up
    Type
    Security
    Priority
    P1
    Reference
    OpenID Connect Core 1.0 (acr); NIST SP 800-63-3 / eIDAS levels of assurance

  5. GOV-005

    Assurance level in the token matches what the IdP proved

    Domain Area
    Citizen identity
    Preconditions
    IdP test users at each level
    Input / Request
    Sign in as each; read the acr claim
    Expected Result
    acr matches the user's proven level; services read it rather than assuming
    Type
    Positive
    Priority
    P2
    Reference
    NIST SP 800-63-3 / eIDAS levels of assurance

  6. GOV-006

    Session ends at logout across the service

    Domain Area
    Citizen identity
    Preconditions
    Signed-in citizen
    Input / Request
    Logout through the service; then call a protected API with the old session
    Expected Result
    401; IdP session ended or logout propagated per your configuration
    Type
    Positive
    Priority
    P2
    Reference
    OpenID Connect RP-Initiated Logout 1.0

The rest of the pack

70 rows across 2 CSV files, and all 6 sections of the guide as PDF and Markdown. Enter your work email above and we will send the download link.

Related reading

Want to automate your API testing?

Generate tests from OpenAPI specs, run in CI/CD, and scale quality across teams.

Start TrialBook Demo